toolcraft 0.0.409 → 0.0.411

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.88",
+      "version": "0.1.89",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.409",
+      "version": "0.0.411",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.409",
+      "version": "0.0.411",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.88",
+      "version": "0.1.89",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.409",
+      "version": "0.0.411",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.409",
+      "version": "0.0.411",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/README.md

@@ -389,6 +389,57 @@ CLI equivalent:
 npx tiny-http-mcp-server --stateless
 ```
 
+## Cloudflare Workers and Fetch hosts
+
+Use the additive `tiny-http-mcp-server/fetch` entry point for a stateless
+`Request` → `Response` handler. It shares the typed tool registry and protocol
+engine with the Node server, without importing Node HTTP, stdio, or OAuth
+modules. Existing `createHttpServer` integrations are unchanged.
+
+```ts
+import { createFetchServer, defineSchema } from "tiny-http-mcp-server/fetch";
+
+const mcp = createFetchServer<{ userId: string }>({
+  name: "images",
+  version: "1.0.0",
+  maxRequestBytes: 128 * 1024,
+  maxResponseBytes: 512 * 1024,
+  maxConcurrentToolCalls: 4,
+  maxQueuedToolCalls: 0
+}).tool("whoami", "Identify the caller", defineSchema({}), (_, { context }) =>
+  context.userId
+);
+
+export default {
+  async fetch(request: Request, env: Env) {
+    // Verify the key with your existing authentication system on EVERY request.
+    const user = await authenticateApiKey(request, env);
+    if (!user) return new Response("Unauthorized", { status: 401 });
+    return mcp.fetch(request, { userId: user.id });
+  }
+};
+```
+
+Authentication and URL routing belong to your host. The second `fetch` argument
+is trusted local state; JSON-RPC parameters and `_meta` cannot override it.
+Tool handlers also receive `request` and a cancellation `signal`. Use that signal
+for downstream work; aborted requests must not keep consuming resources.
+
+The Fetch transport returns JSON for POST, acknowledges notifications with 202,
+and returns 405 with `Allow: POST` for GET/DELETE and other methods. It creates no
+sessions and rejects batch requests before executing any member. Clients must
+send `Content-Type: application/json` and accept both `application/json` and
+`text/event-stream`. Origins are rejected unless explicitly listed in
+`allowedOrigins`; the host owns CORS preflight/response headers. Thrown handler
+exceptions are sanitized; return an explicit MCP `isError` result for an error
+message intended for callers.
+
+`.tool(...)` and `.registerTool(...)` support the same typed schemas, structured
+outputs, and content results as the Node API. Request and response byte limits
+default to 1 MiB. Tool concurrency, queue bounds, active request limits, and tool
+timeouts use the shared server options. Stateless Fetch does not support
+subscriptions or server-initiated notification streams.
+
 ## API Reference
 
 The package re-exports the base server helpers from `tiny-stdio-mcp-server`, so you can import `defineSchema`, `createServer`, `Image`, `Audio`, `File`, and related types from here as well.

