toolcraft 0.0.346 → 0.0.348

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.74",
+      "version": "0.1.76",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.346",
+      "version": "0.0.348",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.346",
+      "version": "0.0.348",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.74",
+      "version": "0.1.76",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.346",
+      "version": "0.0.348",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.346",
+      "version": "0.0.348",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.74",
+      "version": "0.1.76",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -36,6 +36,9 @@ Unsupported pins fail before connection setup.
 `Tool` includes MCP `outputSchema` when a server advertises typed tool output.
 `CallToolResult.structuredContent` preserves modern JSON values; legacy servers
 require an object. Complete `content[]` blocks remain available in either case.
+`callTool` captures its signal and progress token when called. Later edits to
+the options object cannot leave a finished call's progress token active; progress
+notifications remain available while that call is pending.
 
 Set `requestTimeoutMs` on `McpClient` or `timeoutMs` on individual requests.
 Numeric deadlines must be finite, nonnegative and no greater than
@@ -110,7 +113,16 @@ const transport = new HttpTransport({
 You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. An explicit `resourceMetadataUrl` requires fresh network discovery without reading either cache; validated results still populate both caches. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate. It also settles while shared-cache reads, writes or eviction wait. Host cache work may finish afterward; its late rejection remains observed, and canceled discovery does not start another candidate.
 Resource/issuer binding mismatches and exhausted authorization-server discovery
 expose `OAuthMetadataError.phase` while retaining complete SDK messages.
+Protected-resource metadata HTTP failures also expose their numeric `status`.
+Advertised resource identities reject named and empty fragments before issuer
+discovery; malformed shared-cache identities are evicted. Resource queries and
+percent-escaped hash data remain part of the exact resource identity.
+Rejected metadata bodies start cleanup without delaying failure or caller
+cancellation. Host cleanup may finish later; its rejection remains observed.
 `OAuthMetadataError.is(value)` recognizes separately bundled native copies.
+Bearer challenges with repeated case-insensitive parameters fail before OAuth
+recovery, including identical repeats. Their rejected response bodies are released
+without reflecting parameter values in the diagnostic.
 
 OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -307,8 +307,9 @@ interface OAuthMetadataLookupOptions {
 /** Native metadata failure with complete SDK diagnostics and a safe phase. */
 declare class OAuthMetadataError extends Error {
     readonly phase: "protected-resource" | "authorization-server";
+    readonly status?: number | undefined;
     static is(value: unknown): value is OAuthMetadataError;
-    constructor(phase: "protected-resource" | "authorization-server", message: string);
+    constructor(phase: "protected-resource" | "authorization-server", message: string, status?: number | undefined);
 }
 declare class OAuthMetadataDiscovery {
     private readonly fetchImpl;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -6246,13 +6246,15 @@ function createParameterHeaders(definitions, argumentsValue) {
 import { isIP as isIP2 } from "node:net";
 var metadataErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.tiny-mcp-client.OAuthMetadataError");
 var OAuthMetadataError = class extends Error {
-  constructor(phase, message) {
+  constructor(phase, message, status) {
     super(message);
     this.phase = phase;
+    this.status = status;
     this.name = "OAuthMetadataError";
     Object.defineProperty(this, metadataErrorBrand, { value: true });
   }
   phase;
+  status;
   static is(value) {
     return value instanceof Error && Object.getOwnPropertyDescriptor(value, metadataErrorBrand)?.value === true;
   }
@@ -6292,6 +6294,9 @@ function validateProtectedResourceMetadata(value, resourceUrl) {
   if (typeof value.resource !== "string" || value.resource.length === 0) {
     throw new Error("Protected resource metadata must include a resource string");
   }
+  if (value.resource.includes("#")) {
+    throw new OAuthMetadataError("protected-resource", "Protected resource metadata resource must not include fragment");
+  }
   const normalizedResource = canonicalizeResourceIndicator(value.resource);
   if (normalizedResource !== resourceUrl) {
     throw new OAuthMetadataError(
@@ -6360,11 +6365,12 @@ function validateAuthorizationServerMetadata(value, issuer) {
   }
   return value;
 }
-async function readJsonResponse(response, label, signal) {
+async function readJsonResponse(response, phase, signal) {
+  const label = phase === "protected-resource" ? "Protected resource metadata" : "Authorization server metadata";
   if (!response.ok) {
-    await response.body?.cancel().catch(() => void 0);
+    void response.body?.cancel().catch(() => void 0);
     const statusDescriptor = `${response.status} ${response.statusText}`.trim();
-    throw new Error(`${label} request failed (${statusDescriptor})`);
+    throw new OAuthMetadataError(phase, `${label} request failed (${statusDescriptor})`, response.status);
   }
   const text = await readBoundedResponseText(response, 1024 * 1024, void 0, signal);
   try {
@@ -6373,7 +6379,7 @@ async function readJsonResponse(response, label, signal) {
     throw new Error(`${label} response must be valid JSON`);
   }
 }
-async function fetchMetadata(fetch2, location, label, parentSignal) {
+async function fetchMetadata(fetch2, location, phase, parentSignal) {
   parentSignal?.throwIfAborted();
   const deadline = AbortSignal.timeout(1e4);
   const signal = parentSignal === void 0 ? deadline : AbortSignal.any([deadline, parentSignal]);
@@ -6382,7 +6388,7 @@ async function fetchMetadata(fetch2, location, label, parentSignal) {
     headers: { Accept: "application/json" },
     signal
   });
-  return readJsonResponse(response, label, signal);
+  return readJsonResponse(response, phase, signal);
 }
 function resolveWellKnownMetadataUrl(inputUrl, suffix) {
   const url = new URL(typeof inputUrl === "string" ? inputUrl : inputUrl.toString());
@@ -6501,7 +6507,7 @@ var OAuthMetadataDiscovery = class {
     for (const location of locations) {
       try {
         const metadata = validateProtectedResourceMetadata(
-          await fetchMetadata(this.fetchImpl, location, "Protected resource metadata", signal),
+          await fetchMetadata(this.fetchImpl, location, "protected-resource", signal),
           resource
         );
         return { location, metadata };
@@ -6539,7 +6545,7 @@ var OAuthMetadataDiscovery = class {
       for (const authorizationServerMetadataUrl of metadataLocations) {
         try {
           const authorizationServerMetadata = validateAuthorizationServerMetadata(
-            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "Authorization server metadata", signal),
+            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "authorization-server", signal),
             normalizedAuthorizationServer
           );
           const result = {
@@ -6728,7 +6734,11 @@ function parseBearerWwwAuthenticateHeader(headerValue) {
           if (parsedParam === null) {
             break;
           }
-          params[parsedParam.name.toLowerCase()] = parsedParam.value;
+          const parameterName = parsedParam.name.toLowerCase();
+          if (scheme.token.toLowerCase() === "bearer" && Object.hasOwn(params, parameterName)) {
+            throw new Error("Bearer challenge must not repeat authentication parameters");
+          }
+          params[parameterName] = parsedParam.value;
           index = skipOptionalWhitespace(headerValue, parsedParam.nextIndex);
           if (headerValue[index] !== ",") {
             break;
@@ -7109,6 +7119,7 @@ var McpClient = class {
     };
   }
   async callTool(params, options = {}) {
+    options = { ...options };
     const messageLayer = this.getMessageLayerOrThrow();
     const serverCapabilities = this.getServerCapabilitiesOrThrow();
     if (serverCapabilities.tools === void 0) {
@@ -8194,9 +8205,9 @@ var HttpTransport = class {
     if (discoveryClient === void 0) {
       return false;
     }
-    const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
-    const resourceMetadataUrl = challenge?.params.resource_metadata;
     try {
+      const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
+      const resourceMetadataUrl = challenge?.params.resource_metadata;
       const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
       const providerResponse = response.clone();
       let result;
@@ -8378,10 +8389,12 @@ var HttpTransport = class {
       let attempt = await request();
       if (await this.maybeHandleUnauthorizedResponse(attempt.response, controller.signal, attempt.headers, attempt.tokens)) attempt = await request();
       const response = attempt.response;
-      const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
-      if (oauthError !== null) {
+      try {
+        const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
+        if (oauthError !== null) throw oauthError;
+      } catch (error) {
         void response.body?.cancel().catch(() => void 0);
-        throw oauthError;
+        throw error;
       }
       return response;
     } finally {

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.346",
+      "version": "0.0.348",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.346",
+  "version": "0.0.348",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.346",
+  "version": "0.0.348",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.346",
+    "toolcraft-schema": "0.0.348",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",