toolcraft 0.0.354 → 0.0.356

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.85",
+      "version": "0.1.88",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.354",
+      "version": "0.0.356",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.354",
+      "version": "0.0.356",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.85",
+      "version": "0.1.88",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.354",
+      "version": "0.0.356",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.354",
+      "version": "0.0.356",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/README.md

@@ -35,7 +35,8 @@ instances and processes serialize the same encrypted file or Keychain
 service/account; unrelated identities proceed independently. The default
 acquisition timeout is 30 seconds. Cancellation during acquisition does not
 release the active owner's lock. Each acquisition retains its original signal
-and timeout before path checks wait; replacing the caller's option handles cannot
+and timeout before path checks wait, including nonenumerable declared options;
+replacing the caller's option handles cannot
 bypass original cancellation or introduce another signal's cancellation. Individual `get`, `set` and `delete` calls do
 not implicitly acquire it.
 

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -81,7 +81,7 @@ export class EncryptedFileStore {
         }
     }
     async withLock(operation, options = {}) {
-        options = { ...options };
+        options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
         await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
         if (this.fs.readdir === undefined)
             throw new Error("Secret-store transaction locks require filesystem readdir support");

package/node_modules/auth-store/dist/transaction-lock.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { hasOwnErrorCode } from "./error-codes.js";
 /** Filesystem bakery lock: unique claims allow dead-owner cleanup without deleting a replacement owner's lock. */
 export async function withSecretStoreFileLock(fs, lockDirectory, operation, options = {}) {
-    options = { ...options };
+    options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
     const timeoutMs = options.timeoutMs ?? 30_000;
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647)
         throw new Error("Invalid secret-store transaction lock timeout");

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.85",
+      "version": "0.1.88",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -66,6 +66,9 @@ alone do not establish either native error type.
 
 The default provider captures client, interaction, callback, landing-page and
 lock policies when created. Create a new provider to change those settings.
+Initial grants and the selected clock are captured before native persistence
+callbacks. Clock methods retain their original host receiver and private class
+state; later clock state still determines whether a grant has expired.
 Selected callbacks, stores, clocks and AbortSignals remain live host dependencies;
 aborting the original signal still cancels authorization.
 An invalid clock fails before attaching or refreshing a grant with a known
@@ -74,7 +77,11 @@ unlimited secret lifetimes do not require a clock read. Valid negative epoch
 times remain supported.
 Native session and client persistence factories also capture file paths, salts,
 Keychain identities, lock locations and selected filesystem/command handles.
-Mutating these settings cannot redirect a later read or write.
+Mutating these settings cannot redirect a later read or write. Declared options
+retain nonenumerable values; selected filesystem, machine/home/random callbacks
+and Keychain runners keep their original host receiver, including private class
+state. `snapshotOAuthPersistenceOptions(options)` exposes this capture boundary
+for integrations that defer native store construction.
 The factories copy these settings before reading the selected backend environment
 variable, so its getter cannot replace them. They resolve that variable once at creation;
 later environment changes cannot move a transaction between file and Keychain.
@@ -124,6 +131,8 @@ A browser callback cannot redirect a later code exchange by changing caller
 metadata. Metadata loaded from a host session store is copied before clock or
 fetch callbacks, retaining the original refresh endpoint and persisted extensions. Explicit authentication owns metadata when lazy discovery returns;
 the selected discovery method retains its original receiver and live host state.
+Browser and standalone loopback snapshots also retain declared landing-page
+title/body values regardless of enumerability; served text remains HTML escaped.
 Browser and standalone loopback snapshots retain declared redirects, deadlines,
 cancellation and selected host hooks regardless of property enumerability.
 Browser callback hooks retain their original receiver and live host state.
@@ -161,8 +170,8 @@ corrupt or undecryptable records without reading their old contents. It atomical
 retires the identity's grant and registrations and writes a marker that suppresses
 stale initial grants. The default lock wait is 30 seconds. Other names/profiles
 are untouched, and symlink paths are still refused. Native reset, import and
-transaction callbacks retain their original signal while locks or reconciliation
-wait; replacing a caller handle cannot change subsequent cancellation checks.
+transaction callbacks retain their original signal and acquisition limit, including
+nonenumerable declared options, while locks or reconciliation wait; replacing a caller handle cannot change subsequent cancellation checks.
 Cancellation after a completed identity write prevents the transaction callback
 from running and retains that already persisted identity.
 