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,13 +18,23 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.88",
+      "version": "0.1.89",
       "license": "MIT"
     },
     {
       "name": "tiny-mcp-client",
       "version": "0.1.0",
       "license": "MIT"
+    },
+    {
+      "name": "tiny-stdio-mcp-server",
+      "version": "0.1.27",
+      "license": "MIT"
+    },
+    {
+      "name": "toolcraft-schema",
+      "version": "0.0.1",
+      "license": "MIT"
     }
   ]
 }

package/node_modules/tiny-http-mcp-server/dist/fetch-body.d.ts

@@ -0,0 +1,6 @@
+export declare class FetchBodyError extends Error {
+    readonly status: 400 | 413;
+    constructor(status: 400 | 413, message: string);
+}
+/** Bound bytes while reading, including bodies without Content-Length. */
+export declare function readFetchBody(request: Request, maxBytes: number): Promise<string>;

package/node_modules/tiny-http-mcp-server/dist/fetch-body.js

@@ -0,0 +1,47 @@
+export class FetchBodyError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Bound bytes while reading, including bodies without Content-Length. */
+export async function readFetchBody(request, maxBytes) {
+    const length = request.headers.get("content-length");
+    if (length !== null && Number(length) > maxBytes) {
+        await request.body?.cancel();
+        throw new FetchBodyError(413, "Payload too large");
+    }
+    if (request.body === null)
+        return "";
+    const reader = request.body.getReader();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const abort = () => { void reader.cancel().catch(() => undefined); };
+    request.signal.addEventListener("abort", abort, { once: true });
+    let bytes = 0;
+    let text = "";
+    try {
+        request.signal.throwIfAborted();
+        while (true) {
+            const chunk = await reader.read();
+            request.signal.throwIfAborted();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > maxBytes)
+                throw new FetchBodyError(413, "Payload too large");
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        return text + decoder.decode();
+    }
+    catch (error) {
+        await reader.cancel().catch(() => undefined);
+        if (error instanceof FetchBodyError || request.signal.aborted)
+            throw error;
+        throw new FetchBodyError(400, "Invalid request body");
+    }
+    finally {
+        request.signal.removeEventListener("abort", abort);
+        reader.releaseLock();
+    }
+}

package/node_modules/tiny-http-mcp-server/dist/fetch.d.ts

@@ -0,0 +1,23 @@
+import { type CallToolResult, type HandlerRequestContext, type InputRequiredResult, type ServerOptions, type ToolDefinition, type ToolReturn, type TypedSchema, type TypedOutputSchema } from "tiny-stdio-mcp-server/core";
+export { defineSchema, ToolError } from "tiny-stdio-mcp-server/core";
+export type { CallToolResult, TypedSchema, TypedOutputSchema } from "tiny-stdio-mcp-server/core";
+export interface FetchServerOptions extends ServerOptions {
+    /** Defaults to 1 MiB. Enforced while reading the stream. */
+    maxRequestBytes?: number;
+    /** Defaults to 1 MiB. */
+    maxResponseBytes?: number;
+    /** Browser origins allowed to call this endpoint; absent rejects all Origin headers. */
+    allowedOrigins?: readonly string[];
+}
+export interface FetchToolContext<TContext> extends HandlerRequestContext {
+    readonly request: Request;
+    readonly context: TContext;
+}
+export type FetchToolHandler<TIn, TContext, TOut = ToolReturn> = (input: TIn, context: FetchToolContext<TContext>) => TOut | CallToolResult | InputRequiredResult | Promise<TOut | CallToolResult | InputRequiredResult>;
+export interface FetchServer<TContext = undefined> {
+    tool<TIn, TOut = never>(name: string, description: string, schema: TypedSchema<TIn>, handler: FetchToolHandler<TIn, TContext, TOut>, outputSchema?: TypedOutputSchema<TOut>): FetchServer<TContext>;
+    registerTool<TIn, TOut = never>(definition: Omit<ToolDefinition<TIn, TOut>, "handler">, handler: FetchToolHandler<TIn, TContext, TOut>): FetchServer<TContext>;
+    fetch(request: Request, ...context: undefined extends TContext ? [context?: TContext] : [context: TContext]): Promise<Response>;
+}
+/** Stateless Streamable HTTP. Authentication must run in the host before fetch(). */
