toolcraft 0.0.344 → 0.0.346

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.70",
+      "version": "0.1.74",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.344",
+      "version": "0.0.346",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.344",
+      "version": "0.0.346",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.70",
+      "version": "0.1.74",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.344",
+      "version": "0.0.346",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.344",
+      "version": "0.0.346",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.70",
+      "version": "0.1.74",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -91,14 +91,21 @@ later environment changes cannot move a transaction between file and Keychain.
 Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
 exact spelling, port, path and query are preserved through registration,
 authorization and code exchange. Credentials, fragments, port zero and reserved
-OAuth callback query parameters are rejected before binding a listener.
+OAuth callback query parameters, including `error_uri`, are rejected before binding a listener.
 `createDefaultOAuthClientProvider` also checks the configured redirect before
 creating the provider. Imported tokens that cannot be sent as HTTP header
 values fail with diagnostics that omit their contents. Omit
 `redirectUri` to allocate a random loopback port. Standalone callback sessions
-accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
+accept the same `redirectUri`, `signal` and `timeoutMs` options. They capture configuration,
+landing-page data and selected callbacks before invoking a host listener factory;
+original signals and selected callback receivers/live method state remain active. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.
-Always close a successful standalone session in `finally`.
+Always close a standalone session in `finally`. Failed callback responses declare
+plain UTF-8 text with content sniffing disabled; provider markup remains literal
+text. Successful landing pages remain HTML with escaped custom title/body. Recognized
+OAuth callback parameters must occur only once in HTTP callbacks or pasted URLs;
+duplicates fail without reflecting values and code extraction returns null.
+Unrecognized extension parameters remain ignored, including repeated fields.
 
 Native provider calls capture request option handles before host work. Unauthorized
 handling also owns complete discovery metadata, presented grant values, rejected
@@ -266,6 +273,8 @@ Before sending a refresh request, the provider persists a tokenless session with
 A successful response replaces it with the rotated grant. A crash, cancellation,
 network disconnect or incomplete response leaves the marker, so another process
 cannot replay a possibly consumed refresh token or revive the initial import.
+An explicit `refresh_token` must be a nonempty string; malformed fields also
+retain the pending marker. Omitting it preserves the previous refresh token.
 Such a session requires fresh authorization. Interactive unauthorized handling
 can recover it; headless requests fail with an explicit unknown-outcome error.
 Only complete OAuth error responses establish a rejected request and allow a

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -1,6 +1,7 @@
 import http from "node:http";
 import { parseAuthorizationState } from "./authorization-state.js";
 const authorizationErrorBrand = Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
+const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export class OAuthAuthorizationError extends Error {
     error;
@@ -18,6 +19,10 @@ export class OAuthAuthorizationError extends Error {
     }
 }
 export async function createLoopbackAuthorizationSession(options = {}) {
+    const selected = { ...options };
+    options = { ...selected, createServer: selected.createServer?.bind(options),
+        openBrowser: selected.openBrowser?.bind(options), readLine: selected.readLine?.bind(options),
+        landingPage: selected.landingPage === undefined ? undefined : { ...selected.landingPage } };
     options.signal?.throwIfAborted();
     const timeoutMs = options.timeoutMs ?? 120_000;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
@@ -80,10 +85,9 @@ export function loopbackTarget(options) {
         catch (cause) {
             throw new Error("Invalid OAuth loopback redirect URI", { cause });
         }
-        const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
         if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
             || url.username || url.password || url.hash || url.port === "0"
-            || forbiddenQuery.some(name => url.searchParams.has(name))
+            || oauthCallbackParameters.some(name => url.searchParams.has(name))
             || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
             || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))
             throw new Error("Invalid OAuth loopback redirect URI");
@@ -154,11 +158,8 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 res.end("Not found");
                 return;
             }
-            const callbackParameters = {
-                code: url.searchParams.get("code"), error: url.searchParams.get("error"),
-                errorDescription: url.searchParams.get("error_description"), state: url.searchParams.get("state"), iss: url.searchParams.get("iss")
-            };
             try {
+                const callbackParameters = readAuthorizationCallbackParameters(url);
                 validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
                 if (callbackParameters.error !== null)
                     throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
@@ -168,7 +169,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 settle(() => resolve(code));
             }
             catch (error) {
-                res.writeHead(400);
+                res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "X-Content-Type-Options": "nosniff" });
                 res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
                 settle(() => reject(error));
             }
@@ -196,22 +197,21 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
     });
 }
 export function extractCodeFromInput(input) {
-    return extractCallbackParametersFromInput(input)?.code ?? null;
+    try {
+        return extractCallbackParametersFromInput(input)?.code ?? null;
+    }
+    catch {
+        return null;
+    }
 }
 function extractCallbackParametersFromInput(input) {
     const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
     if (trimmed.length === 0) {
         return null;
     }
+    let url;
     try {
-        const url = new URL(trimmed);
-        return {
-            code: url.searchParams.get("code"),
-            error: url.searchParams.get("error"),
-            errorDescription: url.searchParams.get("error_description"),
-            state: url.searchParams.get("state"),
-            iss: url.searchParams.get("iss")
-        };
+        url = new URL(trimmed);
     }
     catch {
         return {
@@ -222,6 +222,15 @@ function extractCallbackParametersFromInput(input) {
             iss: null
         };
     }
+    return readAuthorizationCallbackParameters(url);
+}
+function readAuthorizationCallbackParameters(url) {
+    for (const parameter of oauthCallbackParameters) {
+        if (url.searchParams.getAll(parameter).length > 1)
+            throw new Error(`OAuth callback parameter '${parameter}' must occur only once`);
+    }
+    return { code: url.searchParams.get("code"), error: url.searchParams.get("error"),
+        errorDescription: url.searchParams.get("error_description"), state: url.searchParams.get("state"), iss: url.searchParams.get("iss") };
 }
 function readExpectedAuthorizationCallback(authorizationUrl) {
     const url = new URL(authorizationUrl);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -138,6 +138,8 @@ async function requestTokens(input) {
         }
     }
     const refreshToken = getOwnEntry(payload, "refresh_token");
+    if (refreshToken !== undefined && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
+        throw new Error("OAuth token response has invalid refresh_token");
     const scope = getOwnEntry(payload, "scope");
     const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
         ? refreshToken.trim()

