toolcraft 0.0.342 → 0.0.343

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.65",
+      "version": "0.1.68",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.342",
+      "version": "0.0.343",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.342",
+      "version": "0.0.343",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.65",
+      "version": "0.1.68",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.342",
+      "version": "0.0.343",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.342",
+      "version": "0.0.343",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.65",
+      "version": "0.1.68",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -31,6 +31,7 @@ const verifier = createJwksTokenVerifier({
 - `generateCodeVerifier()` and `generateCodeChallenge(...)`: PKCE helpers.
 - `normalizeStoredOAuthClient(value)`: normalize a saved client identity, full registration and ownership marker.
 - `normalizeOAuthScope(value)`: validate scope syntax and normalize its case-sensitive set.
+- `waitForOAuthOperation(promise, signal?)`: settle the caller on cancellation while continuing to observe host completion.
 - `canonicalizeResourceIndicator(value)`: resource indicator canonicalization.
 - `createJwksTokenVerifier(options)`: JWKS-backed access-token verifier for MCP servers.
 - `OAuthError`: OAuth HTTP error type with status, retryability and known-outcome fields.
@@ -98,7 +99,8 @@ Native provider calls capture request option handles before host work. Unauthori
 handling also owns complete discovery metadata, presented grant values, rejected
 request headers and the selected challenge error before reading persistence.
 A browser callback cannot redirect a later code exchange by changing caller
-metadata. Explicit authentication owns metadata when lazy discovery returns;
+metadata. Metadata loaded from a host session store is copied before clock or
+fetch callbacks, retaining the original refresh endpoint and persisted extensions. Explicit authentication owns metadata when lazy discovery returns;
 the selected discovery method retains its original receiver and live host state.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -593,12 +593,13 @@ function normalizeLoadedSession(session) {
     if (session === null) {
         return null;
     }
+    const discovery = structuredClone(session.discovery);
     const refreshState = getOwnEntry(session, "refreshState");
     if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
         throw new Error("Stored OAuth refresh state is invalid");
     const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
     if (client === null) {
-        return { ...session, client: { clientId: "" }, tokens: undefined };
+        return { ...session, discovery, client: { clientId: "" }, tokens: undefined };
     }
     const tokens = normalizeStoredTokens(getOwnEntry(session, "tokens"));
     if (tokens !== undefined) {
@@ -609,7 +610,7 @@ function normalizeLoadedSession(session) {
             throw new Error("Stored OAuth access token is not a valid HTTP header value");
         }
     }
-    return { ...session, client, tokens };
+    return { ...session, discovery, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
 export type { OAuthTokenGrantImportOptions } from "./client/token-grant.js";
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.js

@@ -1,4 +1,5 @@
 export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
 export { createAuthStoreSessionStore, } from "./client/auth-store-session-store.js";
 export { createResourceBoundOAuthStores } from "./client/resource-bound-store.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.65",
+  "version": "0.1.68",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -101,7 +101,7 @@ const transport = new HttpTransport({
 });
 ```
 
-You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate.
+You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. An explicit `resourceMetadataUrl` requires fresh network discovery without reading either cache; validated results still populate both caches. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3405,6 +3405,24 @@ function normalizeOAuthScope(scope) {
   return normalized || void 0;
 }
 
+// ../mcp-oauth/dist/client/cancellable-operation.js
+async function waitForOAuthOperation(operation, signal) {
+  if (signal === void 0)
+    return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      operation.then(resolve, reject);
+      if (signal.aborted)
+        abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+
 // ../mcp-oauth/dist/client/bounded-json.js
 function copyBoundedOAuthJson(value, message) {
   const invalid = () => new Error(message);
@@ -5204,24 +5222,6 @@ function normalizeBearerTokenType(value) {
   return value.toLowerCase() === "bearer" ? "Bearer" : null;
 }
 
-// ../mcp-oauth/dist/client/cancellable-operation.js
-async function waitForOAuthOperation(operation, signal) {
-  if (signal === void 0)
-    return operation;
-  let abort;
-  try {
-    return await new Promise((resolve, reject) => {
-      abort = () => reject(signal.reason);
-      signal.addEventListener("abort", abort, { once: true });
-      operation.then(resolve, reject);
-      if (signal.aborted)
-        abort();
-    });
-  } finally {
-    signal.removeEventListener("abort", abort);
-  }
-}
-
 // ../mcp-oauth/dist/client/session-transaction.js
 var queues = /* @__PURE__ */ new WeakMap();
 async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
@@ -5837,12 +5837,13 @@ function normalizeLoadedSession(session) {
   if (session === null) {
     return null;
   }
+  const discovery = structuredClone(session.discovery);
   const refreshState = getOwnEntry6(session, "refreshState");
   if (refreshState !== void 0 && (refreshState !== "pending" || getOwnEntry6(session, "tokens") !== void 0))
     throw new Error("Stored OAuth refresh state is invalid");
   const client = normalizeStoredOAuthClient(getOwnEntry6(session, "client"));
   if (client === null) {
-    return { ...session, client: { clientId: "" }, tokens: void 0 };
+    return { ...session, discovery, client: { clientId: "" }, tokens: void 0 };
   }
   const tokens = normalizeStoredTokens(getOwnEntry6(session, "tokens"));
   if (tokens !== void 0) {
@@ -5852,7 +5853,7 @@ function normalizeLoadedSession(session) {
       throw new Error("Stored OAuth access token is not a valid HTTP header value");
     }
   }
-  return { ...session, client, tokens };
+  return { ...session, discovery, client, tokens };
 }
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))
@@ -6423,6 +6424,20 @@ function validateCachedDiscovery(value, resource) {
     authorizationServerMetadata
   });
 }
+async function waitForCache(operation, signal) {
+  if (signal === void 0) return operation;
+  let abort;
+  try {
+    return await new Promise((resolve, reject) => {
+      abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      Promise.resolve(operation).then(resolve, reject);
+      if (signal.aborted) abort();
+    });
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 var OAuthMetadataDiscovery = class {
   fetchImpl;
   cache;
@@ -6459,7 +6474,7 @@ var OAuthMetadataDiscovery = class {
     if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       return structuredClone(memoryCachedResult);
     }
-    const sharedCachedResult = await this.cache?.get(cacheKey);
+    const sharedCachedResult = resourceMetadataUrl === void 0 ? await waitForCache(this.cache?.get(cacheKey), signal) : void 0;
     signal?.throwIfAborted();
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
@@ -6467,7 +6482,7 @@ var OAuthMetadataDiscovery = class {
         this.memoryCache.set(cacheKey, structuredClone(result));
         return result;
       } catch {
-        await this.cache?.delete?.(cacheKey);
+        await waitForCache(this.cache?.delete?.(cacheKey), signal);
       }
     }
     const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
@@ -6490,7 +6505,7 @@ var OAuthMetadataDiscovery = class {
             authorizationServerMetadata
           };
           this.memoryCache.set(cacheKey, structuredClone(result));
-          await this.cache?.set(cacheKey, structuredClone(result));
+          await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
           return result;
         } catch (error) {
           signal?.throwIfAborted();

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.342",
+      "version": "0.0.343",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.342",
+  "version": "0.0.343",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.342",
+  "version": "0.0.343",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.342",
+    "toolcraft-schema": "0.0.343",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",