toolcraft 0.0.311 → 0.0.313

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.28",
+      "version": "0.1.31",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.311",
+      "version": "0.0.313",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.311",
+      "version": "0.0.313",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.28",
+      "version": "0.1.31",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.311",
+      "version": "0.0.313",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.311",
+      "version": "0.0.313",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -56,6 +56,10 @@ directory or filesystem adapter. Injected encrypted-file adapters need
 - Configurable salt, directory, and file name
 - File permissions: `0600`
 - Random IV per write
+- `fileStore.throwOnInvalidDocument: true` makes malformed or unauthenticated
+  existing documents fail with a safe diagnostic; missing files still return
+  `null`. The default treats invalid documents as absent. Strict reads preserve
+  the existing file until an explicit reset or replacement.
 
 ### macOS Keychain
 

package/node_modules/auth-store/dist/encrypted-file-store.d.ts

@@ -31,6 +31,8 @@ export interface EncryptedFileStoreInput {
     getMachineIdentity?: () => MachineIdentity | Promise<MachineIdentity>;
     getHomeDirectory?: () => string;
     getRandomBytes?: (size: number) => Buffer;
+    /** Fail closed instead of treating malformed or unauthenticated documents as absent. */
+    throwOnInvalidDocument?: boolean;
 }
 export declare class EncryptedFileStore implements SecretStore {
     private readonly fs;
@@ -40,6 +42,7 @@ export declare class EncryptedFileStore implements SecretStore {
     private readonly getMachineIdentity;
     private readonly getRandomBytes;
     private keyPromise;
+    private readonly throwOnInvalidDocument;
     constructor(input: EncryptedFileStoreInput);
     get(): Promise<string | null>;
     withLock<T>(operation: () => Promise<T>, options?: SecretStoreLockOptions): Promise<T>;

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -19,6 +19,7 @@ export class EncryptedFileStore {
     getMachineIdentity;
     getRandomBytes;
     keyPromise = null;
+    throwOnInvalidDocument;
     constructor(input) {
         this.fs = input.fs ?? fs;
         this.salt = input.salt;
@@ -37,6 +38,7 @@ export class EncryptedFileStore {
         }
         this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
         this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+        this.throwOnInvalidDocument = input.throwOnInvalidDocument ?? false;
     }
     async get() {
         await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
@@ -52,6 +54,8 @@ export class EncryptedFileStore {
         }
         const document = parseEncryptedDocument(rawDocument);
         if (!document) {
+            if (this.throwOnInvalidDocument)
+                throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
             return null;
         }
         const key = await this.getEncryptionKey();
@@ -61,6 +65,8 @@ export class EncryptedFileStore {
             const ciphertext = Buffer.from(document.ciphertext, "base64");
             if (iv.byteLength !== ENCRYPTION_IV_BYTES ||
                 authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+                if (this.throwOnInvalidDocument)
+                    throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
                 return null;
             }
             const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
@@ -69,6 +75,8 @@ export class EncryptedFileStore {
             return plaintext.toString("utf8");
         }
         catch {
+            if (this.throwOnInvalidDocument)
+                throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
             return null;
         }
     }

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.28",
+      "version": "0.1.31",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -42,6 +42,7 @@ const verifier = createJwksTokenVerifier({
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
 - `sessionLockTimeoutMs` limits acquisition waits for a session transaction lock (default 30,000 ms; integer from 1 to 2147483647)
+- `persistenceNamespace` isolates native sessions and registrations for a named profile (nonempty string, at most 1024 UTF-8 bytes)
 - `initialGrant: { resource, tokens }` optionally imports an existing Bearer grant for one HTTP resource; requires the original client ID
 - `browser.openBrowser(url)` optional
 - `browser.readLine()` optional
@@ -104,6 +105,17 @@ Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Static clients and dynamic initial-grant imports require cached grants to match
+the original normalized client ID and secret. A different client configuration
+fails before attaching or refreshing credentials and retains the stored record;
+select separate persistence or explicitly reset the session to change apps.
+Use `persistenceNamespace: "personal"` or `"work"` to keep separate native
+profiles for the same resource/issuer. `createAuthStoreSessionStore(options,
+namespace)` addresses the same profile when seeding or inspecting credentials.
+Namespaces are hashed into file/Keychain identities and transaction locks;
+omitting one preserves the default storage keys. Switching namespaces selects a
+different record and does not migrate or reset the previous profile. Host-owned
+`sessionStore` implementations remain responsible for their own profile keys.
 
