toolcraft 0.0.316 → 0.0.318

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.36",
+      "version": "0.1.39",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.316",
+      "version": "0.0.318",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.316",
+      "version": "0.0.318",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.36",
+      "version": "0.1.39",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.316",
+      "version": "0.0.318",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.316",
+      "version": "0.0.318",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.36",
+      "version": "0.1.39",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -102,6 +102,15 @@ normalized. An imported grant must declare its scope when a scope is configured.
 Authorization records the requested set when the endpoint omits scope, and
 refresh retains the previous granted set. Mismatched responses never activate
 credentials; an unusable refresh response retains the pending refresh record.
+`resourceIdentity` selects a native-owned logical server within its optional
+persistence namespace. One encrypted, locked document owns that identity's
+current resource URL, sessions and registrations. Changing the URL retires its
+credentials permanently; returning to the old URL does not restore them.
+Retired identities also withhold stale initial grants; authorize again or select
+a fresh explicit profile to import a new grant. This option requires native persistence; custom
+session stores own their durable resource trust policy. Without it, the native
+client retains its existing resource-URL cache behavior.
+
 Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,5 +1,5 @@
-import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
+import { type CreateSecretStoreInput, type SecretStore } from "auth-store";
+import type { OAuthSessionStore, StoredOAuthSession, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -7,4 +7,11 @@ export interface OAuthClientStore {
 }
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
+export declare function createNamedSecretStore(key: string, options: CreateSecretStoreInput, defaults: {
+    salt: string;
+    directory: string;
+    service: string;
+    accountPrefix: string;
+}, namespace?: string): SecretStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
+export declare function isStoredOAuthSession(value: unknown): value is StoredOAuthSession;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -79,7 +79,7 @@ export function createAuthStoreClientStore(options, namespace) {
         }
     };
 }
-function createNamedSecretStore(key, options, defaults, namespace) {
+export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
@@ -132,7 +132,7 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
-function isStoredOAuthSession(value) {
+export function isStoredOAuthSession(value) {
     if (!isObjectRecord(value)) {
         return false;
     }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,4 @@
+import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
 import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
@@ -26,8 +27,13 @@ export function createDefaultOAuthClientProvider(options) {
     const configuredClient = normalizeConfiguredClient(options.client);
     const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
     const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-    const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-    const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
+    if (options.resourceIdentity !== undefined && options.sessionStore !== undefined)
+        throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
+    const resourceStores = options.resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
@@ -127,6 +133,11 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (resourceStores !== undefined) {
+                registeredClients.clear();
+                if (!resourceStores.initialGrantAllowed)
+                    initialGrantConsumed = true;
+            }
             if (session !== null)
                 assertRegistrationIssuer(session.client, session.authorizationServer);
             if (configuredClient !== null && discovery !== undefined)

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.d.ts

@@ -0,0 +1,9 @@
+import type { CreateSecretStoreInput } from "auth-store";
+import { type OAuthClientStore } from "./auth-store-session-store.js";
+import type { OAuthSessionStore } from "./types.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): {
+    sessionStore: OAuthSessionStore;
+    clientStore: OAuthClientStore;
+    initialGrantAllowed: boolean;
+};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -0,0 +1,118 @@
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { assertPersistenceNamespace, createNamedSecretStore, isStoredOAuthSession } from "./auth-store-session-store.js";
+import { normalizeStoredOAuthClient } from "./client-registration.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export function createResourceBoundOAuthStores(options, namespace, identity) {
+    assertPersistenceNamespace(identity);
+    const store = createNamedSecretStore(identity, options, { salt: "poe-code:mcp-oauth:resources:v1",
+        directory: ".poe-code/mcp-oauth/resources", service: "poe-code-mcp-oauth-resources", accountPrefix: "resource" }, namespace);
+    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+    async function read() {
+        const raw = await store.get();
+        if (raw === null)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Stored OAuth resource identity must be valid JSON; reset explicitly to recover");