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.70",
+  "version": "0.1.74",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -58,10 +58,18 @@ Legacy SSE mode opens a GET stream and posts messages to the endpoint announced
 by the server. Announced endpoints must remain on the original origin without
 embedded credentials or fragments; endpoint changes close the connection.
 Both transports accept the same headers, OAuth provider and response limits.
+Static HTTP headers are copied and validated when the transport is constructed,
+before OAuth callbacks run. Invalid headers fail without reflecting their values.
+Use `snapshotHttpTransportHeaders(headers)` to apply the same ownership and safe
+validation when preparing a registry before constructing transports.
 `maxResponseBytes` bounds a complete JSON body or each SSE event (default 16 MiB).
 Receive streams may carry many bounded events and keepalive comments; the limit
 does not cap their lifetime bytes. Use request deadlines and cancellation to
 bound pending operations.
+Receive reconnections retain the last completed event ID through events and
+keepalives without IDs. An explicit empty `id:` clears the resume header,
+including any initially configured value.
+Unicode event IDs use UTF-8 bytes in `Last-Event-ID` headers.
 HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
 make transport decisions without parsing error messages. Legacy HTTP/SSE
 `connect()` also waits for the initialized notification POST to complete before
@@ -79,29 +87,30 @@ the same optional `closeReason` promise when closing requires asynchronous work.
 `HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.
 
 ```ts
-import { HttpTransport, createDefaultOAuthClientProvider } from "tiny-mcp-client";
+import { HttpTransport } from "tiny-mcp-client";
 
 const transport = new HttpTransport({
   url: "https://mcp.example.com/mcp",
   oauth: {
-    provider: createDefaultOAuthClientProvider({
-      client: {
-        mode: "dynamic",
-        metadata: {
-          clientName: "tiny-client"
-        }
-      },
-      browser: {
-        openBrowser: async (url) => {
-          console.log(`Open ${url}`);
-        }
+    client: {
+      mode: "dynamic",
+      metadata: {
+        clientName: "tiny-client"
       }
-    })
+    },
+    browser: {
+      openBrowser: async (url) => {
+        console.log(`Open ${url}`);
+      }
+    }
   }
 });
 ```
 
