toolcraft 0.0.317 → 0.0.319

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.37",
+      "version": "0.1.40",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.317",
+      "version": "0.0.319",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.317",
+      "version": "0.0.319",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.37",
+      "version": "0.1.40",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.317",
+      "version": "0.0.319",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.317",
+      "version": "0.0.319",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.37",
+      "version": "0.1.40",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -95,6 +95,14 @@ without redeeming its refresh token again. A proven current token is refreshed
 on 401 even when the server omits `error="invalid_token"`. Invalid provenance
 fails without quoting token values.
 
+The native provider also exposes `authenticate({ requestUrl, fetch, signal,
+discover })` for explicit login, including servers whose initialization is
+public. `discover` lazily supplies validated OAuth metadata and is skipped for
+usable existing grants. Omit it to recover/reuse known sessions only; the method
+returns `void` if a new discovery lookup is needed. It honors `allowInteractive`,
+recovers pending refresh outcomes through consent, and returns an owned token
+snapshot. Normal transport request authorization remains noninteractive.
+
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it. Explicit scopes must match the cached
 or imported grant's scope set; ordering, repeated spaces and duplicates are

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -66,6 +66,26 @@ export function createDefaultOAuthClientProvider(options) {
     }
     let initialGrantConsumed = false;
     return {
+        async authenticate(input) {
+            input.signal?.throwIfAborted();
+            assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+            const resource = canonicalizeResourceIndicator(input.requestUrl);
+            let session = await ensureAuthorizedSession(resource, undefined, input.fetch, true, false, input.signal);
+            if (session?.tokens !== undefined && !isExpired(session.tokens, now))
+                return { ...session.tokens };
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === resource &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now))
+                return { ...initialGrant.tokens };
+            if (input.discover === undefined)
+                return;
+            const discovery = await input.discover();
+            input.signal?.throwIfAborted();
+            assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
+            session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
+            if (session?.tokens === undefined || isExpired(session.tokens, now))
+                throw new Error("OAuth authentication did not establish a usable grant");
+            return { ...session.tokens };
+        },
         async authorizeRequest(input) {
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -65,12 +65,22 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
         return record;
     }
     result.sessionStore = {
-        async withLock(_resource, operation, options) {
+        async withLock(resource, operation, options) {
             if (store.withLock === undefined)
                 throw new Error("OAuth resource identity backend must support transaction locks");
-            return store.withLock(operation, options);
+            return store.withLock(async () => {
+                options.signal?.throwIfAborted();
+                await reconcile(resource);
+                options.signal?.throwIfAborted();
+                return operation();
+            }, options);
+        },
+        async load(resource) {
+            // Unauthorized provenance may peek before acquiring the transaction lock.
+            // Only the lock owner may adopt a URL or retire the previous credentials.
+            const record = await read();
+            return record?.resource === canonicalizeResourceIndicator(resource) ? record.session : null;
         },
-        async load(resource) { return (await reconcile(resource)).session; },
         async save(resource, session) {
             const record = await reconcile(resource);
             if (canonicalizeResourceIndicator(session.resource) !== record.resource)

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -28,6 +28,14 @@ export interface OAuthUnauthorizedChallenge {
     raw: string;
 }
 export interface OAuthClientProvider {
+    /** Establish a grant explicitly, including when resource initialization is public. */
+    authenticate?(input: {
+        requestUrl: URL;
+        fetch: OAuthMetadataFetch;
+        /** Lazy validated discovery. Without it, recover/reuse known grants only. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void>;
     authorizeRequest?(input: {
         requestUrl: URL;
         headers: Headers;

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.37",
+  "version": "0.1.40",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -37,7 +37,10 @@ by the server. Announced endpoints must remain on the original origin without
 embedded credentials or fragments; endpoint changes close the connection.
 Both transports accept the same headers, OAuth provider and response limits.
 HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
-make transport decisions without parsing error messages.
+make transport decisions without parsing error messages. Legacy HTTP/SSE
+`connect()` also waits for the initialized notification POST to complete before
+reporting ready. Completion failures reject the connection and expose
+`rpcMethod: "notifications/initialized"`; they are not setup transport mismatches.
 
