toolcraft 0.0.351 → 0.0.353

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.84",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.351",
+      "version": "0.0.353",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.351",
+      "version": "0.0.353",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.84",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.351",
+      "version": "0.0.353",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.351",
+      "version": "0.0.353",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.84",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -47,6 +47,7 @@ alone do not establish either native error type.
 
 - `client`
   - `mode: "dynamic"` with optional `metadata`
+    and optional existing `clientId`/`clientSecret`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
 - `sessionLockTimeoutMs` limits acquisition waits for a session transaction lock (default 30,000 ms; integer from 1 to 2147483647)
@@ -123,6 +124,9 @@ A browser callback cannot redirect a later code exchange by changing caller
 metadata. Metadata loaded from a host session store is copied before clock or
 fetch callbacks, retaining the original refresh endpoint and persisted extensions. Explicit authentication owns metadata when lazy discovery returns;
 the selected discovery method retains its original receiver and live host state.
+Browser and standalone loopback snapshots retain declared redirects, deadlines,
+cancellation and selected host hooks regardless of property enumerability.
+Browser callback hooks retain their original receiver and live host state.
 
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
@@ -263,6 +267,10 @@ Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;
 select separate persistence or explicitly reset the session to change apps.
+An explicitly supplied client ID is used for consent in either mode, including
+when discovery advertises a registrar. Dynamic registration creates a client
+only when no existing app identity is supplied; URL client IDs stay opaque and
+do not trigger client-metadata fetching or registration fallback.
 Use `persistenceNamespace: "personal"` or `"work"` to keep separate native
 profiles for the same resource/issuer. `createAuthStoreSessionStore(options,
 namespace)` addresses the same profile when seeding or inspecting credentials.