@@ -210,7 +219,9 @@ also be valid epoch milliseconds; adding the lifetime cannot make an invalid
 issuance clock acceptable. This applies to raw-grant parsing and token responses.
 For a raw OAuth response, `parseOAuthTokenGrant(response, { issuedAt, expiresAt })`
 returns normalized `StoredOAuthTokens`. Timing options are captured before the
-host clock runs, so it cannot bypass their earlier validation. The parser accepts
+host clock runs, so it cannot bypass their earlier validation. Declared timing
+options retain nonenumerable values, and a selected clock method retains its
+original host receiver. The parser accepts
 `access_token`, `refresh_token`,
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,3 +1,4 @@
+import { snapshotOAuthPersistenceOptions } from "./persistence-options.js";
 import { normalizeStoredOAuthClient } from "./client-registration.js";
 import crypto from "node:crypto";
 import path from "node:path";
@@ -82,16 +83,12 @@ export function createAuthStoreClientStore(options, namespace) {
     };
 }
 function snapshotPersistenceOptions(options) {
-    const snapshot = {
-        ...options,
-        ...(options.fileStore === undefined ? {} : { fileStore: { ...options.fileStore } }),
-        ...(options.keychainStore === undefined ? {} : { keychainStore: { ...options.keychainStore,
-                ...(options.keychainStore.lock === undefined ? {} : { lock: { ...options.keychainStore.lock } }) } })
-    };
+    const snapshot = snapshotOAuthPersistenceOptions(options);
     snapshot.backend = resolveSecretStoreBackend(snapshot);
     return snapshot;
 }
 export function createNamedSecretStore(key, options, defaults, namespace) {
+    options = snapshotOAuthPersistenceOptions(options);
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,4 @@
+import { snapshotOAuthPersistenceOptions } from "./persistence-options.js";
 import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
 import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
@@ -21,6 +22,7 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
+    const clock = options.now?.bind(options) ?? Date.now;
     const browser = snapshotLoopbackAuthorizationOptions(options.browser);
     const clientMode = options.client.mode;
     const interactiveEnabled = options.allowInteractive !== false;
@@ -32,14 +34,12 @@ export function createDefaultOAuthClientProvider(options) {
     const configuredClient = normalizeConfiguredClient(options.client);
     const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
     const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-    if (options.resourceIdentity !== undefined && options.sessionStore !== undefined)
+    const resourceIdentity = options.resourceIdentity, persistenceNamespace = options.persistenceNamespace, selectedSessionStore = options.sessionStore;
+    const suppliedGrant = options.initialGrant;
+    const capturedGrant = suppliedGrant === undefined ? undefined : { resource: suppliedGrant.resource, tokens: snapshotInitialGrantTokens(suppliedGrant.tokens) };
+    const authStore = options.authStore === undefined ? undefined : snapshotOAuthPersistenceOptions(options.authStore);
+    if (resourceIdentity !== undefined && selectedSessionStore !== undefined)
         throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
-    const resourceStores = options.resourceIdentity === undefined ? undefined :
-        createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
-    const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-    const clientStore = resourceStores?.clientStore ??
-        (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-    const clock = options.now ?? Date.now;
     const now = () => {
         const timestamp = clock();
         if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS)
@@ -47,10 +47,15 @@ export function createDefaultOAuthClientProvider(options) {
         return timestamp;
     };
     const registeredClients = new Map();
-    if (options.initialGrant !== undefined) {
+    const resourceStores = resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(authStore ?? {}, persistenceNamespace, resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? selectedSessionStore ?? createAuthStoreSessionStore(authStore, persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (authStore === undefined ? null : createAuthStoreClientStore(authStore, persistenceNamespace));
+    if (capturedGrant !== undefined) {
         let resource;
         try {
-            resource = new URL(options.initialGrant.resource);
+            resource = new URL(capturedGrant.resource);
         }
         catch {
             throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
@@ -58,9 +63,9 @@ export function createDefaultOAuthClientProvider(options) {
         if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.href.includes("#"))
             throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
     }
-    const initialGrant = options.initialGrant === undefined ? undefined : {
-        resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
+    const initialGrant = capturedGrant === undefined ? undefined : {
+        resource: canonicalizeResourceIndicator(capturedGrant.resource),
+        tokens: normalizeImportedTokens(capturedGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -606,6 +611,12 @@ function normalizeLoadedSession(session) {
     }
     return { ...session, discovery, client, tokens };
 }
+function snapshotInitialGrantTokens(value) {
+    if (!isObjectRecord(value))
+        return value;
+    const expiresAt = getOwnEntry(value, "expiresAt"), expiresIn = getOwnEntry(value, "expiresIn"), issuedAt = getOwnEntry(value, "issuedAt");
+    return { ...value, expiresAt, expiresIn, issuedAt };
+}
 function normalizeImportedTokens(value, now) {
     if (!isObjectRecord(value))
         return undefined;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -6,7 +6,7 @@ const oauthCallbackParameters = ["code", "state", "iss", "error", "error_descrip
 export function snapshotLoopbackAuthorizationOptions(options) {
     return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), createServer: options.createServer?.bind(options),
         callbackPath: options.callbackPath, redirectUri: options.redirectUri, signal: options.signal, timeoutMs: options.timeoutMs,
-        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage } };
+        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body } };
 }
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export class OAuthAuthorizationError extends Error {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.d.ts

