toolcraft 0.0.352 → 0.0.354

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.85",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.352",
+      "version": "0.0.354",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.352",
+      "version": "0.0.354",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.85",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.352",
+      "version": "0.0.354",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.352",
+      "version": "0.0.354",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.82",
+      "version": "0.1.85",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -47,6 +47,7 @@ alone do not establish either native error type.
 
 - `client`
   - `mode: "dynamic"` with optional `metadata`
+    and optional existing `clientId`/`clientSecret`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
 - `sessionLockTimeoutMs` limits acquisition waits for a session transaction lock (default 30,000 ms; integer from 1 to 2147483647)
@@ -266,6 +267,10 @@ Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;
 select separate persistence or explicitly reset the session to change apps.
+An explicitly supplied client ID is used for consent in either mode, including
+when discovery advertises a registrar. Dynamic registration creates a client
+only when no existing app identity is supplied; URL client IDs stay opaque and
+do not trigger client-metadata fetching or registration fallback.
 Use `persistenceNamespace: "personal"` or `"work"` to keep separate native
 profiles for the same resource/issuer. `createAuthStoreSessionStore(options,
 namespace)` addresses the same profile when seeding or inspecting credentials.

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -396,7 +396,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();
-        if (clientMode === "static" || configuredClient?.registration !== undefined) {
+        if (clientMode === "static" || configuredClient !== null) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
@@ -410,13 +410,6 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         const registrationEndpoint = getOwnString(discovery.authorizationServerMetadata, "registration_endpoint");
-        if (registrationEndpoint === undefined && configuredClient !== null) {
-            return {
-                kind: "static",
-                fromStoredRegistration: false,
-                client: configuredClient
-            };
-        }
         let storedClient = await loadRegisteredClient(discovery.authorizationServer);
         const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client :
             storedClient?.registrationOwnership === "caller" ? storedClient : undefined;
@@ -453,17 +446,12 @@ export function createDefaultOAuthClientProvider(options) {
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
         if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
-            const isConfiguredStaticFallback = configuredClient !== null &&
-                existingSession.client.clientId === configuredClient.clientId &&
-                existingSession.client.clientSecret === configuredClient.clientSecret;
-            if (!isConfiguredStaticFallback) {
-                await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
-                return {
-                    kind: "dynamic",
-                    fromStoredRegistration: true,
-                    client: existingSession.client
-                };
-            }
+            await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+            return {
+                kind: "dynamic",
+                fromStoredRegistration: true,
+                client: existingSession.client
+            };
         }
         const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
         const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.82",
+  "version": "0.1.85",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5691,7 +5691,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
     parentSignal?.throwIfAborted();
-    if (clientMode === "static" || configuredClient?.registration !== void 0) {
+    if (clientMode === "static" || configuredClient !== null) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
@@ -5705,13 +5705,6 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     const registrationEndpoint = getOwnString2(discovery.authorizationServerMetadata, "registration_endpoint");
-    if (registrationEndpoint === void 0 && configuredClient !== null) {
-      return {
-        kind: "static",
-        fromStoredRegistration: false,
-        client: configuredClient
-      };
-    }
     let storedClient = await loadRegisteredClient(discovery.authorizationServer);
     const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client : storedClient?.registrationOwnership === "caller" ? storedClient : void 0;
     if (importedClient !== void 0) {
@@ -5747,15 +5740,12 @@ function createDefaultOAuthClientProvider(options) {
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
     if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
-      const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
-      if (!isConfiguredStaticFallback) {
-        await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
-        return {
-          kind: "dynamic",
-          fromStoredRegistration: true,
-          client: existingSession.client
-        };
-      }
+      await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+      return {
+        kind: "dynamic",
+        fromStoredRegistration: true,
+        client: existingSession.client
+      };
     }
     const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
     const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.352",
+      "version": "0.0.354",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.352",
+  "version": "0.0.354",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.352",
+  "version": "0.0.354",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.352",
+    "toolcraft-schema": "0.0.354",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",