toolcraft 0.0.353 → 0.0.355

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.84",
+      "version": "0.1.87",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.353",
+      "version": "0.0.355",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.353",
+      "version": "0.0.355",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.84",
+      "version": "0.1.87",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.353",
+      "version": "0.0.355",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.353",
+      "version": "0.0.355",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.84",
+      "version": "0.1.87",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -66,6 +66,9 @@ alone do not establish either native error type.
 
 The default provider captures client, interaction, callback, landing-page and
 lock policies when created. Create a new provider to change those settings.
+Initial grants and the selected clock are captured before native persistence
+callbacks. Clock methods retain their original host receiver and private class
+state; later clock state still determines whether a grant has expired.
 Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
 aborting the original signal still cancels authorization.
 An invalid clock fails before attaching or refreshing a grant with a known
@@ -74,7 +77,11 @@ unlimited secret lifetimes do not require a clock read. Valid negative epoch
 times remain supported.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
-Mutating these settings cannot redirect a later read or write.
+Mutating these settings cannot redirect a later read or write. Declared options
+retain nonenumerable values; selected filesystem, machine/home/random callbacks
+and Keychain runners keep their original host receiver, including private class
+state. `snapshotOAuthPersistenceOptions(options)` exposes this capture boundary
+for integrations that defer native store construction.
 The factories copy these settings before reading the selected backend environment
 variable, so its getter cannot replace them. They resolve that variable once at creation;
 later environment changes cannot move a transaction between file and Keychain.
@@ -124,6 +131,8 @@ A browser callback cannot redirect a later code exchange by changing caller
 metadata. Metadata loaded from a host session store is copied before clock or
 fetch callbacks, retaining the original refresh endpoint and persisted extensions. Explicit authentication owns metadata when lazy discovery returns;
 the selected discovery method retains its original receiver and live host state.
+Browser and standalone loopback snapshots also retain declared landing-page
+title/body values regardless of enumerability; served text remains HTML escaped.
 Browser and standalone loopback snapshots retain declared redirects, deadlines,
 cancellation and selected host hooks regardless of property enumerability.
 Browser callback hooks retain their original receiver and live host state.
@@ -210,7 +219,9 @@ also be valid epoch milliseconds; adding the lifetime cannot make an invalid
 issuance clock acceptable. This applies to raw-grant parsing and token responses.
 For a raw OAuth response, `parseOAuthTokenGrant(response, { issuedAt, expiresAt })`
 returns normalized `StoredOAuthTokens`. Timing options are captured before the
-host clock runs, so it cannot bypass their earlier validation. The parser accepts
+host clock runs, so it cannot bypass their earlier validation. Declared timing
+options retain nonenumerable values, and a selected clock method retains its
+original host receiver. The parser accepts
 `access_token`, `refresh_token`,
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { snapshotOAuthPersistenceOptions } from "./persistence-options.js";
 import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
@@ -82,16 +83,12 @@ export function createAuthStoreClientStore(options, namespace) {
     };
 }
 function snapshotPersistenceOptions(options) {
-    const snapshot = {
-        ...options,
-        ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
-        ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
-                ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
-    };
+    const snapshot = snapshotOAuthPersistenceOptions(options);
     snapshot.backend = resolveSecretStoreBackend(snapshot);
     return snapshot;
 }
 export function createNamedSecretStore(key, options, defaults, namespace) {
+    options = snapshotOAuthPersistenceOptions(options);
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,4 @@
+import { snapshotOAuthPersistenceOptions } from "./persistence-options.js";
 import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
 import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
@@ -21,6 +22,7 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
+    const clock = options.now?.bind(options) ?? Date.now;
     const browser = snapshotLoopbackAuthorizationOptions(options.browser);
     const clientMode = options.client.mode;
     const interactiveEnabled = options.allowInteractive !== false;
@@ -32,14 +34,12 @@ export function createDefaultOAuthClientProvider(options) {
     const configuredClient = normalizeConfiguredClient(options.client);
     const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
     const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-    if (options.resourceIdentity !== undefined && options.sessionStore !== undefined)
+    const resourceIdentity = options.resourceIdentity, persistenceNamespace = options.persistenceNamespace, selectedSessionStore = options.sessionStore;
+    const suppliedGrant = options.initialGrant;
+    const capturedGrant = suppliedGrant === undefined ? undefined : { resource: suppliedGrant.resource, tokens: snapshotInitialGrantTokens(suppliedGrant.tokens) };
+    const authStore = options.authStore === undefined ? undefined : snapshotOAuthPersistenceOptions(options.authStore);
+    if (resourceIdentity !== undefined && selectedSessionStore !== undefined)
         throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
-    const resourceStores = options.resourceIdentity === undefined ? undefined :
-        createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
-    const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-    const clientStore = resourceStores?.clientStore ??
-        (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-    const clock = options.now ?? Date.now;
     const now = () => {
         const timestamp = clock();
         if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS)
@@ -47,10 +47,15 @@ export function createDefaultOAuthClientProvider(options) {
         return timestamp;
     };
     const registeredClients = new Map();
-    if (options.initialGrant !== undefined) {
+    const resourceStores = resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(authStore ?? {}, persistenceNamespace, resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? selectedSessionStore ?? createAuthStoreSessionStore(authStore, persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (authStore === undefined ? null : createAuthStoreClientStore(authStore, persistenceNamespace));
+    if (capturedGrant !== undefined) {
         let resource;
         try {
-            resource = new URL(options.initialGrant.resource);
+            resource = new URL(capturedGrant.resource);
         }
         catch {
             throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
@@ -58,9 +63,9 @@ export function createDefaultOAuthClientProvider(options) {
         if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.href.includes("#"))
             throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
     }
-    const initialGrant = options.initialGrant === undefined ? undefined : {
-        resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
+    const initialGrant = capturedGrant === undefined ? undefined : {
+        resource: canonicalizeResourceIndicator(capturedGrant.resource),
+        tokens: normalizeImportedTokens(capturedGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -606,6 +611,12 @@ function normalizeLoadedSession(session) {
     }
     return { ...session, discovery, client, tokens };
 }
+function snapshotInitialGrantTokens(value) {
+    if (!isObjectRecord(value))
+        return value;
+    const expiresAt = getOwnEntry(value, "expiresAt"), expiresIn = getOwnEntry(value, "expiresIn"), issuedAt = getOwnEntry(value, "issuedAt");
+    return { ...value, expiresAt, expiresIn, issuedAt };
+}
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))
         return undefined;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -6,7 +6,7 @@ const oauthCallbackParameters = ["code", "state", "iss", "error", "error_descrip
 export function snapshotLoopbackAuthorizationOptions(options) {
     return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), createServer: options.createServer?.bind(options),
         callbackPath: options.callbackPath, redirectUri: options.redirectUri, signal: options.signal, timeoutMs: options.timeoutMs,
-        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage } };
+        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body } };
 }
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export class OAuthAuthorizationError extends Error {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.d.ts