@@ -0,0 +1,3 @@
+import type { CreateSecretStoreInput } from "auth-store";
+/** Own scalar policies while retaining selected live host dependencies. */
+export declare function snapshotOAuthPersistenceOptions(options: CreateSecretStoreInput): CreateSecretStoreInput;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.js

@@ -0,0 +1,10 @@
+/** Own scalar policies while retaining selected live host dependencies. */
+export function snapshotOAuthPersistenceOptions(options) {
+    const file = options.fileStore, keychain = options.keychainStore, lock = keychain?.lock;
+    return { ...options, backend: options.backend, env: options.env, platform: options.platform, backendEnvVar: options.backendEnvVar,
+        ...(file === undefined ? {} : { fileStore: { ...file, fs: file.fs, filePath: file.filePath, salt: file.salt,
+                defaultDirectory: file.defaultDirectory, defaultFileName: file.defaultFileName, throwOnInvalidDocument: file.throwOnInvalidDocument,
+                getHomeDirectory: file.getHomeDirectory?.bind(file), getMachineIdentity: file.getMachineIdentity?.bind(file), getRandomBytes: file.getRandomBytes?.bind(file) } }),
+        ...(keychain === undefined ? {} : { keychainStore: { ...keychain, service: keychain.service, account: keychain.account,
+                runCommand: keychain.runCommand?.bind(keychain), ...(lock === undefined ? {} : { lock: { ...lock, fs: lock.fs, directory: lock.directory } }) } }) };
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -52,7 +52,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
         }
     };
     async function replace(record, options) {
-        options = { ...options };
+        options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
         options.signal?.throwIfAborted();
         const timeoutMs = options.timeoutMs ?? 30_000;
         if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
@@ -126,7 +126,7 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
     }
     result.sessionStore = {
         async withLock(resource, operation, options) {
-            options = { ...options };
+            options = { ...options, signal: options?.signal, timeoutMs: options?.timeoutMs };
             if (store.withLock === undefined)
                 throw new Error("OAuth resource identity backend must support transaction locks");
             return store.withLock(async () => {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-grant.js

