toolcraft 0.0.349 → 0.0.350

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.78",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.349",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.349",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.78",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.349",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.349",
+      "version": "0.0.350",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.78",
+      "version": "0.1.80",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -61,12 +61,16 @@ alone do not establish either native error type.
 - `browser.timeoutMs` optional authorization deadline (default 120,000 ms)
 - `sessionStore` optional
 - `authStore` optional `auth-store` backend config for the default session store
-- `now()` optional clock override
+- `now()` optional clock override returning integer Unix epoch milliseconds within the JavaScript Date range
 
 The default provider captures client, interaction, callback, landing-page and
 lock policies when created. Create a new provider to change those settings.
 Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
 aborting the original signal still cancels authorization.
+An invalid clock fails before attaching or refreshing a grant with a known
+expiry or redeeming a time-limited client secret. Unknown access lifetimes and
+unlimited secret lifetimes do not require a clock read. Valid negative epoch
+times remain supported.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
 Mutating these settings cannot redirect a later read or write.
@@ -94,6 +98,9 @@ authorization and code exchange. Credentials, fragments, port zero and reserved
 OAuth callback query parameters, including `error_uri`, are rejected before binding a listener.
 Fragment rejection includes a trailing empty `#`. Empty queries and percent-escaped
 hash data remain valid and keep their exact registered spelling.
+Direct initial grants and host-supplied or stored authorization, token and
+registration endpoints also reject empty fragment components before consent or
+credential redemption. Percent-escaped hashes remain ordinary path/query data.
 `createDefaultOAuthClientProvider` also checks the configured redirect before
 creating the provider. Imported tokens that cannot be sent as HTTP header
 values fail with diagnostics that omit their contents. Omit

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -40,7 +40,13 @@ export function createDefaultOAuthClientProvider(options) {
     const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = resourceStores?.clientStore ??
         (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-    const now = options.now ?? Date.now;
+    const clock = options.now ?? Date.now;
+    const now = () => {
+        const timestamp = clock();
+        if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS)
+            throw new Error("OAuth clock must return valid epoch milliseconds");
+        return timestamp;
+    };
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
         let resource;
@@ -50,7 +56,7 @@ export function createDefaultOAuthClientProvider(options) {
         catch {
             throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
         }
-        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.hash)
+        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.href.includes("#"))
             throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
@@ -756,7 +762,7 @@ function isLoopbackHostname(hostname) {
 }
 function assertSecureUrl(value, label) {
     const url = new URL(value);
-    if (url.username !== "" || url.password !== "" || url.hash !== "") {
+    if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
         throw new Error(`${label} must not include credentials or fragment`);
     }
     if (url.protocol === "https:") {

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5335,7 +5335,13 @@ function createDefaultOAuthClientProvider(options) {
   const resourceStores = options.resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
   const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = resourceStores?.clientStore ?? (options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-  const now = options.now ?? Date.now;
+  const clock = options.now ?? Date.now;
+  const now = () => {
+    const timestamp = clock();
+    if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS3)
+      throw new Error("OAuth clock must return valid epoch milliseconds");
+    return timestamp;
+  };
   const registeredClients = /* @__PURE__ */ new Map();
   if (options.initialGrant !== void 0) {
     let resource;
@@ -5344,7 +5350,7 @@ function createDefaultOAuthClientProvider(options) {
     } catch {
       throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
     }
-    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.hash)
+    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.href.includes("#"))
       throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
   }
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
@@ -6011,7 +6017,7 @@ function isLoopbackHostname(hostname2) {
 }
 function assertSecureUrl(value, label) {
   const url = new URL2(value);
-  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+  if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
     throw new Error(`${label} must not include credentials or fragment`);
   }
   if (url.protocol === "https:") {

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.349",
+      "version": "0.0.350",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.349",
+  "version": "0.0.350",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.349",
+  "version": "0.0.350",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.349",
+    "toolcraft-schema": "0.0.350",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",