+export declare function createFetchServer<TContext = undefined>(options: FetchServerOptions): FetchServer<TContext>;

package/node_modules/tiny-http-mcp-server/dist/fetch.js

@@ -0,0 +1,130 @@
+import { createProtocolServer, ToolError } from "tiny-stdio-mcp-server/core";
+import { parseMessage } from "tiny-stdio-mcp-server/jsonrpc";
+import { MODERN_PROTOCOL_VERSION } from "tiny-stdio-mcp-server/protocol";
+import { FetchBodyError, readFetchBody } from "./fetch-body.js";
+import { validateModernHeaders } from "./modern-headers.js";
+export { defineSchema, ToolError } from "tiny-stdio-mcp-server/core";
+const versions = new Set(["2025-03-26", "2025-06-18", "2025-11-25", MODERN_PROTOCOL_VERSION]);
+const unsupportedMethods = new Set(["resources/subscribe", "resources/unsubscribe", "subscriptions/listen"]);
+function json(value, status = 200) {
+    return Response.json(value, { status, headers: { "cache-control": "no-store", "x-content-type-options": "nosniff" } });
+}
+function failure(code, message, status = 400, id = null) {
+    return json({ jsonrpc: "2.0", id, error: { code, message } }, status);
+}
+function validateRequest(request, options) {
+    const origin = request.headers.get("origin");
+    if (origin !== null && !options.allowedOrigins?.includes(origin))
+        return failure(-32600, "Origin not allowed", 403);
+    if (request.method !== "POST") {
+        const response = failure(-32600, "Method not allowed", 405);
+        response.headers.set("allow", "POST");
+        return response;
+    }
+    if (request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
+        return failure(-32600, "Content-Type must be application/json", 415);
+    const accepted = request.headers.get("accept")?.split(",").map(value => value.split(";")[0]?.trim().toLowerCase());
+    if (!accepted?.includes("application/json") || !accepted.includes("text/event-stream"))
+        return failure(-32600, "Accept must include application/json and text/event-stream", 406);
+    const version = request.headers.get("mcp-protocol-version");
+    if (version !== null && !versions.has(version))
+        return failure(-32600, "Unsupported protocol version");
+    if (request.headers.has("mcp-session-id"))
+        return failure(-32600, "This endpoint is stateless", 400);
+}
+/** Stateless Streamable HTTP. Authentication must run in the host before fetch(). */
+export function createFetchServer(options) {
+    const maxRequestBytes = options.maxRequestBytes ?? 1024 * 1024;
+    const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;
+    for (const bound of [maxRequestBytes, maxResponseBytes]) {
+        if (!Number.isSafeInteger(bound) || bound < 1)
+            throw new Error("Fetch byte limits must be positive safe integers");
+    }
+    const protocol = createProtocolServer({ ...options, supportNotifications: false, supportResourceSubscriptions: false });
+    function wrap(handler) {
+        return async (input, context) => {
+            const local = context.localContext;
+            try {
+                return await handler(input, { ...context, ...local });
+            }
+            catch {
+                // Tool-authored error results are public; thrown exceptions may contain credentials.
+                throw new ToolError(-32603, "Tool execution failed");
+            }
+        };
+    }
+    const server = {
+        tool(name, description, schema, handler, outputSchema) {
+            protocol.tool(name, description, schema, wrap(handler), outputSchema);
+            return server;
+        },
+        registerTool(definition, handler) {
+            protocol.registerTool(definition, wrap(handler));
+            return server;
+        },
+        async fetch(request, ...[context]) {
+            const invalid = validateRequest(request, options);
+            if (invalid !== undefined)
+                return invalid;
+            let raw;
+            try {
+                raw = await readFetchBody(request, maxRequestBytes);
+            }
+            catch (error) {
+                if (request.signal.aborted)
+                    throw error;
+                return failure(-32600, error instanceof FetchBodyError ? error.message : "Invalid request body", error instanceof FetchBodyError ? error.status : 400);
+            }
+            // MCP 2025-06-18 and later prohibit batches. Reject before any side effects.
