toolcraft 0.0.313 → 0.0.315

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,141 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
+// ../mcp-oauth/dist/client/token-auth-method.js
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
+}
+
+// ../mcp-oauth/dist/client/client-registration.js
+function parseOAuthClientRegistration(value) {
+  const invalid = () => new Error("Invalid OAuth client registration metadata");
+  let nodes = 0;
+  function copy(input, depth) {
+    if (++nodes > 2e4 || depth > 64)
+      throw invalid();
+    if (input === null || typeof input === "boolean" || typeof input === "string")
+      return input;
+    if (typeof input === "number" && Number.isFinite(input))
+      return input;
+    if (typeof input !== "object" || input === null)
+      throw invalid();
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    if (Array.isArray(input)) {
+      const length = descriptors.length?.value;
+      if (length > 2e4)
+        throw invalid();
+      const result2 = [];
+      for (let index = 0; index < length; index++) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === void 0 || !Object.hasOwn(descriptor, "value"))
+          throw invalid();
+        result2.push(copy(descriptor.value, depth + 1));
+      }
+      return result2;
+    }
+    if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+      throw invalid();
+    return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key2, descriptor]) => {
+      if (!Object.hasOwn(descriptor, "value"))
+        throw invalid();
+      return [key2, copy(descriptor.value, depth + 1)];
+    }));
+  }
+  let result;
+  try {
+    result = copy(value, 0);
+  } catch {
+    throw invalid();
+  }
+  if (typeof result !== "object" || result === null || Array.isArray(result))
+    throw invalid();
+  const record2 = result;
+  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
+    throw new Error("OAuth client registration response missing client_id");
+  for (const key2 of [
+    "client_id",
+    "client_secret",
+    "token_endpoint_auth_method",
+    "application_type",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "scope",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "software_id",
+    "software_version",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "issuer"
+  ]) {
+    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string")
+      throw invalid();
+  }
+  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "")
+    throw invalid();
+  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string")))
+      throw invalid();
+  }
+  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+      throw invalid();
+  }
+  try {
+    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
+  } catch {
+    throw invalid();
+  }
+  if (Buffer.byteLength(JSON.stringify(record2), "utf8") > 64 * 1024)
+    throw invalid();
+  return record2;
+}
+function normalizeStoredOAuthClient(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record2 = value;
+  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
+  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
+  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
+    return null;
+  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record2, "tokenEndpointAuthMethod") ? record2.tokenEndpointAuthMethod : void 0);
+  if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
+    const registration = parseOAuthClientRegistration(record2.registration);
+    const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
+    if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+      throw new Error("OAuth client registration does not match the client identity");
+    client.registration = registration;
+    const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : void 0);
+    if (method !== void 0 && registrationMethod !== void 0 && method !== registrationMethod)
+      throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+    if (registrationMethod !== void 0)
+      client.tokenEndpointAuthMethod = registrationMethod;
+  }
+  if (method !== void 0)
+    client.tokenEndpointAuthMethod = method;
+  return client;
+}
+
 // ../mcp-oauth/dist/client/auth-store-session-store.js
 import crypto from "node:crypto";
 import path4 from "node:path";
@@ -4128,14 +4263,8 @@ function createAuthStoreClientStore(options, namespace) {
       } catch {
         throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
-      if (clientId !== void 0) {
-        const client = { clientId };
-        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-          client.clientSecret = getOwnEntry3(parsed, "clientSecret");
-        }
-        return client;
-      }
+      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
+        return parsed;
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
     async save(issuer, client) {
@@ -4201,14 +4330,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
-}
-function isStoredOAuthClient(value) {
-  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-    return false;
-  }
-  const clientSecret = getOwnEntry3(value, "clientSecret");
-  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthDiscovery(value) {
   if (!isObjectRecord(value)) {
@@ -4655,6 +4777,7 @@ async function exchangeAuthorizationCode(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "authorization_code",
       code: input.code,
@@ -4673,6 +4796,7 @@ async function refreshAccessToken(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "refresh_token",
       refresh_token: input.refreshToken,
@@ -4684,21 +4808,26 @@ async function refreshAccessToken(input) {
   });
 }
 async function requestTokens(input) {
-  const body = new URLSearchParams({
-    client_id: input.clientId,
-    ...input.params
-  });
-  if (input.clientSecret !== void 0) {
-    body.set("client_secret", input.clientSecret);
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
   }
