toolcraft 0.0.348 → 0.0.350

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.76",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.348",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.348",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.76",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.348",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.348",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.76",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -61,12 +61,16 @@ alone do not establish either native error type.
 - `browser.timeoutMs` optional authorization deadline (default 120,000 ms)
 - `sessionStore` optional
 - `authStore` optional `auth-store` backend config for the default session store
-- `now()` optional clock override
+- `now()` optional clock override returning integer Unix epoch milliseconds within the JavaScript Date range
 
 The default provider captures client, interaction, callback, landing-page and
 lock policies when created. Create a new provider to change those settings.
 Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
 aborting the original signal still cancels authorization.
+An invalid clock fails before attaching or refreshing a grant with a known
+expiry or redeeming a time-limited client secret. Unknown access lifetimes and
+unlimited secret lifetimes do not require a clock read. Valid negative epoch
+times remain supported.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
@@ -92,6 +96,11 @@ Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
 exact spelling, port, path and query are preserved through registration,
 authorization and code exchange. Credentials, fragments, port zero and reserved
 OAuth callback query parameters, including `error_uri`, are rejected before binding a listener.
+Fragment rejection includes a trailing empty `#`. Empty queries and percent-escaped
+hash data remain valid and keep their exact registered spelling.
+Direct initial grants and host-supplied or stored authorization, token and
+registration endpoints also reject empty fragment components before consent or
+credential redemption. Percent-escaped hashes remain ordinary path/query data.
 `createDefaultOAuthClientProvider` also checks the configured redirect before
 creating the provider. Imported tokens that cannot be sent as HTTP header
 values fail with diagnostics that omit their contents. Omit

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -40,7 +40,13 @@ export function createDefaultOAuthClientProvider(options) {
     const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = resourceStores?.clientStore ??
         (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-    const now = options.now ?? Date.now;
+    const clock = options.now ?? Date.now;
+    const now = () => {
+        const timestamp = clock();
+        if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS)
+            throw new Error("OAuth clock must return valid epoch milliseconds");
+        return timestamp;
+    };
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
         let resource;
@@ -50,7 +56,7 @@ export function createDefaultOAuthClientProvider(options) {
         catch {
             throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
         }
-        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.hash)
+        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.href.includes("#"))
             throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
@@ -756,7 +762,7 @@ function isLoopbackHostname(hostname) {
 }
 function assertSecureUrl(value, label) {
     const url = new URL(value);
-    if (url.username !== "" || url.password !== "" || url.hash !== "") {
+    if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
         throw new Error(`${label} must not include credentials or fragment`);
     }
     if (url.protocol === "https:") {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -86,7 +86,7 @@ export function loopbackTarget(options) {
             throw new Error("Invalid OAuth loopback redirect URI", { cause });
         }
         if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
-            || url.username || url.password || url.hash || url.port === "0"
+            || url.username || url.password || url.href.includes("#") || url.port === "0"
             || oauthCallbackParameters.some(name => url.searchParams.has(name))
             || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
             || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.76",
+  "version": "0.1.80",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -60,6 +60,8 @@ timer; a timeout releases request capacity so later operations can proceed.
 Legacy SSE mode opens a GET stream and posts messages to the endpoint announced
 by the server. Announced endpoints must remain on the original origin without
 embedded credentials or fragments; endpoint changes close the connection.
+Empty fragment delimiters are rejected too; escaped hashes in an endpoint path
+or query remain literal data.
 Both transports accept the same headers, OAuth provider and response limits.
 Static HTTP headers are copied and validated when the transport is constructed,
 before OAuth callbacks run. Invalid headers fail without reflecting their values.
@@ -117,6 +119,10 @@ Protected-resource metadata HTTP failures also expose their numeric `status`.
 Advertised resource identities reject named and empty fragments before issuer
 discovery; malformed shared-cache identities are evicted. Resource queries and
 percent-escaped hash data remain part of the exact resource identity.
+Discovery lookup, metadata and endpoint URLs reject empty fragments too.
+Issuer identifiers reject named or empty query/fragment components; escaped
+delimiters in their paths remain valid. Original lookup fragments fail before
+cache access, and cached metadata locations with empty fragments are evicted.
 Rejected metadata bodies start cleanup without delaying failure or caller
 cancellation. Host cleanup may finish later; its rejection remains observed.
 `OAuthMetadataError.is(value)` recognizes separately bundled native copies.