@@ -2,7 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { normalizeOAuthScope } from "./scope.js";
 /** Validate a raw RFC token response and anchor its lifetime once for persistence. */
 export function parseOAuthTokenGrant(value, options = {}) {
-    options = { ...options };
+    options = { ...options, expiresAt: options.expiresAt, issuedAt: options.issuedAt, now: options.now?.bind(options) };
     const invalid = () => new Error("Invalid OAuth token grant");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth token grant");
     if (typeof result !== "object" || result === null || Array.isArray(result))

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -1,3 +1,4 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.js

@@ -1,3 +1,4 @@
+export { snapshotOAuthPersistenceOptions } from "./client/persistence-options.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.85",
+  "version": "0.1.88",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,37 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/persistence-options.js
+function snapshotOAuthPersistenceOptions(options) {
+  const file = options.fileStore, keychain = options.keychainStore, lock = keychain?.lock;
+  return {
+    ...options,
+    backend: options.backend,
+    env: options.env,
+    platform: options.platform,
+    backendEnvVar: options.backendEnvVar,
+    ...file === void 0 ? {} : { fileStore: {
+      ...file,
+      fs: file.fs,
+      filePath: file.filePath,
+      salt: file.salt,
+      defaultDirectory: file.defaultDirectory,
+      defaultFileName: file.defaultFileName,
+      throwOnInvalidDocument: file.throwOnInvalidDocument,
+      getHomeDirectory: file.getHomeDirectory?.bind(file),
+      getMachineIdentity: file.getMachineIdentity?.bind(file),
+      getRandomBytes: file.getRandomBytes?.bind(file)
+    } },
+    ...keychain === void 0 ? {} : { keychainStore: {
+      ...keychain,
+      service: keychain.service,
+      account: keychain.account,
+      runCommand: keychain.runCommand?.bind(keychain),
+      ...lock === void 0 ? {} : { lock: { ...lock, fs: lock.fs, directory: lock.directory } }
+    } }
+  };
+}
+
 // ../mcp-oauth/dist/client/scope.js
 function normalizeOAuthScope(scope) {
   if (scope === void 0)
@@ -3528,7 +3559,7 @@ function snapshotLoopbackAuthorizationOptions(options) {
     redirectUri: options.redirectUri,
     signal: options.signal,
     timeoutMs: options.timeoutMs,
-    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage }
+    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
   };
 }
 var OAuthAuthorizationError = class extends Error {
@@ -3954,7 +3985,7 @@ function hasOwnErrorCode(error, code) {
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 async function withSecretStoreFileLock(fs2, lockDirectory, operation, options = {}) {
-  options = { ...options };
+  options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
   const timeoutMs = options.timeoutMs ?? 3e4;
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647)
     throw new Error("Invalid secret-store transaction lock timeout");
@@ -4174,7 +4205,7 @@ var EncryptedFileStore = class {
     }
   }
   async withLock(operation, options = {}) {
-    options = { ...options };
+    options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
     await this.assertCredentialPathHasNoSymbolicLinks(`${this.filePath}.lock`);
     if (this.fs.readdir === void 0)
       throw new Error("Secret-store transaction locks require filesystem readdir support");
@@ -4687,18 +4718,12 @@ function createAuthStoreClientStore(options, namespace) {
   };
 }
 function snapshotPersistenceOptions(options) {
-  const snapshot = {
-    ...options,
-    ...options.fileStore === void 0 ? {} : { fileStore: { ...options.fileStore } },
-    ...options.keychainStore === void 0 ? {} : { keychainStore: {
-      ...options.keychainStore,
-      ...options.keychainStore.lock === void 0 ? {} : { lock: { ...options.keychainStore.lock } }
-    } }
-  };
+  const snapshot = snapshotOAuthPersistenceOptions(options);
   snapshot.backend = resolveSecretStoreBackend(snapshot);
   return snapshot;
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
+  options = snapshotOAuthPersistenceOptions(options);
   const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
   const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
@@ -4842,7 +4867,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
     }
   };
   async function replace(record2, options2) {
-    options2 = { ...options2 };
+    options2 = { ...options2, signal: options2.signal, timeoutMs: options2.timeoutMs };
     options2.signal?.throwIfAborted();
     const timeoutMs = options2.timeoutMs ?? 3e4;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