@@ -0,0 +1,3 @@
+import type { CreateSecretStoreInput } from "auth-store";
+/** Own scalar policies while retaining selected live host dependencies. */
+export declare function snapshotOAuthPersistenceOptions(options: CreateSecretStoreInput): CreateSecretStoreInput;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.js

@@ -0,0 +1,10 @@
+/** Own scalar policies while retaining selected live host dependencies. */
+export function snapshotOAuthPersistenceOptions(options) {
+    const file = options.fileStore, keychain = options.keychainStore, lock = keychain?.lock;
+    return { ...options, backend: options.backend, env: options.env, platform: options.platform, backendEnvVar: options.backendEnvVar,
+        ...(file === undefined ? {} : { fileStore: { ...file, fs: file.fs, filePath: file.filePath, salt: file.salt,
+                defaultDirectory: file.defaultDirectory, defaultFileName: file.defaultFileName, throwOnInvalidDocument: file.throwOnInvalidDocument,
+                getHomeDirectory: file.getHomeDirectory?.bind(file), getMachineIdentity: file.getMachineIdentity?.bind(file), getRandomBytes: file.getRandomBytes?.bind(file) } }),
+        ...(keychain === undefined ? {} : { keychainStore: { ...keychain, service: keychain.service, account: keychain.account,
+                runCommand: keychain.runCommand?.bind(keychain), ...(lock === undefined ? {} : { lock: { ...lock, fs: lock.fs, directory: lock.directory } }) } }) };
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -2,7 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { normalizeOAuthScope } from "./scope.js";
 /** Validate a raw RFC token response and anchor its lifetime once for persistence. */
 export function parseOAuthTokenGrant(value, options = {}) {
-    options = { ...options };
+    options = { ...options, expiresAt: options.expiresAt, issuedAt: options.issuedAt, now: options.now?.bind(options) };
     const invalid = () => new Error("Invalid OAuth token grant");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
     if (typeof result !== "object" || result === null || Array.isArray(result))

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,3 +1,4 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.js