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -6,7 +6,7 @@ import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore, assertPersistenceNamespace } from "./auth-store-session-store.js";
-import { createLoopbackAuthorizationSession, loopbackTarget } from "./loopback-authorization.js";
+import { createLoopbackAuthorizationSession, loopbackTarget, snapshotLoopbackAuthorizationOptions } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
@@ -21,8 +21,7 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
-    const browser = { ...options.browser,
-        ...(options.browser.landingPage === undefined ? {} : { landingPage: { ...options.browser.landingPage } }) };
+    const browser = snapshotLoopbackAuthorizationOptions(options.browser);
     const clientMode = options.client.mode;
     const interactiveEnabled = options.allowInteractive !== false;
     const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
@@ -397,7 +396,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        if (clientMode === "static" || configuredClient?.registration !== undefined) {
+        if (clientMode === "static" || configuredClient !== null) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -411,13 +410,6 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         const registrationEndpoint = getOwnString(discovery.authorizationServerMetadata, "registration_endpoint");
-        if (registrationEndpoint === undefined && configuredClient !== null) {
-            return {
-                kind: "static",
-                fromStoredRegistration: false,
-                client: configuredClient
-            };
-        }
         let storedClient = await loadRegisteredClient(discovery.authorizationServer);
         const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client :
             storedClient?.registrationOwnership === "caller" ? storedClient : undefined;
@@ -454,17 +446,12 @@ export function createDefaultOAuthClientProvider(options) {
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
         if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
-            const isConfiguredStaticFallback = configuredClient !== null &&
-                existingSession.client.clientId === configuredClient.clientId &&
-                existingSession.client.clientSecret === configuredClient.clientSecret;
-            if (!isConfiguredStaticFallback) {
-                await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
-                return {
-                    kind: "dynamic",
-                    fromStoredRegistration: true,
-                    client: existingSession.client
-                };
-            }
+            await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+            return {
+                kind: "dynamic",
+                fromStoredRegistration: true,
+                client: existingSession.client
+            };
         }
         const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
         const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -20,6 +20,8 @@ export interface LoopbackAuthorizationSession {
     waitForCode(authorizationUrl: string): Promise<string>;
     close(): void;
 }
+/** Capture declared configuration regardless of property enumerability. */
+export declare function snapshotLoopbackAuthorizationOptions(options: LoopbackAuthorizationOptions): LoopbackAuthorizationOptions;
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export declare class OAuthAuthorizationError extends Error {
     readonly error: string;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -2,6 +2,12 @@ import http from "node:http";
 import { parseAuthorizationState } from "./authorization-state.js";
 const authorizationErrorBrand = Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
 const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+/** Capture declared configuration regardless of property enumerability. */
+export function snapshotLoopbackAuthorizationOptions(options) {
+    return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), createServer: options.createServer?.bind(options),
+        callbackPath: options.callbackPath, redirectUri: options.redirectUri, signal: options.signal, timeoutMs: options.timeoutMs,
+        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage } };
+}
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export class OAuthAuthorizationError extends Error {
     error;
@@ -19,10 +25,7 @@ export class OAuthAuthorizationError extends Error {
     }
 }
 export async function createLoopbackAuthorizationSession(options = {}) {
-    const selected = { ...options };
-    options = { ...selected, createServer: selected.createServer?.bind(options),
-        openBrowser: selected.openBrowser?.bind(options), readLine: selected.readLine?.bind(options),
-        landingPage: selected.landingPage === undefined ? undefined : { ...selected.landingPage } };
+    options = snapshotLoopbackAuthorizationOptions(options);
     options.signal?.throwIfAborted();
     const timeoutMs = options.timeoutMs ?? 120_000;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3518,6 +3518,19 @@ function getOwnEntry(record2, key2) {
 // ../mcp-oauth/dist/client/loopback-authorization.js
 var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
 var oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+function snapshotLoopbackAuthorizationOptions(options) {
+  return {
+    ...options,
+    openBrowser: options.openBrowser?.bind(options),
+    readLine: options.readLine?.bind(options),
+    createServer: options.createServer?.bind(options),
+    callbackPath: options.callbackPath,
+    redirectUri: options.redirectUri,
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage }
+  };
+}
 var OAuthAuthorizationError = class extends Error {
   error;
   errorDescription;
@@ -3534,14 +3547,7 @@ var OAuthAuthorizationError = class extends Error {
   }
 };
 async function createLoopbackAuthorizationSession(options = {}) {
-  const selected = { ...options };
-  options = {
-    ...selected,
-    createServer: selected.createServer?.bind(options),
-    openBrowser: selected.openBrowser?.bind(options),
-    readLine: selected.readLine?.bind(options),
-    landingPage: selected.landingPage === void 0 ? void 0 : { ...selected.landingPage }
-  };
+  options = snapshotLoopbackAuthorizationOptions(options);
   options.signal?.throwIfAborted();
   const timeoutMs = options.timeoutMs ?? 12e4;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
@@ -5321,10 +5327,7 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
-  const browser = {
-    ...options.browser,
-    ...options.browser.landingPage === void 0 ? {} : { landingPage: { ...options.browser.landingPage } }
-  };
+  const browser = snapshotLoopbackAuthorizationOptions(options.browser);
   const clientMode = options.client.mode;
   const interactiveEnabled = options.allowInteractive !== false;
   const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
@@ -5688,7 +5691,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    if (clientMode === "static" || configuredClient?.registration !== void 0) {
+    if (clientMode === "static" || configuredClient !== null) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5702,13 +5705,6 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     const registrationEndpoint = getOwnString2(discovery.authorizationServerMetadata, "registration_endpoint");
-    if (registrationEndpoint === void 0 && configuredClient !== null) {
-      return {
-        kind: "static",
-        fromStoredRegistration: false,
-        client: configuredClient
-      };
-    }
     let storedClient = await loadRegisteredClient(discovery.authorizationServer);
     const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client : storedClient?.registrationOwnership === "caller" ? storedClient : void 0;
     if (importedClient !== void 0) {
@@ -5744,15 +5740,12 @@ function createDefaultOAuthClientProvider(options) {
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
     if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
-      const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
-      if (!isConfiguredStaticFallback) {
-        await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
-        return {
-          kind: "dynamic",
-          fromStoredRegistration: true,
-          client: existingSession.client
-        };
-      }
+      await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+      return {
+        kind: "dynamic",
+        fromStoredRegistration: true,
+        client: existingSession.client
+      };
     }
     const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
     const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.351",
+      "version": "0.0.353",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.351",
+  "version": "0.0.353",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.351",
+  "version": "0.0.353",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.351",
+    "toolcraft-schema": "0.0.353",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",