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 
@@ -130,6 +142,12 @@ can recover it; headless requests fail with an explicit unknown-outcome error.
 Only complete OAuth error responses establish a rejected request and allow a
 transient retry or restoration of the original grant. Gateway error pages do not.
 
+Native persisted OAuth reads always reject corrupt encrypted documents and
+invalid stored JSON, with diagnostics that omit decrypted contents. They retain
+the existing record for explicit reset rather than interpreting corruption as
+an absent session and reviving an initial grant. Caller file-backend settings
+cannot disable this policy.
+
 ## Environment Variables
 
 This package exposes no direct environment variables. When `authStore` is used,

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -9,6 +9,7 @@ export interface OAuthClientStore {
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
     clear(issuer: string): Promise<void>;
 }
-export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput): OAuthSessionStore;
-export declare function createAuthStoreClientStore(options: CreateSecretStoreInput): OAuthClientStore;
+export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
+export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
+export declare function assertPersistenceNamespace(namespace: string | undefined): void;
 export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -9,45 +9,59 @@ const DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
 const DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
 const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
-export function createAuthStoreSessionStore(options = {}) {
+export function createAuthStoreSessionStore(options = {}, namespace) {
+    assertPersistenceNamespace(namespace);
     return {
         async withLock(resource, operation, lockOptions) {
-            const store = createResourceSecretStore(resource, options);
+            const store = createResourceSecretStore(resource, options, namespace);
             if (store.withLock === undefined)
                 throw new Error("OAuth secret-store backend does not support transaction locks");
             return store.withLock(operation, lockOptions);
         },
         async load(resource) {
-            const store = createResourceSecretStore(resource, options);
+            const store = createResourceSecretStore(resource, options, namespace);
             const value = await store.get();
             if (value === null) {
                 return null;
             }
-            const parsed = JSON.parse(value);
+            let parsed;
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
+            }
             if (isStoredOAuthSession(parsed)) {
                 return parsed;
             }
             throw new Error("Stored OAuth session must match the expected shape");
         },
         async save(resource, session) {
-            const store = createResourceSecretStore(resource, options);
+            const store = createResourceSecretStore(resource, options, namespace);
             await store.set(JSON.stringify(session));
         },
         async clear(resource) {
-            const store = createResourceSecretStore(resource, options);
+            const store = createResourceSecretStore(resource, options, namespace);
             await store.delete();
         }
     };
 }
-export function createAuthStoreClientStore(options) {
+export function createAuthStoreClientStore(options, namespace) {
+    assertPersistenceNamespace(namespace);
     return {
         async load(issuer) {
-            const store = createIssuerSecretStore(issuer, options);
+            const store = createIssuerSecretStore(issuer, options, namespace);
             const value = await store.get();
             if (value === null) {
                 return null;
             }
-            const parsed = JSON.parse(value);
+            let parsed;
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
+            }
             const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
             if (clientId !== undefined) {
                 const client = { clientId };
@@ -60,21 +74,22 @@ export function createAuthStoreClientStore(options) {
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
-            const store = createIssuerSecretStore(issuer, options);
+            const store = createIssuerSecretStore(issuer, options, namespace);
             await store.set(JSON.stringify(client));
         },
         async clear(issuer) {
-            const store = createIssuerSecretStore(issuer, options);
+            const store = createIssuerSecretStore(issuer, options, namespace);
             await store.delete();
         }
     };
 }
-function createNamedSecretStore(key, options, defaults) {
-    const hash = crypto.createHash("sha256").update(key).digest("hex");
+function createNamedSecretStore(key, options, defaults, namespace) {
+    const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
     const fileStore = {
         ...options.fileStore,
+        throwOnInvalidDocument: true,
         filePath: parsedFilePath === null
             ? undefined
             : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
@@ -91,21 +106,25 @@ function createNamedSecretStore(key, options, defaults) {
     };
     return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
-function createResourceSecretStore(resource, options) {
+function createResourceSecretStore(resource, options, namespace) {
     return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
         salt: DEFAULT_FILE_SALT,
         directory: DEFAULT_FILE_DIRECTORY,
         service: DEFAULT_KEYCHAIN_SERVICE,
         accountPrefix: "provider"
-    });
+    }, namespace);
 }
-function createIssuerSecretStore(issuer, options) {
+function createIssuerSecretStore(issuer, options, namespace) {
     return createNamedSecretStore(issuer, options, {
         salt: DEFAULT_CLIENT_FILE_SALT,
         directory: DEFAULT_CLIENT_FILE_DIRECTORY,
         service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
         accountPrefix: "issuer"
-    });
+    }, namespace);
+}
+export function assertPersistenceNamespace(namespace) {
+    if (namespace !== undefined && (typeof namespace !== "string" || namespace.trim() === "" || Buffer.byteLength(namespace, "utf8") > 1024))
+        throw new Error("OAuth persistence namespace must be a nonempty string within 1024 bytes");
 }
 function isObjectRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,7 +1,7 @@
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
-import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
+import { createAuthStoreClientStore, createAuthStoreSessionStore, assertPersistenceNamespace } from "./auth-store-session-store.js";
 import { createLoopbackAuthorizationSession, loopbackTarget } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
@@ -17,8 +17,9 @@ export function createOAuthClientProvider(options) {
 }
 export function createDefaultOAuthClientProvider(options) {
     loopbackTarget(options.browser);
-    const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
-    const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
+    assertPersistenceNamespace(options.persistenceNamespace);
+    const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+    const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
@@ -140,6 +141,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
+            if ((options.client.mode === "static" || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = normalizeConfiguredClient(options.client);
+                if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
+                    throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
+            }
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -112,6 +112,8 @@ export interface DefaultOAuthClientProviderOptions {
     allowInteractive?: boolean;
     /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
     sessionLockTimeoutMs?: number;
+    /** Isolate native persisted sessions and registrations for a named profile. */
+    persistenceNamespace?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.28",
+  "version": "0.1.31",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -70,6 +70,8 @@ interface EncryptedFileStoreInput {
     getMachineIdentity?: () => MachineIdentity | Promise<MachineIdentity>;
     getHomeDirectory?: () => string;
     getRandomBytes?: (size: number) => Buffer;
+    /** Fail closed instead of treating malformed or unauthenticated documents as absent. */
+    throwOnInvalidDocument?: boolean;
 }
 
