toolcraft 0.0.345 → 0.0.347

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.71",
+      "version": "0.1.75",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.345",
+      "version": "0.0.347",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.345",
+      "version": "0.0.347",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.71",
+      "version": "0.1.75",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.345",
+      "version": "0.0.347",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.345",
+      "version": "0.0.347",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.71",
+      "version": "0.1.75",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.71",
+  "version": "0.1.75",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -66,6 +66,10 @@ validation when preparing a registry before constructing transports.
 Receive streams may carry many bounded events and keepalive comments; the limit
 does not cap their lifetime bytes. Use request deadlines and cancellation to
 bound pending operations.
+Receive reconnections retain the last completed event ID through events and
+keepalives without IDs. An explicit empty `id:` clears the resume header,
+including any initially configured value.
+Unicode event IDs use UTF-8 bytes in `Last-Event-ID` headers.
 HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
 make transport decisions without parsing error messages. Legacy HTTP/SSE
 `connect()` also waits for the initialized notification POST to complete before
@@ -83,29 +87,36 @@ the same optional `closeReason` promise when closing requires asynchronous work.
 `HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.
 
 ```ts
-import { HttpTransport, createDefaultOAuthClientProvider } from "tiny-mcp-client";
+import { HttpTransport } from "tiny-mcp-client";
 
 const transport = new HttpTransport({
   url: "https://mcp.example.com/mcp",
   oauth: {
-    provider: createDefaultOAuthClientProvider({
-      client: {
-        mode: "dynamic",
-        metadata: {
-          clientName: "tiny-client"
-        }
-      },
-      browser: {
-        openBrowser: async (url) => {
-          console.log(`Open ${url}`);
-        }
+    client: {
+      mode: "dynamic",
+      metadata: {
+        clientName: "tiny-client"
       }
-    })
+    },
+    browser: {
+      openBrowser: async (url) => {
+        console.log(`Open ${url}`);
+      }
+    }
   }
 });
 ```
 
 You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. An explicit `resourceMetadataUrl` requires fresh network discovery without reading either cache; validated results still populate both caches. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
+Resource/issuer binding mismatches and exhausted authorization-server discovery
+expose `OAuthMetadataError.phase` while retaining complete SDK messages.
+Protected-resource metadata HTTP failures also expose their numeric `status`.
+Rejected metadata bodies start cleanup without delaying failure or caller
+cancellation. Host cleanup may finish later; its rejection remains observed.
+`OAuthMetadataError.is(value)` recognizes separately bundled native copies.
+Bearer challenges with repeated case-insensitive parameters fail before OAuth
+recovery, including identical repeats. Their rejected response bodies are released
+without reflecting parameter values in the diagnostic.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -304,6 +304,13 @@ interface OAuthMetadataLookupOptions {
     resourceMetadataUrl?: string | URL;
     signal?: AbortSignal;
 }
+/** Native metadata failure with complete SDK diagnostics and a safe phase. */
+declare class OAuthMetadataError extends Error {
+    readonly phase: "protected-resource" | "authorization-server";
+    readonly status?: number | undefined;
+    static is(value: unknown): value is OAuthMetadataError;
+    constructor(phase: "protected-resource" | "authorization-server", message: string, status?: number | undefined);
+}
 declare class OAuthMetadataDiscovery {
     private readonly fetchImpl;
     private readonly cache;
@@ -874,5 +881,5 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpProtocolVersion, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };

package/node_modules/tiny-mcp-client/dist/index.js

@@ -6244,6 +6244,21 @@ function createParameterHeaders(definitions, argumentsValue) {
 