+            const parsed = parseMessage(raw);
+            if (!parsed.success)
+                return failure(parsed.error.code, parsed.error.message, 400, parsed.id);
+            if (parsed.isNotification)
+                return new Response(null, { status: 202 });
+            const message = parsed.request;
+            if (!("id" in message))
+                return failure(-32600, "Invalid Request");
+            if (message.method.startsWith("notifications/"))
+                return failure(-32600, "Invalid Request", 400, message.id);
+            if (unsupportedMethods.has(message.method))
+                return failure(-32601, "Method not found", 200, message.id);
+            const headers = Object.fromEntries(request.headers);
+            const metadata = message.params?._meta;
+            const modern = request.headers.get("mcp-protocol-version") === MODERN_PROTOCOL_VERSION ||
+                metadata?.["io.modelcontextprotocol/protocolVersion"] === MODERN_PROTOCOL_VERSION;
+            if (modern) {
+                const error = validateModernHeaders(headers, message);
+                if (error !== undefined)
+                    return json({ jsonrpc: "2.0", id: message.id, error }, 400);
+            }
+            // Fresh lifecycle per request isolates duplicate IDs and cancellation across callers.
+            const session = protocol.createMessageSession();
+            try {
+                if (!modern && message.method !== "initialize") {
+                    await session.handleMessage("initialize", { protocolVersion: request.headers.get("mcp-protocol-version") ?? "2025-03-26" });
+                }
+                const handled = await session.handleMessage(message.method, message.params, {
+                    ...(message.id !== null ? { requestId: message.id } : {}),
+                    signal: request.signal,
+                    parameterHeaders: headers,
+                    localContext: { request, context }
+                });
+                request.signal.throwIfAborted();
+                const response = { jsonrpc: "2.0", id: message.id, ...handled };
+                const body = JSON.stringify(response);
+                if (new TextEncoder().encode(body).byteLength > maxResponseBytes)
+                    return failure(-32603, "Response exceeds byte limit", 200, message.id);
+                return json(response);
+            }
+            catch (error) {
+                if (request.signal.aborted)
+                    throw error;
+                return failure(-32603, "Internal error", 200, message.id);
+            }
+            finally {
+                session.close();
+            }
+        }
+    };
+    return server;
+}

package/node_modules/tiny-http-mcp-server/dist/modern-headers.js

@@ -1,4 +1,3 @@
-import { JSON_RPC_ERROR_CODES } from "tiny-stdio-mcp-server";
 import { decodeHeaderValue } from "tiny-stdio-mcp-server/headers";
 export function validateModernHeaders(headers, request) {
     const metadata = request.params?._meta;
@@ -7,7 +6,7 @@ export function validateModernHeaders(headers, request) {
         : undefined;
     if (typeof version !== "string")
         return {
-            code: JSON_RPC_ERROR_CODES.INVALID_PARAMS,
+            code: -32602,
             message: "Missing protocol version request metadata"
         };
     const expected = { "mcp-protocol-version": version };

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.88",
+  "version": "0.1.89",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",
@@ -24,6 +24,10 @@
     "./test-support": {
       "types": "./dist/test-support.d.ts",
       "import": "./dist/test-support.js"
+    },
+    "./fetch": {
+      "types": "./dist/fetch.d.ts",
+      "import": "./dist/fetch.js"
     }
   },
   "scripts": {

package/node_modules/tiny-stdio-mcp-server/README.md

@@ -245,3 +245,14 @@ per-tool schemas, and per-call content helper options such as `maxBytes` for rem
 ## License
 
 MIT
+
+## Protocol-only hosts
+
+Import `createProtocolServer` and `defineSchema` from
+`tiny-stdio-mcp-server/core` when your host supplies its own transport. This
+entry point loads no Node stdio modules. Use `createMessageSession()` for an
+isolated request lifecycle and close it when the transport completes. The
+`handleMessage` context accepts `localContext` for host-owned state; tool
+handlers receive it separately from client parameters and metadata. Use the
+ordinary root `createServer` export for `listen()` or `connect()`; the core
+entry point does not provide a stdio runtime.