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            throw new Error("Invalid stored OAuth resource identity");
+        const record = value;
+        if (!["version", "resource", "generation", "session", "clients"].every(key => Object.hasOwn(record, key)) || record.version !== 1 || typeof record.resource !== "string" || record.resource !== canonicalizeResourceIndicator(record.resource) ||
+            !Number.isSafeInteger(record.generation) || record.generation < 0 ||
+            (record.session !== null && (!isStoredOAuthSession(record.session) || record.session.resource !== record.resource)) ||
+            typeof record.clients !== "object" || record.clients === null || Array.isArray(record.clients))
+            throw new Error("Invalid stored OAuth resource identity; reset explicitly to recover");
+        let resourceUrl;
+        try {
+            resourceUrl = new URL(record.resource);
+        }
+        catch {
+            throw new Error("Invalid stored OAuth resource identity URL");
+        }
+        if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.username || resourceUrl.password || resourceUrl.hash)
+            throw new Error("Invalid stored OAuth resource identity URL");
+        for (const [issuer, client] of Object.entries(record.clients)) {
+            const normalized = normalizeStoredOAuthClient(client);
+            let url;
+            try {
+                url = new URL(issuer);
+            }
+            catch {
+                throw new Error("Invalid stored OAuth resource client issuer");
+            }
+            if (normalized === null || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+                throw new Error("Invalid stored OAuth resource client");
+            Object.defineProperty(record.clients, issuer, { value: normalized, enumerable: true, configurable: true, writable: true });
+        }
+        return record;
+    }
+    async function reconcile(resource) {
+        resource = canonicalizeResourceIndicator(resource);
+        const existing = await read();
+        if (existing?.resource === resource) {
+            result.initialGrantAllowed = existing.generation === 0;
+            return existing;
+        }
+        const record = { version: 1, resource, generation: existing === null ? 0 : existing.generation + 1, session: null, clients: {} };
+        if (!Number.isSafeInteger(record.generation))
+            throw new Error("OAuth resource identity generation limit exceeded");
+        await store.set(JSON.stringify(record));
+        result.initialGrantAllowed = record.generation === 0;
+        return record;
+    }
+    result.sessionStore = {
+        async withLock(resource, operation, options) {
+            if (store.withLock === undefined)
+                throw new Error("OAuth resource identity backend must support transaction locks");
+            return store.withLock(async () => {
+                options.signal?.throwIfAborted();
+                await reconcile(resource);
+                options.signal?.throwIfAborted();
+                return operation();
+            }, options);
+        },
+        async load(resource) {
+            // Unauthorized provenance may peek before acquiring the transaction lock.
+            // Only the lock owner may adopt a URL or retire the previous credentials.
+            const record = await read();
+            return record?.resource === canonicalizeResourceIndicator(resource) ? record.session : null;
+        },
+        async save(resource, session) {
+            const record = await reconcile(resource);
+            if (canonicalizeResourceIndicator(session.resource) !== record.resource)
+                throw new Error("OAuth session does not match its resource identity");
+            record.session = session;
+            await store.set(JSON.stringify(record));
+        },
+        async clear(resource) {
+            const record = await reconcile(resource);
+            record.session = null;
+            // Preserve a tombstone so environment grants cannot revive a cleared family.
+            record.generation = Math.max(1, record.generation);
+            result.initialGrantAllowed = false;
+            await store.set(JSON.stringify(record));
+        }
+    };
+    result.clientStore = {
+        async load(issuer) { const record = await read(); return record !== null && Object.hasOwn(record.clients, issuer) ? record.clients[issuer] : null; },
+        async save(issuer, client) {
+            const record = await read();
+            if (record === null)
+                throw new Error("OAuth resource identity must be bound before registering a client");
+            Object.defineProperty(record.clients, issuer, { value: client, enumerable: true, configurable: true, writable: true });
+            await store.set(JSON.stringify(record));
+        },
+        async clear(issuer) {
+            const record = await read();
+            if (record === null || !Object.hasOwn(record.clients, issuer))
+                return;
+            delete record.clients[issuer];
+            await store.set(JSON.stringify(record));
+        }
+    };
+    return result;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -147,6 +147,8 @@ export interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.36",
+  "version": "0.1.39",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -37,7 +37,10 @@ by the server. Announced endpoints must remain on the original origin without
 embedded credentials or fragments; endpoint changes close the connection.