 // src/oauth-discovery.ts
 import { isIP as isIP2 } from "node:net";
+var metadataErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.tiny-mcp-client.OAuthMetadataError");
+var OAuthMetadataError = class extends Error {
+  constructor(phase, message, status) {
+    super(message);
+    this.phase = phase;
+    this.status = status;
+    this.name = "OAuthMetadataError";
+    Object.defineProperty(this, metadataErrorBrand, { value: true });
+  }
+  phase;
+  status;
+  static is(value) {
+    return value instanceof Error && Object.getOwnPropertyDescriptor(value, metadataErrorBrand)?.value === true;
+  }
+};
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
@@ -6281,7 +6296,8 @@ function validateProtectedResourceMetadata(value, resourceUrl) {
   }
   const normalizedResource = canonicalizeResourceIndicator(value.resource);
   if (normalizedResource !== resourceUrl) {
-    throw new Error(
+    throw new OAuthMetadataError(
+      "protected-resource",
       `Protected resource metadata resource mismatch: expected ${resourceUrl}, received ${value.resource}`
     );
   }
@@ -6303,7 +6319,8 @@ function validateAuthorizationServerMetadata(value, issuer) {
     throw new Error("Authorization server metadata must include issuer");
   }
   if (value.issuer !== issuer) {
-    throw new Error(
+    throw new OAuthMetadataError(
+      "authorization-server",
       `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`
     );
   }
@@ -6345,11 +6362,12 @@ function validateAuthorizationServerMetadata(value, issuer) {
   }
   return value;
 }
-async function readJsonResponse(response, label, signal) {
+async function readJsonResponse(response, phase, signal) {
+  const label = phase === "protected-resource" ? "Protected resource metadata" : "Authorization server metadata";
   if (!response.ok) {
-    await response.body?.cancel().catch(() => void 0);
+    void response.body?.cancel().catch(() => void 0);
     const statusDescriptor = `${response.status} ${response.statusText}`.trim();
-    throw new Error(`${label} request failed (${statusDescriptor})`);
+    throw new OAuthMetadataError(phase, `${label} request failed (${statusDescriptor})`, response.status);
   }
   const text = await readBoundedResponseText(response, 1024 * 1024, void 0, signal);
   try {
@@ -6358,7 +6376,7 @@ async function readJsonResponse(response, label, signal) {
     throw new Error(`${label} response must be valid JSON`);
   }
 }
-async function fetchMetadata(fetch2, location, label, parentSignal) {
+async function fetchMetadata(fetch2, location, phase, parentSignal) {
   parentSignal?.throwIfAborted();
   const deadline = AbortSignal.timeout(1e4);
   const signal = parentSignal === void 0 ? deadline : AbortSignal.any([deadline, parentSignal]);
@@ -6367,7 +6385,7 @@ async function fetchMetadata(fetch2, location, label, parentSignal) {
     headers: { Accept: "application/json" },
     signal
   });
-  return readJsonResponse(response, label, signal);
+  return readJsonResponse(response, phase, signal);
 }
 function resolveWellKnownMetadataUrl(inputUrl, suffix) {
   const url = new URL(typeof inputUrl === "string" ? inputUrl : inputUrl.toString());
@@ -6486,7 +6504,7 @@ var OAuthMetadataDiscovery = class {
     for (const location of locations) {
       try {
         const metadata = validateProtectedResourceMetadata(
-          await fetchMetadata(this.fetchImpl, location, "Protected resource metadata", signal),
+          await fetchMetadata(this.fetchImpl, location, "protected-resource", signal),
           resource
         );
         return { location, metadata };
@@ -6524,7 +6542,7 @@ var OAuthMetadataDiscovery = class {
       for (const authorizationServerMetadataUrl of metadataLocations) {
         try {
           const authorizationServerMetadata = validateAuthorizationServerMetadata(
-            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "Authorization server metadata", signal),
+            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "authorization-server", signal),
             normalizedAuthorizationServer
           );
           const result = {
@@ -6546,7 +6564,8 @@ var OAuthMetadataDiscovery = class {
         }
       }
     }
-    throw new Error(
+    throw new OAuthMetadataError(
+      "authorization-server",
       `Unable to load authorization server metadata for ${cacheKey}: ${authorizationServerErrors.join(
         "; "
       )}`
@@ -6712,7 +6731,11 @@ function parseBearerWwwAuthenticateHeader(headerValue) {
           if (parsedParam === null) {
             break;
           }
-          params[parsedParam.name.toLowerCase()] = parsedParam.value;
+          const parameterName = parsedParam.name.toLowerCase();
+          if (scheme.token.toLowerCase() === "bearer" && Object.hasOwn(params, parameterName)) {
+            throw new Error("Bearer challenge must not repeat authentication parameters");
+          }
+          params[parameterName] = parsedParam.value;
           index = skipOptionalWhitespace(headerValue, parsedParam.nextIndex);
           if (headerValue[index] !== ",") {
             break;
@@ -8004,7 +8027,8 @@ var HttpTransport = class {
     }
     if (this.legacyProtocolVersion !== void 0) headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     if (this.lastEventId !== void 0) {
-      headers.set("Last-Event-ID", this.lastEventId);
+      if (this.lastEventId === "") headers.delete("Last-Event-ID");
+      else headers.set("Last-Event-ID", Buffer.from(this.lastEventId, "utf8").toString("latin1"));
     }
     return this.authorizeRequestHeaders(headers, signal);
   }
@@ -8177,9 +8201,9 @@ var HttpTransport = class {
     if (discoveryClient === void 0) {
       return false;
     }
-    const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
-    const resourceMetadataUrl = challenge?.params.resource_metadata;
     try {
+      const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
+      const resourceMetadataUrl = challenge?.params.resource_metadata;
       const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
       const providerResponse = response.clone();
       let result;
@@ -8263,15 +8287,15 @@ var HttpTransport = class {
           void reader.cancel().catch(() => void 0);
           return;
         }
-        this.lastEventId = parser.lastEventId;
+        this.lastEventId = parser.lastEventId ?? this.lastEventId;
       }
       const trailingChunk = decoder.decode();
       if (trailingChunk.length > 0) {
         this.writeSseMessages(parser.push(trailingChunk), context);
-        this.lastEventId = parser.lastEventId;
+        this.lastEventId = parser.lastEventId ?? this.lastEventId;
       }
       this.writeSseMessages(parser.flush(), context);
-      this.lastEventId = parser.lastEventId;
+      this.lastEventId = parser.lastEventId ?? this.lastEventId;
       if (context !== void 0 && !context.completed) throw new Error("MCP HTTP stream ended before its final response");
     } catch (error) {
       void reader.cancel().catch(() => void 0);
@@ -8361,10 +8385,12 @@ var HttpTransport = class {
       let attempt = await request();
       if (await this.maybeHandleUnauthorizedResponse(attempt.response, controller.signal, attempt.headers, attempt.tokens)) attempt = await request();
       const response = attempt.response;
-      const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
-      if (oauthError !== null) {
+      try {
+        const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
+        if (oauthError !== null) throw oauthError;
+      } catch (error) {
         void response.body?.cancel().catch(() => void 0);
-        throw oauthError;
+        throw error;
       }
       return response;
     } finally {
@@ -9282,6 +9308,7 @@ export {
   McpClient,
   McpError,
   OAuthMetadataDiscovery,
+  OAuthMetadataError,
   StdioTransport,
   createInMemoryTransportPair,
   createSdkTestPair,

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.345",
+      "version": "0.0.347",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.345",
+  "version": "0.0.347",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.345",
+  "version": "0.0.347",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.345",
+    "toolcraft-schema": "0.0.347",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",