toolcraft 0.0.335 → 0.0.337

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.57",
+      "version": "0.1.60",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.335",
+      "version": "0.0.337",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.335",
+      "version": "0.0.337",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.57",
+      "version": "0.1.60",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.335",
+      "version": "0.0.337",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.335",
+      "version": "0.0.337",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -25,6 +25,10 @@ const value = await store.get(); // "secret-value"
 await store.delete();
 ```
 
+Use `resolveSecretStoreBackend(options)` to select and validate the backend
+without constructing a store or reading credentials. Pass the returned backend
+explicitly when deferred operations must keep the same environment selection.
+
 Both built-in backends expose `store.withLock(operation, { signal, timeoutMs })`
 for transactions spanning a read, external operation and write. Independent
 instances and processes serialize the same encrypted file or Keychain

package/node_modules/auth-store/dist/create-secret-store.d.ts

@@ -1,2 +1,4 @@
-import type { CreateSecretStoreInput, CreateSecretStoreResult } from "./types.js";
+import type { CreateSecretStoreInput, CreateSecretStoreResult, StoreBackend } from "./types.js";
 export declare function createSecretStore(input: CreateSecretStoreInput): CreateSecretStoreResult;
+/** Select and validate a backend without constructing a store or accessing credentials. */
+export declare function resolveSecretStoreBackend(input: CreateSecretStoreInput): StoreBackend;

package/node_modules/auth-store/dist/create-secret-store.js

@@ -17,7 +17,7 @@ const storeFactories = {
     }
 };
 export function createSecretStore(input) {
-    const backend = resolveBackend(input);
+    const backend = resolveSecretStoreBackend(input);
     const platform = input.platform ?? process.platform;
     if (backend === "keychain" && platform !== MACOS_PLATFORM) {
         throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
@@ -25,7 +25,8 @@ export function createSecretStore(input) {
     const store = storeFactories[backend](input);
     return { backend, store };
 }
-function resolveBackend(input) {
+/** Select and validate a backend without constructing a store or accessing credentials. */
+export function resolveSecretStoreBackend(input) {
     const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
     const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
     const backend = configuredBackend?.trim();

package/node_modules/auth-store/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { createSecretStore } from "./create-secret-store.js";
+export { createSecretStore, resolveSecretStoreBackend } from "./create-secret-store.js";
 export { EncryptedFileStore } from "./encrypted-file-store.js";
 export { KeychainStore } from "./keychain-store.js";
 export type { SecretStoreLockOptions, SecretStoreLockFileSystem } from "./transaction-lock.js";

package/node_modules/auth-store/dist/index.js

@@ -1,4 +1,4 @@
-export { createSecretStore } from "./create-secret-store.js";
+export { createSecretStore, resolveSecretStoreBackend } from "./create-secret-store.js";
 export { EncryptedFileStore } from "./encrypted-file-store.js";
 export { KeychainStore } from "./keychain-store.js";
 export { key, MigratingSecretStore } from "./provider-store.js";

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.57",
+      "version": "0.1.60",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -57,6 +57,16 @@ const verifier = createJwksTokenVerifier({
 - `authStore` optional `auth-store` backend config for the default session store
 - `now()` optional clock override
 
+The default provider captures client, interaction, callback, landing-page and
+lock policies when created. Create a new provider to change those settings.
+Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
+aborting the original signal still cancels authorization.
+Native session and client persistence factories also capture file paths, salts,
+Keychain identities, lock locations and selected filesystem/command handles.
+Mutating these settings cannot redirect a later read or write.
+The factories resolve the selected backend environment variable once at creation;
+later environment changes cannot move a transaction between file and Keychain.