@@ -1,3 +1,4 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.84",
+  "version": "0.1.87",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,37 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/persistence-options.js
+function snapshotOAuthPersistenceOptions(options) {
+  const file = options.fileStore, keychain = options.keychainStore, lock = keychain?.lock;
+  return {
+    ...options,
+    backend: options.backend,
+    env: options.env,
+    platform: options.platform,
+    backendEnvVar: options.backendEnvVar,
+    ...file === void 0 ? {} : { fileStore: {
+      ...file,
+      fs: file.fs,
+      filePath: file.filePath,
+      salt: file.salt,
+      defaultDirectory: file.defaultDirectory,
+      defaultFileName: file.defaultFileName,
+      throwOnInvalidDocument: file.throwOnInvalidDocument,
+      getHomeDirectory: file.getHomeDirectory?.bind(file),
+      getMachineIdentity: file.getMachineIdentity?.bind(file),
+      getRandomBytes: file.getRandomBytes?.bind(file)
+    } },
+    ...keychain === void 0 ? {} : { keychainStore: {
+      ...keychain,
+      service: keychain.service,
+      account: keychain.account,
+      runCommand: keychain.runCommand?.bind(keychain),
+      ...lock === void 0 ? {} : { lock: { ...lock, fs: lock.fs, directory: lock.directory } }
+    } }
+  };
+}
+
 // ../mcp-oauth/dist/client/scope.js
 function normalizeOAuthScope(scope) {
   if (scope === void 0)
@@ -3528,7 +3559,7 @@ function snapshotLoopbackAuthorizationOptions(options) {
     redirectUri: options.redirectUri,
     signal: options.signal,
     timeoutMs: options.timeoutMs,
-    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage }
+    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
   };
 }
 var OAuthAuthorizationError = class extends Error {
@@ -4687,18 +4718,12 @@ function createAuthStoreClientStore(options, namespace) {
   };
 }
 function snapshotPersistenceOptions(options) {
-  const snapshot = {
-    ...options,
-    ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
-    ...options.keychainStore === void 0 ? {} : { keychainStore: {
-      ...options.keychainStore,
-      ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
-    } }
-  };
+  const snapshot = snapshotOAuthPersistenceOptions(options);
   snapshot.backend = resolveSecretStoreBackend(snapshot);
   return snapshot;
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
+  options = snapshotOAuthPersistenceOptions(options);
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
   const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
@@ -5327,6 +5352,7 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
+  const clock = options.now?.bind(options) ?? Date.now;
   const browser = snapshotLoopbackAuthorizationOptions(options.browser);
   const clientMode = options.client.mode;
   const interactiveEnabled = options.allowInteractive !== false;
@@ -5338,12 +5364,12 @@ function createDefaultOAuthClientProvider(options) {
   const configuredClient = normalizeConfiguredClient(options.client);
   const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
   const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-  if (options.resourceIdentity !== void 0 && options.sessionStore !== void 0)
+  const resourceIdentity = options.resourceIdentity, persistenceNamespace = options.persistenceNamespace, selectedSessionStore = options.sessionStore;
+  const suppliedGrant = options.initialGrant;
+  const capturedGrant = suppliedGrant === void 0 ? void 0 : { resource: suppliedGrant.resource, tokens: snapshotInitialGrantTokens(suppliedGrant.tokens) };
+  const authStore = options.authStore === void 0 ? void 0 : snapshotOAuthPersistenceOptions(options.authStore);
+  if (resourceIdentity !== void 0 && selectedSessionStore !== void 0)
     throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
-  const resourceStores = options.resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
-  const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-  const clientStore = resourceStores?.clientStore ?? (options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-  const clock = options.now ?? Date.now;
   const now = () => {
     const timestamp = clock();
     if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS3)
@@ -5351,19 +5377,22 @@ function createDefaultOAuthClientProvider(options) {
     return timestamp;
   };
   const registeredClients = /* @__PURE__ */ new Map();
-  if (options.initialGrant !== void 0) {
+  const resourceStores = resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(authStore ?? {}, persistenceNamespace, resourceIdentity);
+  const sessionStore = resourceStores?.sessionStore ?? selectedSessionStore ?? createAuthStoreSessionStore(authStore, persistenceNamespace);
+  const clientStore = resourceStores?.clientStore ?? (authStore === void 0 ? null : createAuthStoreClientStore(authStore, persistenceNamespace));
+  if (capturedGrant !== void 0) {
     let resource;
     try {
-      resource = new URL2(options.initialGrant.resource);
+      resource = new URL2(capturedGrant.resource);
     } catch {
       throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
     }
     if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.href.includes("#"))
       throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
   }
-  const initialGrant = options.initialGrant === void 0 ? void 0 : {
-    resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-    tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
+  const initialGrant = capturedGrant === void 0 ? void 0 : {
+    resource: canonicalizeResourceIndicator(capturedGrant.resource),
+    tokens: normalizeImportedTokens(capturedGrant.tokens, now),
     client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
@@ -5891,6 +5920,12 @@ function normalizeLoadedSession(session) {
   }
   return { ...session, discovery, client, tokens };
 }
+function snapshotInitialGrantTokens(value) {
+  if (!isObjectRecord3(value))
+    return value;
+  const expiresAt = getOwnEntry6(value, "expiresAt"), expiresIn = getOwnEntry6(value, "expiresIn"), issuedAt = getOwnEntry6(value, "issuedAt");
+  return { ...value, expiresAt, expiresIn, issuedAt };
+}
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))
     return void 0;

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.353",
+      "version": "0.0.355",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.353",
+  "version": "0.0.355",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.353",
+  "version": "0.0.355",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.353",
+    "toolcraft-schema": "0.0.355",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",