toolcraft 0.0.314 → 0.0.316

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.33",
+      "version": "0.1.36",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.314",
+      "version": "0.0.316",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.314",
+      "version": "0.0.316",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.33",
+      "version": "0.1.36",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.314",
+      "version": "0.0.316",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.314",
+      "version": "0.0.316",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.33",
+      "version": "0.1.36",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -106,12 +106,50 @@ Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
-`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
-and optional `scope`. A fresh imported token is used only for its resource.
+`tokenType: "Bearer"`, optional `expiresAt` (Unix epoch milliseconds or `null`
+if unknown), and optional `scope`. `expiresIn` is a lifetime in seconds and is
+anchored once at import. For a delayed import, provide the original `issuedAt`
+in epoch milliseconds or its real absolute `expiresAt`; a numeric absolute
+expiry takes precedence. Without either, the relative value means remaining
+lifetime at import. Omitted expiry stays unknown. A fresh imported token is
+used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
 Input tokens are copied and invalid expiry values fail before authorization.
+Pass a complete DCR response as `client.registration` (or validate untrusted JSON
+with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
+and secret from that response and reuse it without registering another app.
+Explicit ID/secret values must agree with the imported response. Sessions and
+native registration stores retain arrays, issuance/expiry timestamps and JSON
+provider metadata. Registration input is copied, bounded to 64 KiB and 64
+levels, and rejects invalid standard field types and non-JSON extensions.
+An optional registration `issuer` must match discovery and the persisted
+authorization server exactly. Contradictory metadata fails without activating
+or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;
+zero means no expiry. Live access tokens remain usable after secret expiry,
+but an expired secret is never submitted for refresh. Native DCR can replace
+an expired registration during explicit authorization; caller-owned imports
+must be updated. Headless requests retain the old record and report recovery
+is required without creating a pending refresh marker.
+Native registrations retain `requestedRedirectUri`, the actual listener URI
+submitted to DCR, separately from the full response metadata. Fresh responses
+may normalize a loopback port or represent IPv4 loopback as portless localhost;
+host, path, scheme, query and fragment differences outside that boundary fail.
+Authorization and code exchange always use the actual listener URI. Silent
+refresh keeps its original client regardless of callback changes. At interactive
+authorization, a native registration with an obsolete captured callback is
+replaced; caller-owned full registration imports retain their original identity.
+Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
+`client_secret_basic`; a full registration can supply the same field as
+`token_endpoint_auth_method`. Public clients never transmit a stored secret.
+Basic credentials are individually form-encoded before Base64 encoding and
+are omitted from the form body. Cached grants retain their registered method;
+an explicitly different configured method requires separate persistence or a
+reset. Native DCR chooses a supported method, preferring public PKCE when
+advertised. Unsupported methods and missing confidential secrets fail before
+token requests. Existing clients without a method keep the previous default:
+body authentication when a secret is present, public authentication otherwise.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,9 +1,5 @@
 import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
+import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -12,4 +8,3 @@ export interface OAuthClientStore {
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
-export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import { createSecretStore } from "auth-store";
@@ -62,15 +63,10 @@ export function createAuthStoreClientStore(options, namespace) {
             catch {
                 throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
             }
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
+            // Preserve all registration metadata; provider normalization validates its
+            // identity and schema before it can authorize a request.
+            if (isObjectRecord(parsed) && typeof getOwnEntry(parsed, "clientId") === "string")
+                return parsed;
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
         async save(issuer, client) {
@@ -142,21 +138,13 @@ function isStoredOAuthSession(value) {
     }
     return (isNonBlankOwnString(value, "resource") &&
         isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        normalizeStoredOAuthClient(getOwnEntry(value, "client")) !== null &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
         (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
 }
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
 function isStoredOAuthDiscovery(value) {
     if (!isObjectRecord(value)) {
         return false;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
+export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export declare function registrationMatchesRedirect(client: StoredOAuthClient, requestedUri: string, fresh?: boolean): boolean;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -0,0 +1,148 @@
+import { loopbackTarget } from "./loopback-authorization.js";
+import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+export function parseOAuthClientRegistration(value) {
+    const invalid = () => new Error("Invalid OAuth client registration metadata");
+    let nodes = 0;
+    function copy(input, depth) {
+        if (++nodes > 20_000 || depth > 64)
+            throw invalid();
+        if (input === null || typeof input === "boolean" || typeof input === "string")