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.409",
+      "version": "0.0.411",
       "license": "MIT"
     }
   ]

package/node_modules/tiny-stdio-mcp-server/dist/core.d.ts

@@ -0,0 +1,8 @@
+/** Protocol engine and typed tools without Node transport imports. */
+export { createProtocolServer } from "./protocol-server.js";
+export type { Server, MessageRequestContext, MessageSession } from "./protocol-server.js";
+export { defineSchema } from "./schema.js";
+export type { TypedSchema, TypedOutputSchema } from "./schema.js";
+export { ToolError } from "./types.js";
+export type { CallToolResult, HandlerRequestContext, InputRequiredResult, ServerOptions, ToolDefinition } from "./types.js";
+export type { ToolReturn } from "./content/convert.js";

package/node_modules/tiny-stdio-mcp-server/dist/core.js

@@ -0,0 +1,4 @@
+/** Protocol engine and typed tools without Node transport imports. */
+export { createProtocolServer } from "./protocol-server.js";
+export { defineSchema } from "./schema.js";
+export { ToolError } from "./types.js";

package/node_modules/tiny-stdio-mcp-server/dist/protocol-server.d.ts

@@ -0,0 +1,48 @@
+import type { ServerOptions, ToolDefinition, ToolHandler, HandleResult, Prompt, PromptHandler, Resource, ResourceHandler, ResourceTemplate, Transport, SDKTransport, JSONRPCNotification } from "./types.js";
+import type { TypedSchema, TypedOutputSchema } from "./schema.js";
+interface StdioRuntime {
+    readline: typeof import("node:readline");
+    StdioInput: typeof import("./stdio-input.js").StdioInput;
+    StdioOutput: typeof import("./stdio-output.js").StdioOutput;
+}
+export interface Server {
+    tool<TIn, TOut = never>(name: string, description: string, inputSchema: TypedSchema<TIn>, handler: ToolHandler<TIn, TOut>, outputSchema?: TypedOutputSchema<TOut>): Server;
+    registerTool<TIn, TOut = never>(definition: Omit<ToolDefinition<TIn, TOut>, "handler">, handler: ToolHandler<TIn, TOut>): Server;
+    prompt(definition: Prompt, handler: PromptHandler): Server;
+    resource(definition: Resource, handler: ResourceHandler): Server;
+    resourceTemplate(definition: ResourceTemplate, handler: ResourceHandler): Server;
+    method(name: string, handler: CustomMethodHandler): Server;
+    onNotification(listener: (notification: JSONRPCNotification) => void): () => void;
+    removeTool(name: string): boolean;
+    removePrompt(name: string): boolean;
+    removeResource(uri: string): boolean;
+    removeResourceTemplate(uriTemplate: string): boolean;
+    notifyToolsChanged(): Promise<void>;
+    notifyPromptsChanged(): Promise<void>;
+    notifyResourcesChanged(): Promise<void>;
+    notifyResourceUpdated(uri: string): Promise<void>;
+    createMessageSession(listener?: (notification: JSONRPCNotification) => void | Promise<void>): MessageSession;
+    handleMessage(method: string, params?: Record<string, unknown>, context?: MessageRequestContext): Promise<HandleResult>;
+    listen(): Promise<void>;
+    connect(transport: Transport): Promise<void>;
+    connectSDK(transport: SDKTransport): Promise<void>;
+}
+export interface MessageSessionContext {
+    readonly signal: AbortSignal;
+    notify(method: string, params?: Record<string, unknown>): Promise<void>;
+}
+export interface MessageRequestContext {
+    requestId?: string | number;
+    signal?: AbortSignal;
+    parameterHeaders?: Record<string, string | string[] | undefined>;
+    /** Host-only state, never read from JSON-RPC params or metadata. */
+    localContext?: unknown;
+}
+export type CustomMethodHandler = (params: Record<string, unknown> | undefined, session: MessageSessionContext) => unknown | Promise<unknown>;
+export type MessageHandler = (method: string, params?: Record<string, unknown>, context?: MessageRequestContext) => Promise<HandleResult>;
+export interface MessageSession {
+    handleMessage: MessageHandler;
+    close(): void;
+}
+export declare function createProtocolServer(options: ServerOptions, stdio?: StdioRuntime): Server;
+export {};