@@ -4908,7 +4933,7 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
   }
   result.sessionStore = {
     async withLock(resource, operation, options2) {
-      options2 = { ...options2 };
+      options2 = { ...options2, signal: options2?.signal, timeoutMs: options2?.timeoutMs };
       if (store.withLock === void 0)
         throw new Error("OAuth resource identity backend must support transaction locks");
       return store.withLock(async () => {
@@ -5327,6 +5352,7 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
+  const clock = options.now?.bind(options) ?? Date.now;
   const browser = snapshotLoopbackAuthorizationOptions(options.browser);
   const clientMode = options.client.mode;
   const interactiveEnabled = options.allowInteractive !== false;
@@ -5338,12 +5364,12 @@ function createDefaultOAuthClientProvider(options) {
   const configuredClient = normalizeConfiguredClient(options.client);
   const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
   const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-  if (options.resourceIdentity !== void 0 && options.sessionStore !== void 0)
+  const resourceIdentity = options.resourceIdentity, persistenceNamespace = options.persistenceNamespace, selectedSessionStore = options.sessionStore;
+  const suppliedGrant = options.initialGrant;
+  const capturedGrant = suppliedGrant === void 0 ? void 0 : { resource: suppliedGrant.resource, tokens: snapshotInitialGrantTokens(suppliedGrant.tokens) };
+  const authStore = options.authStore === void 0 ? void 0 : snapshotOAuthPersistenceOptions(options.authStore);
+  if (resourceIdentity !== void 0 && selectedSessionStore !== void 0)
     throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
-  const resourceStores = options.resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
-  const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-  const clientStore = resourceStores?.clientStore ?? (options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
-  const clock = options.now ?? Date.now;
   const now = () => {
     const timestamp = clock();
     if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS3)
@@ -5351,19 +5377,22 @@ function createDefaultOAuthClientProvider(options) {
     return timestamp;
   };
   const registeredClients = /* @__PURE__ */ new Map();
-  if (options.initialGrant !== void 0) {
+  const resourceStores = resourceIdentity === void 0 ? void 0 : createResourceBoundOAuthStores(authStore ?? {}, persistenceNamespace, resourceIdentity);
+  const sessionStore = resourceStores?.sessionStore ?? selectedSessionStore ?? createAuthStoreSessionStore(authStore, persistenceNamespace);
+  const clientStore = resourceStores?.clientStore ?? (authStore === void 0 ? null : createAuthStoreClientStore(authStore, persistenceNamespace));
+  if (capturedGrant !== void 0) {
     let resource;
     try {
-      resource = new URL2(options.initialGrant.resource);
+      resource = new URL2(capturedGrant.resource);
     } catch {
       throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
     }
     if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.href.includes("#"))
       throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
   }
-  const initialGrant = options.initialGrant === void 0 ? void 0 : {
-    resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-    tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
+  const initialGrant = capturedGrant === void 0 ? void 0 : {
+    resource: canonicalizeResourceIndicator(capturedGrant.resource),
+    tokens: normalizeImportedTokens(capturedGrant.tokens, now),
     client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
@@ -5891,6 +5920,12 @@ function normalizeLoadedSession(session) {
   }
   return { ...session, discovery, client, tokens };
 }
+function snapshotInitialGrantTokens(value) {
+  if (!isObjectRecord3(value))
+    return value;
+  const expiresAt = getOwnEntry6(value, "expiresAt"), expiresIn = getOwnEntry6(value, "expiresIn"), issuedAt = getOwnEntry6(value, "issuedAt");
+  return { ...value, expiresAt, expiresIn, issuedAt };
+}
 function normalizeImportedTokens(value, now) {
   if (!isObjectRecord3(value))
     return void 0;

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.354",
+      "version": "0.0.356",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.354",
+  "version": "0.0.356",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.354",
+  "version": "0.0.356",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -158,7 +158,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.354",
+    "toolcraft-schema": "0.0.356",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",