+            return input;
+        if (typeof input === "number" && Number.isFinite(input))
+            return input;
+        if (typeof input !== "object" || input === null)
+            throw invalid();
+        const descriptors = Object.getOwnPropertyDescriptors(input);
+        if (Array.isArray(input)) {
+            const length = descriptors.length?.value;
+            if (length > 20_000)
+                throw invalid();
+            const result = [];
+            for (let index = 0; index < length; index++) {
+                const descriptor = descriptors[String(index)];
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    throw invalid();
+                result.push(copy(descriptor.value, depth + 1));
+            }
+            return result;
+        }
+        if (Object.getPrototypeOf(input) !== Object.prototype && Object.getPrototypeOf(input) !== null)
+            throw invalid();
+        return Object.fromEntries(Object.entries(descriptors).filter(([, descriptor]) => descriptor.enumerable).map(([key, descriptor]) => {
+            if (!Object.hasOwn(descriptor, "value"))
+                throw invalid();
+            return [key, copy(descriptor.value, depth + 1)];
+        }));
+    }
+    let result;
+    try {
+        result = copy(value, 0);
+    }
+    catch {
+        throw invalid();
+    }
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        throw invalid();
+    const record = result;
+    if (!Object.hasOwn(record, "client_id") || typeof record.client_id !== "string" || record.client_id.trim() === "")
+        throw new Error("OAuth client registration response missing client_id");
+    for (const key of ["client_id", "client_secret", "token_endpoint_auth_method", "application_type", "client_name", "client_uri", "logo_uri", "scope",
+        "tos_uri", "policy_uri", "jwks_uri", "software_id", "software_version", "software_statement", "registration_access_token", "registration_client_uri", "issuer"]) {
+        if (Object.hasOwn(record, key) && record[key] !== null && typeof record[key] !== "string")
+            throw invalid();
+    }
+    if (typeof record.client_secret === "string" && record.client_secret.trim() === "")
+        throw invalid();
+    for (const key of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (!Array.isArray(entry) || entry.some(item => typeof item !== "string")))
+            throw invalid();
+    }
+    for (const key of ["client_id_issued_at", "client_secret_expires_at"]) {
+        const entry = record[key];
+        if (Object.hasOwn(record, key) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0))
+            throw invalid();
+    }
+    try {
+        normalizeOAuthScope(Object.hasOwn(record, "scope") && record.scope !== null ? record.scope : undefined);
+    }
+    catch {
+        throw invalid();
+    }
+    if (Buffer.byteLength(JSON.stringify(record), "utf8") > 64 * 1024)
+        throw invalid();
+    return record;
+}
+export function normalizeStoredOAuthClient(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const clientId = Object.hasOwn(record, "clientId") ? record.clientId : undefined;
+    const clientSecret = Object.hasOwn(record, "clientSecret") ? record.clientSecret : undefined;
+    if (typeof clientId !== "string" || clientId.trim() === "" ||
+        (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
+        return null;
+    const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const requestedRedirectUri = Object.hasOwn(record, "requestedRedirectUri") ? record.requestedRedirectUri : undefined;
+    if (requestedRedirectUri !== undefined) {
+        try {
+            if (typeof requestedRedirectUri !== "string")
+                throw new Error("Invalid redirect identity");
+            loopbackTarget({ redirectUri: requestedRedirectUri });
+        }
+        catch {
+            throw new Error("Invalid stored OAuth registration redirect identity");
+        }
+        client.requestedRedirectUri = requestedRedirectUri;
+    }
+    const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
+    if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
+        const registration = parseOAuthClientRegistration(record.registration);
+        const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
+        if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
+            throw new Error("OAuth client registration does not match the client identity");
+        client.registration = registration;
+        const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : undefined);
+        if (method !== undefined && registrationMethod !== undefined && method !== registrationMethod)
+            throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+        if (registrationMethod !== undefined)
+            client.tokenEndpointAuthMethod = registrationMethod;
+    }
+    if (method !== undefined)
+        client.tokenEndpointAuthMethod = method;
+    return client;
+}
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export function registrationMatchesRedirect(client, requestedUri, fresh = false) {
+    if (client.requestedRedirectUri !== undefined)
+        return client.requestedRedirectUri === requestedUri;
+    const redirects = client.registration?.redirect_uris;
+    if (redirects === undefined || redirects === null || redirects.length === 0)
+        return true;
+    return redirects.some(returnedUri => {
+        if (returnedUri === requestedUri)
+            return true;
+        if (!fresh)
+            return false;
+        let returned, requested;
+        try {
+            returned = new URL(returnedUri);
+            requested = new URL(requestedUri);
+        }
+        catch {
+            return false;
+        }
+        if (requested.protocol !== "http:" || returned.protocol !== "http:" ||
+            !["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+            return false;
+        const sameHost = returned.hostname === requested.hostname;
+        const normalizedIpv4 = requested.hostname === "127.0.0.1" && returned.hostname === "localhost" && returned.port === "";
+        if (!sameHost && !normalizedIpv4)
+            return false;
+        returned.hostname = requested.hostname;
+        returned.port = requested.port;
+        return returned.href === requested.href;
+    });
+}