 ## OAuth HTTP support
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -131,6 +131,14 @@ interface OAuthUnauthorizedChallenge {
     raw: string;
 }
 interface OAuthClientProvider {
+    /** Establish a grant explicitly, including when resource initialization is public. */
+    authenticate?(input: {
+        requestUrl: URL;
+        fetch: OAuthMetadataFetch;
+        /** Lazy validated discovery. Without it, recover/reuse known grants only. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
+        signal?: AbortSignal;
+    }): Promise<StoredOAuthTokens | void>;
     authorizeRequest?(input: {
         requestUrl: URL;
         headers: Headers;
@@ -641,6 +649,11 @@ interface McpTransport {
     closed: Promise<McpTransportClosedEvent>;
     dispose(reason?: Error): void;
     filterTools?(tools: Tool[], reset?: boolean): Tool[];
+    /** Complete a legacy initialization handshake before the client reports ready. */
+    completeInitialization?(options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<void>;
 }
 interface InMemoryServerTransport {
     readable: Readable;
@@ -676,7 +689,8 @@ type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<R
 declare class HttpTransportError extends Error {
     readonly status: number;
     readonly method: "GET" | "POST" | "DELETE";
-    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE");
+    readonly rpcMethod?: string | undefined;
+    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE", rpcMethod?: string | undefined);
 }
 interface HttpTransportOptions {
     url: string;
@@ -733,6 +747,10 @@ declare class HttpTransport implements McpTransport {
     private readonly toolParameterHeaders;
     private readonly onWarning;
     constructor({ url, mode, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
+    completeInitialization(options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<void>;
     filterTools(tools: Tool[], reset?: boolean): Tool[];
     dispose(reason?: Error): void;
     private closeWithSessionTermination;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4771,13 +4771,19 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
     return record2;
   }
   result.sessionStore = {
-    async withLock(_resource, operation, options2) {
+    async withLock(resource, operation, options2) {
       if (store.withLock === void 0)
         throw new Error("OAuth resource identity backend must support transaction locks");
-      return store.withLock(operation, options2);
+      return store.withLock(async () => {
+        options2.signal?.throwIfAborted();
+        await reconcile(resource);
+        options2.signal?.throwIfAborted();
+        return operation();
+      }, options2);
     },
     async load(resource) {
-      return (await reconcile(resource)).session;
+      const record2 = await read();
+      return record2?.resource === canonicalizeResourceIndicator(resource) ? record2.session : null;
     },
     async save(resource, session) {
       const record2 = await reconcile(resource);
@@ -5166,6 +5172,25 @@ function createDefaultOAuthClientProvider(options) {
   }
   let initialGrantConsumed = false;
   return {
+    async authenticate(input) {
+      input.signal?.throwIfAborted();
+      assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+      const resource = canonicalizeResourceIndicator(input.requestUrl);
+      let session = await ensureAuthorizedSession(resource, void 0, input.fetch, true, false, input.signal);
+      if (session?.tokens !== void 0 && !isExpired(session.tokens, now))
+        return { ...session.tokens };
+      if (session === null && !initialGrantConsumed && initialGrant?.resource === resource && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now))
+        return { ...initialGrant.tokens };
+      if (input.discover === void 0)
+        return;
+      const discovery = await input.discover();
+      input.signal?.throwIfAborted();
+      assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
+      session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
+      if (session?.tokens === void 0 || isExpired(session.tokens, now))
+        throw new Error("OAuth authentication did not establish a usable grant");
+      return { ...session.tokens };
+    },
     async authorizeRequest(input) {
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