 Both transports accept the same headers, OAuth provider and response limits.
 HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
-make transport decisions without parsing error messages.
+make transport decisions without parsing error messages. Legacy HTTP/SSE
+`connect()` also waits for the initialized notification POST to complete before
+reporting ready. Completion failures reject the connection and expose
+`rpcMethod: "notifications/initialized"`; they are not setup transport mismatches.
 
 ## OAuth HTTP support
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -250,6 +250,8 @@ interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
@@ -639,6 +641,11 @@ interface McpTransport {
     closed: Promise<McpTransportClosedEvent>;
     dispose(reason?: Error): void;
     filterTools?(tools: Tool[], reset?: boolean): Tool[];
+    /** Complete a legacy initialization handshake before the client reports ready. */
+    completeInitialization?(options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<void>;
 }
 interface InMemoryServerTransport {
     readable: Readable;
@@ -674,7 +681,8 @@ type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<R
 declare class HttpTransportError extends Error {
     readonly status: number;
     readonly method: "GET" | "POST" | "DELETE";
-    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE");
+    readonly rpcMethod?: string | undefined;
+    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE", rpcMethod?: string | undefined);
 }
 interface HttpTransportOptions {
     url: string;
@@ -731,6 +739,10 @@ declare class HttpTransport implements McpTransport {
     private readonly toolParameterHeaders;
     private readonly onWarning;
     constructor({ url, mode, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
+    completeInitialization(options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<void>;
     filterTools(tools: Tool[], reset?: boolean): Tool[];
     dispose(reason?: Error): void;
     private closeWithSessionTermination;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4709,6 +4709,120 @@ function isNonBlankOwnString(record2, key2) {
   return value !== void 0 && value.trim().length > 0;
 }
 
+// ../mcp-oauth/dist/client/resource-bound-store.js
+function createResourceBoundOAuthStores(options, namespace, identity) {
+  assertPersistenceNamespace(identity);
+  const store = createNamedSecretStore(identity, options, {
+    salt: "poe-code:mcp-oauth:resources:v1",
+    directory: ".poe-code/mcp-oauth/resources",
+    service: "poe-code-mcp-oauth-resources",
+    accountPrefix: "resource"
+  }, namespace);
+  const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+  async function read() {
+    const raw = await store.get();
+    if (raw === null)
+      return null;
+    let value;
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      throw new Error("Stored OAuth resource identity must be valid JSON; reset explicitly to recover");
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      throw new Error("Invalid stored OAuth resource identity");
+    const record2 = value;
+    if (!["version", "resource", "generation", "session", "clients"].every((key2) => Object.hasOwn(record2, key2)) || record2.version !== 1 || typeof record2.resource !== "string" || record2.resource !== canonicalizeResourceIndicator(record2.resource) || !Number.isSafeInteger(record2.generation) || record2.generation < 0 || record2.session !== null && (!isStoredOAuthSession(record2.session) || record2.session.resource !== record2.resource) || typeof record2.clients !== "object" || record2.clients === null || Array.isArray(record2.clients))
+      throw new Error("Invalid stored OAuth resource identity; reset explicitly to recover");
+    let resourceUrl;
+    try {
+      resourceUrl = new URL(record2.resource);
+    } catch {
+      throw new Error("Invalid stored OAuth resource identity URL");
+    }
+    if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.username || resourceUrl.password || resourceUrl.hash)
+      throw new Error("Invalid stored OAuth resource identity URL");
+    for (const [issuer, client] of Object.entries(record2.clients)) {
+      const normalized = normalizeStoredOAuthClient(client);
+      let url;
+      try {
+        url = new URL(issuer);
+      } catch {
+        throw new Error("Invalid stored OAuth resource client issuer");
+      }
+      if (normalized === null || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+        throw new Error("Invalid stored OAuth resource client");