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3601,7 +3601,7 @@ function loopbackTarget(options) {
     } catch (cause) {
       throw new Error("Invalid OAuth loopback redirect URI", { cause });
     }
-    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
+    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.href.includes("#") || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
       throw new Error("Invalid OAuth loopback redirect URI");
     return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
   }
@@ -5335,7 +5335,13 @@ function createDefaultOAuthClientProvider(options) {
   const resourceStores = options.resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
   const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = resourceStores?.clientStore ?? (options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-  const now = options.now ?? Date.now;
+  const clock = options.now ?? Date.now;
+  const now = () => {
+    const timestamp = clock();
+    if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS3)
+      throw new Error("OAuth clock must return valid epoch milliseconds");
+    return timestamp;
+  };
   const registeredClients = /* @__PURE__ */ new Map();
   if (options.initialGrant !== void 0) {
     let resource;
@@ -5344,7 +5350,7 @@ function createDefaultOAuthClientProvider(options) {
     } catch {
       throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
     }
-    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.hash)
+    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.href.includes("#"))
       throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
   }
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
@@ -6011,7 +6017,7 @@ function isLoopbackHostname(hostname2) {
 }
 function assertSecureUrl(value, label) {
   const url = new URL2(value);
-  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+  if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
     throw new Error(`${label} must not include credentials or fragment`);
   }
   if (url.protocol === "https:") {
@@ -6276,7 +6282,7 @@ function isLoopbackHostname2(hostname2) {
   return normalizedHostname === "localhost" || normalizedHostname === "::1" || normalizedHostname === "[::1]" || isIP2(normalizedHostname) === 4 && normalizedHostname.startsWith("127.");
 }
 function assertSecureUrl2(url, label) {
-  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+  if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
     throw new Error(`${label} must not include credentials or fragment`);
   }
   if (url.protocol === "https:") {
@@ -6346,11 +6352,6 @@ function validateAuthorizationServerMetadata(value, issuer) {
     } catch {
       throw new Error(`Authorization server metadata ${field} must be an absolute URL`);
     }
-    if (endpoint.username !== "" || endpoint.password !== "" || endpoint.hash !== "") {
-      throw new Error(
-        `Authorization server metadata ${field} must not include credentials or fragment`
-      );
-    }
     assertSecureUrl2(endpoint, `Authorization server metadata ${field}`);
   }
   if (!isStringArray(value.response_types_supported) || !value.response_types_supported.includes("code")) {
@@ -6397,7 +6398,7 @@ function resolveWellKnownMetadataUrl(inputUrl, suffix) {
   return url.toString();
 }
 function resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl) {
-  const resource = new URL(canonicalizeResourceIndicator(resourceUrl));
+  const resource = new URL(typeof resourceUrl === "string" ? resourceUrl : resourceUrl.toString());
   assertSecureUrl2(resource, "Protected resource URL");
   if (resourceMetadataUrl !== void 0) {
     const resolvedResourceMetadataUrl2 = new URL(
@@ -6416,7 +6417,7 @@ function resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl) {
 function validateAuthorizationServerIssuer(issuer) {
   const input = typeof issuer === "string" ? issuer : issuer.toString();
   const url = new URL(input);
-  if (url.search.length > 0 || url.hash.length > 0) {
+  if (url.href.includes("?") || url.href.includes("#")) {
     throw new Error("Authorization server issuer must not include query or fragment");
   }
   assertSecureUrl2(url, "Authorization server issuer");
@@ -6450,11 +6451,6 @@ function validateCachedDiscovery(value, resource) {
   }
   const resourceMetadata = validateProtectedResourceMetadata(value.resourceMetadata, resource);
   const resourceMetadataLocation = new URL(value.resourceMetadataUrl);
-  if (resourceMetadataLocation.username !== "" || resourceMetadataLocation.password !== "" || resourceMetadataLocation.hash !== "") {
-    throw new Error(
-      "Cached OAuth discovery metadata location must not include credentials or fragment"
-    );
-  }
   assertSecureUrl2(resourceMetadataLocation, "Cached OAuth discovery metadata location");
   const issuer = validateAuthorizationServerIssuer(value.authorizationServer);
   if (!resourceMetadata.authorization_servers.includes(issuer)) {
@@ -6521,7 +6517,7 @@ var OAuthMetadataDiscovery = class {
   async discover(resourceUrl, { resourceMetadataUrl, signal } = {}) {
     signal?.throwIfAborted();
     const cacheKey = canonicalizeResourceIndicator(resourceUrl);
-    resolveProtectedResourceMetadataUrl(cacheKey, resourceMetadataUrl);
+    resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl);
     const memoryCachedResult = this.memoryCache.get(cacheKey);
     if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       return structuredClone(memoryCachedResult);
@@ -8333,7 +8329,7 @@ var HttpTransport = class {
       if (message.event === "endpoint") {
         const endpoint = new URL(message.data, this.url);
         const resource = new URL(this.url);
-        if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:" || endpoint.origin !== resource.origin || endpoint.username || endpoint.password || endpoint.hash)
+        if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:" || endpoint.origin !== resource.origin || endpoint.username || endpoint.password || endpoint.href.includes("#"))
           throw new Error("Unsafe legacy SSE endpoint");
         if (this.legacyEndpoint !== void 0 && this.legacyEndpoint !== endpoint.href)
           throw new Error("Legacy SSE endpoint changed during the active connection");

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.348",
+      "version": "0.0.350",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.348",
+  "version": "0.0.350",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.348",
+  "version": "0.0.350",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.348",
+    "toolcraft-schema": "0.0.350",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",