@@ -6782,7 +6807,8 @@ var McpClient = class {
           async (params, context) => this.options.onElicitationRequest(params, context)
         );
       }
-      messageLayer.sendNotification("notifications/initialized");
+      if (transport.completeInitialization === void 0) messageLayer.sendNotification("notifications/initialized");
+      else await transport.completeInitialization({ signal: options.signal, timeoutMs: this.options.requestTimeoutMs ?? 3e4 });
       this.currentState = "ready";
       return initializeResult;
     } catch (error) {
@@ -7282,14 +7308,16 @@ async function createTestPair(server, createClient) {
   return { client, cleanup };
 }
 var HttpTransportError = class extends Error {
-  constructor(message, status, method) {
+  constructor(message, status, method, rpcMethod) {
     super(message);
     this.status = status;
     this.method = method;
+    this.rpcMethod = rpcMethod;
     this.name = "HttpTransportError";
   }
   status;
   method;
+  rpcMethod;
 };
 function defaultStdioSpawn(command, args, options) {
   return spawn2(command, args, options);
@@ -7464,6 +7492,21 @@ var HttpTransport = class {
       this.dispose(error instanceof Error ? error : new Error(String(error)));
     });
   }
+  async completeInitialization(options) {
+    const deadline = options.timeoutMs > 0 ? AbortSignal.timeout(Math.ceil(options.timeoutMs)) : void 0;
+    const signals = [options.signal, deadline].filter((signal2) => signal2 !== void 0);
+    const signal = signals.length === 0 ? new AbortController().signal : AbortSignal.any(signals);
+    signal.throwIfAborted();
+    try {
+      await this.sendPost(serializeJsonRpcMessage({ jsonrpc: "2.0", method: "notifications/initialized" }), signal);
+      signal.throwIfAborted();
+      if (this.disposed) throw (await this.closed).reason;
+    } catch (error) {
+      if (error instanceof HttpTransportError)
+        throw new HttpTransportError(error.message, error.status, error.method, "notifications/initialized");
+      throw error;
+    }
+  }
   filterTools(tools, reset = true) {
     if (reset) this.toolParameterHeaders.clear();
     const accepted = [];
@@ -7575,7 +7618,8 @@ var HttpTransport = class {
       }
     }
   }
-  async sendPost(line) {
+  async sendPost(line, signal) {
+    signal?.throwIfAborted();
     const parsed = parseJsonRpcMessage(line);
     const message = parsed.type === "request" || parsed.type === "notification" ? parsed.message : void 0;
     const metadata = isObjectRecord5(message?.params) ? message.params._meta : void 0;
@@ -7589,7 +7633,10 @@ var HttpTransport = class {
         this.modernRequests.get(requestId)?.abort();
       return;
     }
-    const controller = modern && parsed.type === "request" ? new AbortController() : void 0;
+    const controller = modern && parsed.type === "request" || signal !== void 0 ? new AbortController() : void 0;
+    const aborted = () => controller?.abort(signal?.reason);
+    signal?.addEventListener("abort", aborted, { once: true });
+    if (signal?.aborted) aborted();
     const id = parsed.type === "request" ? parsed.message.id : void 0;
     if (controller !== void 0 && id !== void 0) this.modernRequests.set(id, controller);
     try {
@@ -7598,7 +7645,7 @@ var HttpTransport = class {
       const response = await this.fetchWithOAuthRetry({
         url: postUrl,
         method: "POST",
-        createHeaders: (signal) => this.createPostHeaders(message, modern, signal),
+        createHeaders: (signal2) => this.createPostHeaders(message, modern, signal2),
         body: line,
         controller
       });
@@ -7634,6 +7681,7 @@ var HttpTransport = class {
     } catch (error) {
       if (!controller?.signal.aborted) throw error;
     } finally {
+      signal?.removeEventListener("abort", aborted);
       if (id !== void 0 && this.modernRequests.get(id) === controller)
         this.modernRequests.delete(id);
     }

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.317",
+      "version": "0.0.319",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.317",
+  "version": "0.0.319",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.317",
+  "version": "0.0.319",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.317",
+    "toolcraft-schema": "0.0.319",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",