+      Object.defineProperty(record2.clients, issuer, { value: normalized, enumerable: true, configurable: true, writable: true });
+    }
+    return record2;
+  }
+  async function reconcile(resource) {
+    resource = canonicalizeResourceIndicator(resource);
+    const existing = await read();
+    if (existing?.resource === resource) {
+      result.initialGrantAllowed = existing.generation === 0;
+      return existing;
+    }
+    const record2 = { version: 1, resource, generation: existing === null ? 0 : existing.generation + 1, session: null, clients: {} };
+    if (!Number.isSafeInteger(record2.generation))
+      throw new Error("OAuth resource identity generation limit exceeded");
+    await store.set(JSON.stringify(record2));
+    result.initialGrantAllowed = record2.generation === 0;
+    return record2;
+  }
+  result.sessionStore = {
+    async withLock(resource, operation, options2) {
+      if (store.withLock === void 0)
+        throw new Error("OAuth resource identity backend must support transaction locks");
+      return store.withLock(async () => {
+        options2.signal?.throwIfAborted();
+        await reconcile(resource);
+        options2.signal?.throwIfAborted();
+        return operation();
+      }, options2);
+    },
+    async load(resource) {
+      const record2 = await read();
+      return record2?.resource === canonicalizeResourceIndicator(resource) ? record2.session : null;
+    },
+    async save(resource, session) {
+      const record2 = await reconcile(resource);
+      if (canonicalizeResourceIndicator(session.resource) !== record2.resource)
+        throw new Error("OAuth session does not match its resource identity");
+      record2.session = session;
+      await store.set(JSON.stringify(record2));
+    },
+    async clear(resource) {
+      const record2 = await reconcile(resource);
+      record2.session = null;
+      record2.generation = Math.max(1, record2.generation);
+      result.initialGrantAllowed = false;
+      await store.set(JSON.stringify(record2));
+    }
+  };
+  result.clientStore = {
+    async load(issuer) {
+      const record2 = await read();
+      return record2 !== null && Object.hasOwn(record2.clients, issuer) ? record2.clients[issuer] : null;
+    },
+    async save(issuer, client) {
+      const record2 = await read();
+      if (record2 === null)
+        throw new Error("OAuth resource identity must be bound before registering a client");
+      Object.defineProperty(record2.clients, issuer, { value: client, enumerable: true, configurable: true, writable: true });
+      await store.set(JSON.stringify(record2));
+    },
+    async clear(issuer) {
+      const record2 = await read();
+      if (record2 === null || !Object.hasOwn(record2.clients, issuer))
+        return;
+      delete record2.clients[issuer];
+      await store.set(JSON.stringify(record2));
+    }
+  };
+  return result;
+}
+
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
 import { isIP } from "node:net";
 
@@ -5023,8 +5137,11 @@ function createDefaultOAuthClientProvider(options) {
   const configuredClient = normalizeConfiguredClient(options.client);
   const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
   const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-  const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-  const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
+  if (options.resourceIdentity !== void 0 && options.sessionStore !== void 0)
+    throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
+  const resourceStores = options.resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
+  const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+  const clientStore = resourceStores?.clientStore ?? (options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
   const now = options.now ?? Date.now;
   const registeredClients = /* @__PURE__ */ new Map();
   if (options.initialGrant !== void 0) {
@@ -5117,6 +5234,11 @@ function createDefaultOAuthClientProvider(options) {
     const canonicalResource = canonicalizeResourceIndicator(resource);
     return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
       let session = await loadSession(canonicalResource);
+      if (resourceStores !== void 0) {
+        registeredClients.clear();
+        if (!resourceStores.initialGrantAllowed)
+          initialGrantConsumed = true;
+      }
       if (session !== null)
