toolcraft 0.0.703 → 0.0.705

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.105",
+      "version": "0.1.106",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.703",
+      "version": "0.0.705",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.703",
+      "version": "0.0.705",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.105",
+      "version": "0.1.106",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.703",
+      "version": "0.0.705",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.703",
+      "version": "0.0.705",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.105",
+      "version": "0.1.106",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -149,7 +149,11 @@ observe the supplied signal and pass it to any work they start.
 `authorizeRequest` may return an owned token snapshot for the request it
 authorized. The HTTP client supplies that snapshot as `presentedTokens`, along
 with the actual request's `requestHeaders`, to `handleUnauthorized`. Providers
-that return `void` remain supported. The native provider compares the rejected
+that return `void` remain supported. HTTP transports supply lazy `discover()`
+instead of eagerly fetching metadata before the handler. A custom handler can
+return `{ action: "fail" }` without metadata access or replay; call `discover()`
+only when recovery needs validated metadata. Direct callers may still supply
+already validated `discovery`. The native provider compares the rejected
 snapshot with persisted credentials: delayed 401s retry with a newer grant
 without redeeming its refresh token again. A proven current token is refreshed
 on 401 even when the server omits `error="invalid_token"`. Invalid provenance

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -137,7 +137,10 @@ export function createDefaultOAuthClientProvider(options) {
                     ...(presented === undefined ? {} : { presentedTokens: presented }) };
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
-                const resource = canonicalizeResourceIndicator(input.discovery.resource);
+                const discovery = input.discovery ?? structuredClone(await waitForOAuthOperation(input.discover?.() ?? Promise.reject(new Error("OAuth recovery requires metadata discovery")), input.signal));
+                if (discovery === undefined)
+                    throw new Error("OAuth recovery requires metadata discovery");
+                const resource = canonicalizeResourceIndicator(discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
                 const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
                 const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
@@ -157,7 +160,7 @@ export function createDefaultOAuthClientProvider(options) {
                 }
                 const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
                 const session = await ensureAuthorizedSession(resource, {
-                    ...input.discovery,
+                    ...discovery,
                     resource
                 }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
                 if (session?.tokens?.accessToken === undefined) {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -46,7 +46,10 @@ export interface OAuthClientProvider {
         requestUrl: URL;
         response: Response;
         challenge: OAuthUnauthorizedChallenge | null;
-        discovery: OAuthDiscoveryResult;
+        /** Validated metadata supplied by direct callers, if already available. */
+        discovery?: OAuthDiscoveryResult;
+        /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
         /** Headers actually attached to this rejected request. */

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.105",
+  "version": "0.1.106",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -103,7 +103,7 @@ the same optional `closeReason` promise when closing requires asynchronous work.
 
 ## OAuth HTTP support
 
-`HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.
+`HttpTransport` accepts `oauth` options from `mcp-oauth`. On HTTP 401, the transport calls the OAuth provider before fetching metadata. Custom providers can reject the presented token and return `{ action: "fail" }` without discovery or request replay. The handler receives a memoized `discover()` callback for validated protected-resource and authorization-server metadata when recovery needs it. The built-in provider invokes this callback and requests a retry when credentials are available.
 
 ```ts
 import { HttpTransport } from "tiny-mcp-client";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -149,7 +149,10 @@ interface OAuthClientProvider {
         requestUrl: URL;
         response: Response;
         challenge: OAuthUnauthorizedChallenge | null;
-        discovery: OAuthDiscoveryResult;
+        /** Validated metadata supplied by direct callers, if already available. */
+        discovery?: OAuthDiscoveryResult;
+        /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
         /** Headers actually attached to this rejected request. */

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5527,7 +5527,10 @@ function createDefaultOAuthClientProvider(options) {
         };
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
-        const resource = canonicalizeResourceIndicator(input.discovery.resource);
+        const discovery = input.discovery ?? structuredClone(await waitForOAuthOperation(input.discover?.() ?? Promise.reject(new Error("OAuth recovery requires metadata discovery")), input.signal));
+        if (discovery === void 0)
+          throw new Error("OAuth recovery requires metadata discovery");
+        const resource = canonicalizeResourceIndicator(discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
         const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
@@ -5547,7 +5550,7 @@ function createDefaultOAuthClientProvider(options) {
         }
         const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
-          ...input.discovery,
+          ...discovery,
           resource
         }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
         if (session?.tokens?.accessToken === void 0) {
@@ -8315,7 +8318,8 @@ var HttpTransport = class {
     try {
       const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
       const resourceMetadataUrl = challenge?.params.resource_metadata;
-      const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
+      let discovery;
+      const discover = () => discovery ??= discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
       const providerResponse = response.clone();
       let result;
       try {
@@ -8323,7 +8327,7 @@ var HttpTransport = class {
           requestUrl: new URL(this.url),
           response: providerResponse,
           challenge,
-          discovery,
+          discover,
           signal,
           requestHeaders: new Headers(requestHeaders),
           presentedTokens,

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.703",
+      "version": "0.0.705",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.703",
+  "version": "0.0.705",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.703",
+  "version": "0.0.705",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -162,7 +162,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.703",
+    "toolcraft-schema": "0.0.705",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",