 You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. An explicit `resourceMetadataUrl` requires fresh network discovery without reading either cache; validated results still populate both caches. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
+Resource/issuer binding mismatches and exhausted authorization-server discovery
+expose `OAuthMetadataError.phase` while retaining complete SDK messages.
+`OAuthMetadataError.is(value)` recognizes separately bundled native copies.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -304,6 +304,12 @@ interface OAuthMetadataLookupOptions {
     resourceMetadataUrl?: string | URL;
     signal?: AbortSignal;
 }
+/** Native metadata failure with complete SDK diagnostics and a safe phase. */
+declare class OAuthMetadataError extends Error {
+    readonly phase: "protected-resource" | "authorization-server";
+    static is(value: unknown): value is OAuthMetadataError;
+    constructor(phase: "protected-resource" | "authorization-server", message: string);
+}
 declare class OAuthMetadataDiscovery {
     private readonly fetchImpl;
     private readonly cache;
@@ -725,6 +731,8 @@ declare class StdioTransport implements McpTransport {
     private appendStderrOutput;
     dispose(reason?: Error): void;
 }
+/** Own and validate static HTTP headers without reflecting malformed values. */
+declare function snapshotHttpTransportHeaders(headers?: RequestInit["headers"]): Headers;
 declare class HttpTransport implements McpTransport {
     readonly readable: Readable;
     readonly writable: Writable;
@@ -872,5 +880,5 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpProtocolVersion, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3517,6 +3517,7 @@ function getOwnEntry(record2, key2) {
 
 // ../mcp-oauth/dist/client/loopback-authorization.js
 var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
+var oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
 var OAuthAuthorizationError = class extends Error {
   error;
   errorDescription;
@@ -3533,6 +3534,14 @@ var OAuthAuthorizationError = class extends Error {
   }
 };
 async function createLoopbackAuthorizationSession(options = {}) {
+  const selected = { ...options };
+  options = {
+    ...selected,
+    createServer: selected.createServer?.bind(options),
+    openBrowser: selected.openBrowser?.bind(options),
+    readLine: selected.readLine?.bind(options),
+    landingPage: selected.landingPage === void 0 ? void 0 : { ...selected.landingPage }
+  };
   options.signal?.throwIfAborted();
   const timeoutMs = options.timeoutMs ?? 12e4;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
@@ -3592,8 +3601,7 @@ function loopbackTarget(options) {
     } catch (cause) {
       throw new Error("Invalid OAuth loopback redirect URI", { cause });
     }
-    const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
-    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || forbiddenQuery.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
+    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
       throw new Error("Invalid OAuth loopback redirect URI");
     return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
   }
@@ -3669,14 +3677,8 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
         res.end("Not found");
         return;
       }
-      const callbackParameters = {
-        code: url.searchParams.get("code"),
-        error: url.searchParams.get("error"),
-        errorDescription: url.searchParams.get("error_description"),
-        state: url.searchParams.get("state"),
-        iss: url.searchParams.get("iss")
-      };
       try {
+        const callbackParameters = readAuthorizationCallbackParameters(url);
         validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
         if (callbackParameters.error !== null)
           throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
@@ -3685,7 +3687,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
         res.end(buildSuccessPage(options.landingPage));
         settle(() => resolve(code));
       } catch (error) {
-        res.writeHead(400);
+        res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "X-Content-Type-Options": "nosniff" });
         res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
         settle(() => reject(error));
       }
@@ -3716,15 +3718,9 @@ function extractCallbackParametersFromInput(input) {
   if (trimmed.length === 0) {
     return null;
   }
+  let url;
   try {
-    const url = new URL(trimmed);
-    return {
-      code: url.searchParams.get("code"),
-      error: url.searchParams.get("error"),
-      errorDescription: url.searchParams.get("error_description"),
-      state: url.searchParams.get("state"),
-      iss: url.searchParams.get("iss")
-    };
+    url = new URL(trimmed);
   } catch {
     return {
       code: trimmed,
@@ -3734,6 +3730,20 @@ function extractCallbackParametersFromInput(input) {
       iss: null
     };
   }
+  return readAuthorizationCallbackParameters(url);
+}
+function readAuthorizationCallbackParameters(url) {
+  for (const parameter of oauthCallbackParameters) {
+    if (url.searchParams.getAll(parameter).length > 1)
+      throw new Error(`OAuth callback parameter '${parameter}' must occur only once`);
+  }
+  return {
+    code: url.searchParams.get("code"),
+    error: url.searchParams.get("error"),
+    errorDescription: url.searchParams.get("error_description"),
+    state: url.searchParams.get("state"),
+    iss: url.searchParams.get("iss")
+  };
 }
 function readExpectedAuthorizationCallback(authorizationUrl) {
   const url = new URL(authorizationUrl);
@@ -5174,6 +5184,8 @@ async function requestTokens(input) {
     }
   }
   const refreshToken = getOwnEntry5(payload, "refresh_token");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
+    throw new Error("OAuth token response has invalid refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
   const normalizedScope = normalizeOAuthScope(scope);
@@ -6232,6 +6244,19 @@ function createParameterHeaders(definitions, argumentsValue) {
 