+
 `createJwksTokenVerifier(options)` accepts:
 
 | Option                   | Type                | Default        | Description                                                                              |

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,7 +1,7 @@
 import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
-import { createSecretStore } from "auth-store";
+import { createSecretStore, resolveSecretStoreBackend } from "auth-store";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
 const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
@@ -12,6 +12,7 @@ const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createAuthStoreSessionStore(options = {}, namespace) {
     assertPersistenceNamespace(namespace);
+    options = snapshotPersistenceOptions(options);
     return {
         async withLock(resource, operation, lockOptions) {
             const store = createResourceSecretStore(resource, options, namespace);
@@ -49,6 +50,7 @@ export function createAuthStoreSessionStore(options = {}, namespace) {
 }
 export function createAuthStoreClientStore(options, namespace) {
     assertPersistenceNamespace(namespace);
+    options = snapshotPersistenceOptions(options);
     return {
         async load(issuer) {
             const store = createIssuerSecretStore(issuer, options, namespace);
@@ -79,6 +81,14 @@ export function createAuthStoreClientStore(options, namespace) {
         }
     };
 }
+function snapshotPersistenceOptions(options) {
+    return {
+        ...options, backend: resolveSecretStoreBackend(options),
+        ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
+        ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
+                ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
+    };
+}
 export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -20,7 +20,12 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
-    loopbackTarget(options.browser);
+    const browser = { ...options.browser,
+        ...(options.browser.landingPage === undefined ? {} : { landingPage: { ...options.browser.landingPage } }) };
+    const clientMode = options.client.mode;
+    const interactiveEnabled = options.allowInteractive !== false;
+    const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
+    loopbackTarget(browser);
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
@@ -187,7 +192,7 @@ export function createDefaultOAuthClientProvider(options) {
             if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
                 forceRefresh = false;
             const sessionDiscovery = resolveDiscovery(discovery, session);
-            if ((options.client.mode === "static" || configuredClient !== null || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+            if ((clientMode === "static" || configuredClient !== null || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
                 const configured = configuredClient;
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
@@ -198,7 +203,7 @@ export function createDefaultOAuthClientProvider(options) {
                 (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
                 throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
-                if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
+                if (!allowInteractive || !interactiveEnabled || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
                 return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
             }
@@ -209,7 +214,7 @@ export function createDefaultOAuthClientProvider(options) {
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
                 if (hasExpiredClientSecret(session.client, now)) {
-                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                    if (!allowInteractive || !interactiveEnabled || clientMode === "static" || configuredClient?.registration !== undefined)
                         throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
                     return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
                 }
@@ -225,10 +230,10 @@ export function createDefaultOAuthClientProvider(options) {
             if (!allowInteractive || sessionDiscovery === undefined) {
                 return session;
             }
-            if (options.allowInteractive === false)
+            if (!interactiveEnabled)
                 throw new Error("OAuth interactive authorization is disabled");
             return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
-        }, { signal, timeoutMs: options.sessionLockTimeoutMs });
+        }, { signal, timeoutMs: sessionLockTimeoutMs });
     }
     async function refreshSession(resource, session, discovery, fetch, signal) {
         signal?.throwIfAborted();
@@ -303,13 +308,8 @@ export function createDefaultOAuthClientProvider(options) {
         let reRegistrationAttempted = false;
         while (true) {
             const loopback = await createLoopbackAuthorizationSession({
-                openBrowser: options.browser.openBrowser,
-                readLine: options.browser.readLine,
-                createServer: options.browser.createServer,
-                landingPage: options.browser.landingPage,
-                redirectUri: options.browser.redirectUri,
-                signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-                timeoutMs: options.browser.timeoutMs
+                ...browser,
+                signal: browser.signal === undefined ? signal : signal === undefined ? browser.signal : AbortSignal.any([signal, browser.signal])
             });
             let resolvedClient = null;
             try {
@@ -379,7 +379,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        if (options.client.mode === "static" || configuredClient?.registration !== undefined) {
+        if (clientMode === "static" || configuredClient?.registration !== undefined) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -134,6 +134,7 @@ export interface OAuthSessionStore {
         timeoutMs: number;
     }): Promise<T>;
 }
+/** Configuration values are captured at creation; selected host dependencies remain live. */
 export interface DefaultOAuthClientProviderOptions {
     client: {
         mode: "dynamic";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.57",
+  "version": "0.1.60",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -237,6 +237,7 @@ interface OAuthSessionStore {
         timeoutMs: number;
     }): Promise<T>;
 }
+/** Configuration values are captured at creation; selected host dependencies remain live. */