 interface KeychainCommandResult {
@@ -213,6 +215,8 @@ interface DefaultOAuthClientProviderOptions {
     allowInteractive?: boolean;
     /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
     sessionLockTimeoutMs?: number;
+    /** Isolate native persisted sessions and registrations for a named profile. */
+    persistenceNamespace?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3575,6 +3575,7 @@ var EncryptedFileStore = class {
   getMachineIdentity;
   getRandomBytes;
   keyPromise = null;
+  throwOnInvalidDocument;
   constructor(input) {
     this.fs = input.fs ?? fs;
     this.salt = input.salt;
@@ -3592,6 +3593,7 @@ var EncryptedFileStore = class {
     }
     this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
     this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+    this.throwOnInvalidDocument = input.throwOnInvalidDocument ?? false;
   }
   async get() {
     await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
@@ -3606,6 +3608,8 @@ var EncryptedFileStore = class {
     }
     const document = parseEncryptedDocument(rawDocument);
     if (!document) {
+      if (this.throwOnInvalidDocument)
+        throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
       return null;
     }
     const key2 = await this.getEncryptionKey();
@@ -3614,6 +3618,8 @@ var EncryptedFileStore = class {
       const authTag = Buffer.from(document.authTag, "base64");
       const ciphertext = Buffer.from(document.ciphertext, "base64");
       if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+        if (this.throwOnInvalidDocument)
+          throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
         return null;
       }
       const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key2, iv);
@@ -3621,6 +3627,8 @@ var EncryptedFileStore = class {
       const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
       return plaintext.toString("utf8");
     } catch {
+      if (this.throwOnInvalidDocument)
+        throw new Error("Invalid encrypted credential document; reset the store explicitly to recover");
       return null;
     }
   }
@@ -4069,45 +4077,57 @@ var DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
 var DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
 var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 var MAX_JS_DATE_MS = 864e13;
-function createAuthStoreSessionStore(options = {}) {
+function createAuthStoreSessionStore(options = {}, namespace) {
+  assertPersistenceNamespace(namespace);
   return {
     async withLock(resource, operation, lockOptions) {
-      const store = createResourceSecretStore(resource, options);
+      const store = createResourceSecretStore(resource, options, namespace);
       if (store.withLock === void 0)
         throw new Error("OAuth secret-store backend does not support transaction locks");
       return store.withLock(operation, lockOptions);
     },
     async load(resource) {
-      const store = createResourceSecretStore(resource, options);
+      const store = createResourceSecretStore(resource, options, namespace);
       const value = await store.get();
       if (value === null) {
         return null;
       }
-      const parsed = JSON.parse(value);
+      let parsed;
+      try {
+        parsed = JSON.parse(value);
+      } catch {
+        throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
+      }
       if (isStoredOAuthSession(parsed)) {
         return parsed;
       }
       throw new Error("Stored OAuth session must match the expected shape");
     },
     async save(resource, session) {
-      const store = createResourceSecretStore(resource, options);
+      const store = createResourceSecretStore(resource, options, namespace);
       await store.set(JSON.stringify(session));
     },
     async clear(resource) {
-      const store = createResourceSecretStore(resource, options);
+      const store = createResourceSecretStore(resource, options, namespace);
       await store.delete();
     }
   };
 }
-function createAuthStoreClientStore(options) {
+function createAuthStoreClientStore(options, namespace) {
+  assertPersistenceNamespace(namespace);
   return {
     async load(issuer) {
-      const store = createIssuerSecretStore(issuer, options);