 // src/oauth-discovery.ts
 import { isIP as isIP2 } from "node:net";
+var metadataErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.tiny-mcp-client.OAuthMetadataError");
+var OAuthMetadataError = class extends Error {
+  constructor(phase, message) {
+    super(message);
+    this.phase = phase;
+    this.name = "OAuthMetadataError";
+    Object.defineProperty(this, metadataErrorBrand, { value: true });
+  }
+  phase;
+  static is(value) {
+    return value instanceof Error && Object.getOwnPropertyDescriptor(value, metadataErrorBrand)?.value === true;
+  }
+};
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
@@ -6269,7 +6294,8 @@ function validateProtectedResourceMetadata(value, resourceUrl) {
   }
   const normalizedResource = canonicalizeResourceIndicator(value.resource);
   if (normalizedResource !== resourceUrl) {
-    throw new Error(
+    throw new OAuthMetadataError(
+      "protected-resource",
       `Protected resource metadata resource mismatch: expected ${resourceUrl}, received ${value.resource}`
     );
   }
@@ -6291,7 +6317,8 @@ function validateAuthorizationServerMetadata(value, issuer) {
     throw new Error("Authorization server metadata must include issuer");
   }
   if (value.issuer !== issuer) {
-    throw new Error(
+    throw new OAuthMetadataError(
+      "authorization-server",
       `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`
     );
   }
@@ -6534,7 +6561,8 @@ var OAuthMetadataDiscovery = class {
         }
       }
     }
-    throw new Error(
+    throw new OAuthMetadataError(
+      "authorization-server",
       `Unable to load authorization server metadata for ${cacheKey}: ${authorizationServerErrors.join(
         "; "
       )}`
@@ -7659,6 +7687,13 @@ var StdioTransport = class _StdioTransport {
     }
   }
 };
+function snapshotHttpTransportHeaders(headers) {
+  try {
+    return new Headers(headers);
+  } catch {
+    throw new Error("Invalid HTTP transport headers");
+  }
+}
 var HttpTransport = class {
   readable;
   writable;
@@ -7708,7 +7743,7 @@ var HttpTransport = class {
     this.maxResponseBytes = maxResponseBytes;
     this.url = url;
     this.mode = mode;
-    this.headers = headers;
+    this.headers = snapshotHttpTransportHeaders(headers);
     this.fetchImpl = fetchImpl;
     this.onWarning = onWarning;
     this.oauthProvider = oauth === void 0 ? void 0 : createOAuthClientProvider(oauth);
@@ -7985,7 +8020,8 @@ var HttpTransport = class {
     }
     if (this.legacyProtocolVersion !== void 0) headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     if (this.lastEventId !== void 0) {
-      headers.set("Last-Event-ID", this.lastEventId);
+      if (this.lastEventId === "") headers.delete("Last-Event-ID");
+      else headers.set("Last-Event-ID", Buffer.from(this.lastEventId, "utf8").toString("latin1"));
     }
     return this.authorizeRequestHeaders(headers, signal);
   }
@@ -8244,15 +8280,15 @@ var HttpTransport = class {
           void reader.cancel().catch(() => void 0);
           return;
         }
-        this.lastEventId = parser.lastEventId;
+        this.lastEventId = parser.lastEventId ?? this.lastEventId;
       }
       const trailingChunk = decoder.decode();
       if (trailingChunk.length > 0) {
         this.writeSseMessages(parser.push(trailingChunk), context);
-        this.lastEventId = parser.lastEventId;
+        this.lastEventId = parser.lastEventId ?? this.lastEventId;
       }
       this.writeSseMessages(parser.flush(), context);
-      this.lastEventId = parser.lastEventId;
+      this.lastEventId = parser.lastEventId ?? this.lastEventId;
       if (context !== void 0 && !context.completed) throw new Error("MCP HTTP stream ended before its final response");
     } catch (error) {
       void reader.cancel().catch(() => void 0);
@@ -9263,12 +9299,14 @@ export {
   McpClient,
   McpError,
   OAuthMetadataDiscovery,
+  OAuthMetadataError,
   StdioTransport,
   createInMemoryTransportPair,
   createSdkTestPair,
   createTestPair,
   discoverOAuthMetadata,
-  fetchMcpResponse
+  fetchMcpResponse,
+  snapshotHttpTransportHeaders
 };
 /*!
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.344",
+      "version": "0.0.346",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.344",
+  "version": "0.0.346",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.344",
+  "version": "0.0.346",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.344",
+    "toolcraft-schema": "0.0.346",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",