 interface DefaultOAuthClientProviderOptions {
     client: {
         mode: "dynamic";

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4526,7 +4526,7 @@ var storeFactories = {
   }
 };
 function createSecretStore(input) {
-  const backend = resolveBackend(input);
+  const backend = resolveSecretStoreBackend(input);
   const platform = input.platform ?? process.platform;
   if (backend === "keychain" && platform !== MACOS_PLATFORM) {
     throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
@@ -4534,7 +4534,7 @@ function createSecretStore(input) {
   const store = storeFactories[backend](input);
   return { backend, store };
 }
-function resolveBackend(input) {
+function resolveSecretStoreBackend(input) {
   const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
   const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
   const backend = configuredBackend?.trim();
@@ -4572,6 +4572,7 @@ var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
 var MAX_JS_DATE_MS = 864e13;
 function createAuthStoreSessionStore(options = {}, namespace) {
   assertPersistenceNamespace(namespace);
+  options = snapshotPersistenceOptions(options);
   return {
     async withLock(resource, operation, lockOptions) {
       const store = createResourceSecretStore(resource, options, namespace);
@@ -4608,6 +4609,7 @@ function createAuthStoreSessionStore(options = {}, namespace) {
 }
 function createAuthStoreClientStore(options, namespace) {
   assertPersistenceNamespace(namespace);
+  options = snapshotPersistenceOptions(options);
   return {
     async load(issuer) {
       const store = createIssuerSecretStore(issuer, options, namespace);
@@ -4635,6 +4637,17 @@ function createAuthStoreClientStore(options, namespace) {
     }
   };
 }
+function snapshotPersistenceOptions(options) {
+  return {
+    ...options,
+    backend: resolveSecretStoreBackend(options),
+    ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
+    ...options.keychainStore === void 0 ? {} : { keychainStore: {
+      ...options.keychainStore,
+      ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
+    } }
+  };
+}
 function createNamedSecretStore(key2, options, defaults, namespace) {
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
@@ -5239,7 +5252,14 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
-  loopbackTarget(options.browser);
+  const browser = {
+    ...options.browser,
+    ...options.browser.landingPage === void 0 ? {} : { landingPage: { ...options.browser.landingPage } }
+  };
+  const clientMode = options.client.mode;
+  const interactiveEnabled = options.allowInteractive !== false;
+  const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
+  loopbackTarget(browser);
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
@@ -5398,7 +5418,7 @@ function createDefaultOAuthClientProvider(options) {
       if (forceRefresh && rejectedTokens !== void 0 && (rejectedTokens === null || session?.tokens === void 0 || !sameTokenGrant(session.tokens, rejectedTokens)))
         forceRefresh = false;
       const sessionDiscovery = resolveDiscovery(discovery, session);
-      if ((options.client.mode === "static" || configuredClient !== null || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
+      if ((clientMode === "static" || configuredClient !== null || initialGrant !== void 0) && session !== null && (session.tokens !== void 0 || session.refreshState === "pending")) {
         const configured = configuredClient;
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
@@ -5408,7 +5428,7 @@ function createDefaultOAuthClientProvider(options) {
       if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
         throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
-        if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
+        if (!allowInteractive || !interactiveEnabled || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
         return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
       }
@@ -5417,7 +5437,7 @@ function createDefaultOAuthClientProvider(options) {
       }
       if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
         if (hasExpiredClientSecret(session.client, now)) {
-          if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== void 0)
+          if (!allowInteractive || !interactiveEnabled || clientMode === "static" || configuredClient?.registration !== void 0)
             throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
           return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
         }
@@ -5433,10 +5453,10 @@ function createDefaultOAuthClientProvider(options) {
       if (!allowInteractive || sessionDiscovery === void 0) {
         return session;
       }
-      if (options.allowInteractive === false)
+      if (!interactiveEnabled)
         throw new Error("OAuth interactive authorization is disabled");
       return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
-    }, { signal, timeoutMs: options.sessionLockTimeoutMs });
+    }, { signal, timeoutMs: sessionLockTimeoutMs });
   }
   async function refreshSession(resource, session, discovery, fetch2, signal) {
     signal?.throwIfAborted();
@@ -5509,13 +5529,8 @@ function createDefaultOAuthClientProvider(options) {
     let reRegistrationAttempted = false;
     while (true) {
       const loopback = await createLoopbackAuthorizationSession({
-        openBrowser: options.browser.openBrowser,
-        readLine: options.browser.readLine,
-        createServer: options.browser.createServer,
-        landingPage: options.browser.landingPage,
-        redirectUri: options.browser.redirectUri,
-        signal: options.browser.signal === void 0 ? signal : signal === void 0 ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-        timeoutMs: options.browser.timeoutMs
+        ...browser,
+        signal: browser.signal === void 0 ? signal : signal === void 0 ? browser.signal : AbortSignal.any([signal, browser.signal])
       });
       let resolvedClient = null;
       try {
@@ -5584,7 +5599,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    if (options.client.mode === "static" || configuredClient?.registration !== void 0) {
+    if (clientMode === "static" || configuredClient?.registration !== void 0) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.335",
+      "version": "0.0.337",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.335",
+  "version": "0.0.337",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.335",
+  "version": "0.0.337",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.335",
+    "toolcraft-schema": "0.0.337",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",