toolcraft 0.0.550 → 0.0.552

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.97",
+      "version": "0.1.98",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.550",
+      "version": "0.0.552",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.550",
+      "version": "0.0.552",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.97",
+      "version": "0.1.98",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.550",
+      "version": "0.0.552",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.550",
+      "version": "0.0.552",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.97",
+      "version": "0.1.98",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -226,13 +226,13 @@ original host receiver. The parser accepts
 `token_type`, `scope`, `expires_in` (seconds), `expires_at` (epoch seconds), and
 `expiresAt` (epoch milliseconds). Numeric absolute expiry wins over relative
 lifetime; the options timestamp wins over response timestamps. The optional
-`now` clock anchors a new import. JSON is bounded to 64 KiB/64 levels; malformed
+`now` clock anchors a new import. JSON has no implicit byte or depth ceiling; malformed
 credentials, scope, timing, accessors and non-JSON metadata are rejected without
 quoting the input. The parser makes no network or storage requests.
 For named native persistence, `createResourceBoundOAuthStores(authStore,
 namespace, identity).importSession(session, { signal, timeoutMs })` explicitly
 replaces the bound grant and original client in one locked document. It takes
-an owned, bounded session snapshot before waiting; validates resource/issuer
+an owned session snapshot before waiting; validates resource/issuer
 binding; marks full registrations as caller-owned; and retires previous clients.
 Its durable marker suppresses stale automatic environment imports after tokens
 are cleared. Like reset, explicit import can recover a corrupt old document
@@ -243,8 +243,8 @@ with `parseOAuthClientRegistration`). Dynamic clients infer their original ID
 and secret from that response and reuse it without registering another app.
 Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
-provider metadata. Registration input is copied, bounded to 64 KiB and 64
-levels, and rejects invalid standard field types and non-JSON extensions.
+provider metadata. Registration input is copied without an implicit byte or depth
+ceiling and rejects invalid standard field types and non-JSON extensions.
 An optional registration `issuer` must match discovery and the persisted
 authorization server exactly. Contradictory metadata fails without activating
 or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
-/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+/** Validate and copy a JSON DCR response without quoting credential input. */
 export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
 export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;
 /** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -2,7 +2,7 @@ import { copyBoundedOAuthJson } from "./bounded-json.js";
 import { loopbackTarget } from "./loopback-authorization.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
-/** Validate and copy a bounded JSON DCR response without quoting credential input. */
+/** Validate and copy a JSON DCR response without quoting credential input. */
 export function parseOAuthClientRegistration(value) {
     const invalid = () => new Error("Invalid OAuth client registration metadata");
     const result = copyBoundedOAuthJson(value, "Invalid OAuth client registration metadata");

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.97",
+  "version": "0.1.98",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.js

@@ -217,7 +217,7 @@ function isJsonValue(value, options = {}) {
   if (maxNodes !== Infinity && (!Number.isSafeInteger(maxNodes) || maxNodes < 1))
     throw new Error("maxNodes must be a positive safe integer");
   if (maxDepth !== Infinity && (!Number.isSafeInteger(maxDepth) || maxDepth < 0))
-    throw new Error("maxDepth must be a nonnegative safe integer");
+    throw new Error("maxDepth must be a nonnegative safe integer or Infinity");
   const ancestors = /* @__PURE__ */ new Set();
   const stack = [];
   function* properties(item2) {
@@ -258,7 +258,7 @@ function isJsonValue(value, options = {}) {
           }
           hookOwner = Object.getPrototypeOf(hookOwner);
         }
-        if (Array.isArray(item) && item.length > maxNodes)
+        if (Array.isArray(item) && item.length > maxNodes - nodes)
           return false;
         ancestors.add(item);
         stack.push({ owner: item, children: properties(item), depth });

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.550",
+      "version": "0.0.552",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/dist/json.js

@@ -11,7 +11,7 @@ export function isJsonValue(value, options = {}) {
     if (maxNodes !== Infinity && (!Number.isSafeInteger(maxNodes) || maxNodes < 1))
         throw new Error("maxNodes must be a positive safe integer");
     if (maxDepth !== Infinity && (!Number.isSafeInteger(maxDepth) || maxDepth < 0))
-        throw new Error("maxDepth must be a nonnegative safe integer");
+        throw new Error("maxDepth must be a nonnegative safe integer or Infinity");
     const ancestors = new Set();
     const stack = [];
     function* properties(item) {
@@ -55,7 +55,7 @@ export function isJsonValue(value, options = {}) {
                     }
                     hookOwner = Object.getPrototypeOf(hookOwner);
                 }
-                if (Array.isArray(item) && item.length > maxNodes)
+                if (Array.isArray(item) && item.length > maxNodes - nodes)
                     return false;
                 ancestors.add(item);
                 stack.push({ owner: item, children: properties(item), depth });

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.550",
+  "version": "0.0.552",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.550",
+  "version": "0.0.552",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -162,7 +162,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.550",
+    "toolcraft-schema": "0.0.552",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",