+      const store = createIssuerSecretStore(issuer, options, namespace);
       const value = await store.get();
       if (value === null) {
         return null;
       }
-      const parsed = JSON.parse(value);
+      let parsed;
+      try {
+        parsed = JSON.parse(value);
+      } catch {
+        throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
+      }
       const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
       if (clientId !== void 0) {
         const client = { clientId };
@@ -4119,21 +4139,22 @@ function createAuthStoreClientStore(options) {
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
     async save(issuer, client) {
-      const store = createIssuerSecretStore(issuer, options);
+      const store = createIssuerSecretStore(issuer, options, namespace);
       await store.set(JSON.stringify(client));
     },
     async clear(issuer) {
-      const store = createIssuerSecretStore(issuer, options);
+      const store = createIssuerSecretStore(issuer, options, namespace);
       await store.delete();
     }
   };
 }
-function createNamedSecretStore(key2, options, defaults) {
-  const hash = crypto.createHash("sha256").update(key2).digest("hex");
+function createNamedSecretStore(key2, options, defaults, namespace) {
+  const hash = crypto.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
   const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
   const fileStore = {
     ...options.fileStore,
+    throwOnInvalidDocument: true,
     filePath: parsedFilePath === null ? void 0 : path4.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
     salt: options.fileStore?.salt ?? defaults.salt,
     defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
@@ -4146,21 +4167,25 @@ function createNamedSecretStore(key2, options, defaults) {
   };
   return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
-function createResourceSecretStore(resource, options) {
+function createResourceSecretStore(resource, options, namespace) {
   return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
     salt: DEFAULT_FILE_SALT,
     directory: DEFAULT_FILE_DIRECTORY,
     service: DEFAULT_KEYCHAIN_SERVICE,
     accountPrefix: "provider"
-  });
+  }, namespace);
 }
-function createIssuerSecretStore(issuer, options) {
+function createIssuerSecretStore(issuer, options, namespace) {
   return createNamedSecretStore(issuer, options, {
     salt: DEFAULT_CLIENT_FILE_SALT,
     directory: DEFAULT_CLIENT_FILE_DIRECTORY,
     service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
     accountPrefix: "issuer"
-  });
+  }, namespace);
+}
+function assertPersistenceNamespace(namespace) {
+  if (namespace !== void 0 && (typeof namespace !== "string" || namespace.trim() === "" || Buffer.byteLength(namespace, "utf8") > 1024))
+    throw new Error("OAuth persistence namespace must be a nonempty string within 1024 bytes");
 }
 function isObjectRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4821,8 +4846,9 @@ function createOAuthClientProvider(options) {
 }
 function createDefaultOAuthClientProvider(options) {
   loopbackTarget(options.browser);
-  const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
-  const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
+  assertPersistenceNamespace(options.persistenceNamespace);
+  const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+  const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
   const registeredClients = /* @__PURE__ */ new Map();
   if (options.initialGrant !== void 0) {
@@ -4939,6 +4965,11 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
+      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = normalizeConfiguredClient(options.client);
+        if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
+          throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
+      }
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.311",
+      "version": "0.0.313",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.311",
+  "version": "0.0.313",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.311",
+  "version": "0.0.313",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.311",
+    "toolcraft-schema": "0.0.313",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",