   input.signal?.throwIfAborted();
   const deadline = AbortSignal.timeout(3e4);
   const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
   const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: body.toString(),
     signal
   });
@@ -4726,7 +4855,9 @@ async function requestTokens(input) {
   const refreshToken = getOwnEntry5(payload, "refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : void 0;
+  const normalizedScope = normalizeOAuthScope(scope);
+  if (scope !== void 0 && normalizedScope === void 0)
+    throw new Error("Invalid OAuth scope syntax in token response");
   return {
     accessToken: normalizedAccessToken,
     refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
@@ -4847,6 +4978,11 @@ function createOAuthClientProvider(options) {
 function createDefaultOAuthClientProvider(options) {
   loopbackTarget(options.browser);
   assertPersistenceNamespace(options.persistenceNamespace);
+  const clientMetadata = getClientMetadata(options.client);
+  const requestedScope = clientMetadata?.scope;
+  const configuredClient = normalizeConfiguredClient(options.client);
+  const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+  const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4864,11 +5000,13 @@ function createDefaultOAuthClientProvider(options) {
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
     tokens: normalizeStoredTokens(options.initialGrant.tokens),
-    client: normalizeConfiguredClient(options.client)
+    client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
   if (initialGrant?.tokens !== void 0) {
+    if (requestedScope !== void 0 && initialGrant.tokens.scope !== requestedScope)
+      throw new Error("OAuth initial grant does not match the requested OAuth scope");
     try {
       new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
     } catch {
@@ -4956,6 +5094,7 @@ function createDefaultOAuthClientProvider(options) {
           authorizationServer: discovery.authorizationServer,
           client: initialGrant.client,
           tokens: initialGrant.tokens,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(canonicalResource, session);
@@ -4965,11 +5104,15 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
-        const configured = normalizeConfiguredClient(options.client);
+      if ((options.client.mode === "static" || configuredClient?.registration !== void 0 || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+        const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
       }
+      if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+        throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+      if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
+        throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5002,6 +5145,7 @@ function createDefaultOAuthClientProvider(options) {
     if (session.tokens?.refreshToken === void 0) {
       return session;
     }
+    assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
     const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
     await saveSession(resource, pendingSession);
     signal?.throwIfAborted();
@@ -5013,6 +5157,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: session.client.clientId,
           clientSecret: session.client.clientSecret,
+          tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
           refreshToken: session.tokens.refreshToken,
           resource,
           fetch: fetch2,
@@ -5046,10 +5191,13 @@ function createDefaultOAuthClientProvider(options) {
       ...session,
       tokens: {
         ...refreshedTokens,
-        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+        scope: refreshedTokens.scope ?? session.tokens.scope
       },
       discovery: toStoredDiscovery(discovery)
     };
+    if (requestedScope !== void 0 && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+      throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
     await saveSession(resource, updatedSession);
     return updatedSession;
   }
@@ -5073,10 +5221,12 @@ function createDefaultOAuthClientProvider(options) {
       let resolvedClient = null;
       try {
         resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
+        assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
         const sessionWithoutTokens = {
           resource,
           authorizationServer: discovery.authorizationServer,
           client: resolvedClient.client,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(resource, sessionWithoutTokens);
@@ -5088,13 +5238,14 @@ function createDefaultOAuthClientProvider(options) {
           clientId: resolvedClient.client.clientId,
           redirectUri: loopback.redirectUri,
           codeChallenge: challenge,
-          clientMetadata: getClientMetadata(options.client)
+          clientMetadata
         });
         const code = await loopback.waitForCode(authorizationUrl);
         const tokens = await exchangeAuthorizationCode({
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: resolvedClient.client.clientId,
           clientSecret: resolvedClient.client.clientSecret,
+          tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
           code,
           codeVerifier: verifier,
           redirectUri: loopback.redirectUri,
@@ -5103,6 +5254,8 @@ function createDefaultOAuthClientProvider(options) {
           signal,
           now
         });
+        if (requestedScope !== void 0 && tokens.scope !== void 0 && normalizeOAuthScope(tokens.scope) !== requestedScope)
+          throw new Error("OAuth authorization response does not match the requested OAuth scope");
         const session = {
           ...sessionWithoutTokens,
           tokens
@@ -5132,8 +5285,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    const configuredClient = normalizeConfiguredClient(options.client);
-    if (options.client.mode === "static") {