         assertRegistrationIssuer(session.client, session.authorizationServer);
       if (configuredClient !== null && discovery !== void 0)
@@ -6666,7 +6788,8 @@ var McpClient = class {
           async (params, context) => this.options.onElicitationRequest(params, context)
         );
       }
-      messageLayer.sendNotification("notifications/initialized");
+      if (transport.completeInitialization === void 0) messageLayer.sendNotification("notifications/initialized");
+      else await transport.completeInitialization({ signal: options.signal, timeoutMs: this.options.requestTimeoutMs ?? 3e4 });
       this.currentState = "ready";
       return initializeResult;
     } catch (error) {
@@ -7166,14 +7289,16 @@ async function createTestPair(server, createClient) {
   return { client, cleanup };
 }
 var HttpTransportError = class extends Error {
-  constructor(message, status, method) {
+  constructor(message, status, method, rpcMethod) {
     super(message);
     this.status = status;
     this.method = method;
+    this.rpcMethod = rpcMethod;
     this.name = "HttpTransportError";
   }
   status;
   method;
+  rpcMethod;
 };
 function defaultStdioSpawn(command, args, options) {
   return spawn2(command, args, options);
@@ -7348,6 +7473,21 @@ var HttpTransport = class {
       this.dispose(error instanceof Error ? error : new Error(String(error)));
     });
   }
+  async completeInitialization(options) {
+    const deadline = options.timeoutMs > 0 ? AbortSignal.timeout(Math.ceil(options.timeoutMs)) : void 0;
+    const signals = [options.signal, deadline].filter((signal2) => signal2 !== void 0);
+    const signal = signals.length === 0 ? new AbortController().signal : AbortSignal.any(signals);
+    signal.throwIfAborted();
+    try {
+      await this.sendPost(serializeJsonRpcMessage({ jsonrpc: "2.0", method: "notifications/initialized" }), signal);
+      signal.throwIfAborted();
+      if (this.disposed) throw (await this.closed).reason;
+    } catch (error) {
+      if (error instanceof HttpTransportError)
+        throw new HttpTransportError(error.message, error.status, error.method, "notifications/initialized");
+      throw error;
+    }
+  }
   filterTools(tools, reset = true) {
     if (reset) this.toolParameterHeaders.clear();
     const accepted = [];
@@ -7459,7 +7599,8 @@ var HttpTransport = class {
       }
     }
   }
-  async sendPost(line) {
+  async sendPost(line, signal) {
+    signal?.throwIfAborted();
     const parsed = parseJsonRpcMessage(line);
     const message = parsed.type === "request" || parsed.type === "notification" ? parsed.message : void 0;
     const metadata = isObjectRecord5(message?.params) ? message.params._meta : void 0;
@@ -7473,7 +7614,10 @@ var HttpTransport = class {
         this.modernRequests.get(requestId)?.abort();
       return;
     }
-    const controller = modern && parsed.type === "request" ? new AbortController() : void 0;
+    const controller = modern && parsed.type === "request" || signal !== void 0 ? new AbortController() : void 0;
+    const aborted = () => controller?.abort(signal?.reason);
+    signal?.addEventListener("abort", aborted, { once: true });
+    if (signal?.aborted) aborted();
     const id = parsed.type === "request" ? parsed.message.id : void 0;
     if (controller !== void 0 && id !== void 0) this.modernRequests.set(id, controller);
     try {
@@ -7482,7 +7626,7 @@ var HttpTransport = class {
       const response = await this.fetchWithOAuthRetry({
         url: postUrl,
         method: "POST",
-        createHeaders: (signal) => this.createPostHeaders(message, modern, signal),
+        createHeaders: (signal2) => this.createPostHeaders(message, modern, signal2),
         body: line,
         controller
       });
@@ -7518,6 +7662,7 @@ var HttpTransport = class {
     } catch (error) {
       if (!controller?.signal.aborted) throw error;
     } finally {
+      signal?.removeEventListener("abort", aborted);
       if (id !== void 0 && this.modernRequests.get(id) === controller)
         this.modernRequests.delete(id);
     }

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.316",
+      "version": "0.0.318",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.316",
+  "version": "0.0.318",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.316",
+  "version": "0.0.318",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.316",
+    "toolcraft-schema": "0.0.318",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",