+    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5180,7 +5332,11 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+    const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+    const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));
+    if (registrationMethod === void 0 || supported !== void 0 && !supported.includes(registrationMethod))
+      throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5192,14 +5348,14 @@ function createDefaultOAuthClientProvider(options) {
       signal
     });
     const payload = await readOAuthJsonObjectResponse(response, signal);
-    const clientId = getOwnString2(payload, "client_id");
-    if (clientId === void 0 || clientId.trim().length === 0) {
-      throw new Error("OAuth client registration response missing client_id");
-    }
-    const clientSecret = getOwnString2(payload, "client_secret");
+    const registration = parseOAuthClientRegistration(payload);
+    const registeredSecret = getOwnString2(registration, "client_secret");
+    const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry6(registration, "token_endpoint_auth_method")) ?? requestedTokenMethod ?? (supported === void 0 ? void 0 : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
     const registeredClient = {
-      clientId: clientId.trim(),
-      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
+      clientId: registration.client_id.trim(),
+      ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
+      registration
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -5212,7 +5368,7 @@ function createDefaultOAuthClientProvider(options) {
     return normalizeLoadedSession(await sessionStore.load(resource));
   }
   async function saveSession(resource, session) {
-    await sessionStore.save(resource, session);
+    await sessionStore.save(resource, structuredClone(session));
   }
   async function clearSession(resource) {
     await sessionStore.clear(resource);
@@ -5225,7 +5381,7 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
     if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
@@ -5298,7 +5454,7 @@ function normalizeLoadedSession(session) {
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
-  const client = normalizeStoredClient(getOwnEntry6(session, "client"));
+  const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
@@ -5308,25 +5464,6 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
-function normalizeStoredClient(value) {
-  if (!isObjectRecord3(value)) {
-    return null;
-  }
-  const clientId = getOwnString2(value, "clientId");
-  if (clientId === void 0 || clientId.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientId = clientId.trim();
-  const clientSecret = getOwnEntry6(value, "clientSecret");
-  if (clientSecret === void 0) {
-    return { clientId: normalizedClientId };
-  }
-  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
-    return null;
-  }
-  const normalizedClientSecret = clientSecret.trim();
-  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
-}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5335,10 +5472,10 @@ function normalizeStoredTokens(value) {
   const tokenType = getOwnString2(value, "tokenType");
   const expiresAt = getOwnEntry6(value, "expiresAt");
   const refreshToken = getOwnEntry6(value, "refreshToken");
-  const scope = getOwnString2(value, "scope");
+  const scope = getOwnEntry6(value, "scope");
   const normalizedAccessToken = accessToken?.trim();
   const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
-  const normalizedScope = scope?.trim();
+  const normalizedScope = normalizeOAuthScope(scope);
   if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
@@ -5356,18 +5493,18 @@ function getClientMetadata(client) {
   }
   return {
     clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-    scope: normalizeOptionalOAuthString(client.metadata.scope),
+    scope: normalizeOAuthScope(client.metadata.scope),
     softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
     softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
   };
 }
 function normalizeConfiguredClient(client) {
-  const clientId = normalizeOptionalOAuthString(client.clientId);
-  if (clientId === void 0) {
+  const registration = client.registration === void 0 ? void 0 : parseOAuthClientRegistration(client.registration);
+  const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+  if (clientId === void 0)
     return null;
-  }
-  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
-  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {
@@ -5467,12 +5604,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+  const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value) || value.length > 128 || value.some((method) => typeof method !== "string"))
+    throw new Error("Invalid OAuth token endpoint authentication metadata");
+  return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+  const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && client.clientSecret === void 0)
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const supported = getSupportedTokenAuthMethods(metadata);
+  if (supported !== void 0 && !supported.includes(method))
+    throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
   const body = {
     redirect_uris: [redirectUri],
     grant_types: ["authorization_code", "refresh_token"],
     response_types: ["code"],
-    token_endpoint_auth_method: "none"
+    token_endpoint_auth_method: tokenEndpointAuthMethod
   };
   const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
   const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.313",
+      "version": "0.0.315",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.313",
+  "version": "0.0.315",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.313",
+  "version": "0.0.315",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.313",
+    "toolcraft-schema": "0.0.315",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",