toolcraft 0.0.731 → 0.0.733

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.109",
+      "version": "0.1.111",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.731",
+      "version": "0.0.733",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.731",
+      "version": "0.0.733",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.109",
+      "version": "0.1.111",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.731",
+      "version": "0.0.733",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.731",
+      "version": "0.0.733",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.109",
+      "version": "0.1.111",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -57,7 +57,8 @@ alone do not establish either native error type.
 - `browser.readLine()` optional
 - `browser.createServer()` optional
 - `browser.landingPage` optional
-- `browser.redirectUri` optional exact registered HTTP loopback callback with a fixed port
+- `browser.redirectUri` exact registered HTTP loopback callback with a fixed port, or HTTPS callback when `waitForCallback` is supplied
+- `browser.waitForCallback({ authorizationUrl, redirectUri, signal })` lets a web host receive its HTTPS callback. Return the complete callback URL; the client checks its redirect, fixed query, state and issuer before exchanging the PKCE code. The host owns navigation and callback routing; no local listener starts. Observe `signal` to release canceled or timed-out host work.
 - `browser.signal` optional cancellation signal
 - `browser.timeoutMs` optional authorization deadline (default 120,000 ms)
 - `sessionStore` optional
@@ -342,3 +343,10 @@ HTTP 403) are nonretryable `invalid_response` errors; authorization fails withou
 waiting for consent that never started. Raw server errors remain transient.
 `outcomeKnown: false` still withholds an uncertain rotating refresh family: a
 nonretryable HTTP status alone does not prove a refresh token was unconsumed.
+
+A host can use `browser: { redirectUri: "https://poe.com/oauth/mcp/callback", waitForCallback }`
+with its registered OAuth app. The authorization server must allow that exact URL;
+a desktop-only Google app still needs a web-client registration. Existing loopback
+callbacks keep their local-listener behavior. Token responses with `scope: ""`
+(such as Notion MCP) preserve an explicit empty grant, including on refresh and
+reload; they never inherit a configured nonempty requested scope.

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -186,7 +186,7 @@ function isStoredOAuthTokensOrMissing(value) {
         return false;
     }
     const scope = getOwnEntry(value, "scope");
-    return scope === undefined || (typeof scope === "string" && scope.trim().length > 0);
+    return scope === undefined || scope === "" || (typeof scope === "string" && scope.trim().length > 0);
 }
 function isNonBlankOwnString(record, key) {
     const value = getOwnString(record, key);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,5 +1,5 @@
 import { copyBoundedOAuthJson } from "./bounded-json.js";
-import { loopbackTarget } from "./loopback-authorization.js";
+import { loopbackTarget, validateHostedOAuthRedirect } from "./loopback-authorization.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a JSON DCR response without quoting credential input. */
@@ -51,7 +51,10 @@ export function normalizeStoredOAuthClient(value) {
         try {
             if (typeof requestedRedirectUri !== "string")
                 throw new Error("Invalid redirect identity");
-            loopbackTarget({ redirectUri: requestedRedirectUri });
+            if (new URL(requestedRedirectUri).protocol === "https:")
+                validateHostedOAuthRedirect(requestedRedirectUri);
+            else
+                loopbackTarget({ redirectUri: requestedRedirectUri });
         }
         catch {
             throw new Error("Invalid stored OAuth registration redirect identity");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -7,7 +7,7 @@ import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore, assertPersistenceNamespace } from "./auth-store-session-store.js";
-import { createLoopbackAuthorizationSession, loopbackTarget, snapshotLoopbackAuthorizationOptions } from "./loopback-authorization.js";
+import { createLoopbackAuthorizationSession, validateAuthorizationRedirect, snapshotLoopbackAuthorizationOptions } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
@@ -27,7 +27,7 @@ export function createDefaultOAuthClientProvider(options) {
     const clientMode = options.client.mode;
     const interactiveEnabled = options.allowInteractive !== false;
     const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
-    loopbackTarget(browser);
+    validateAuthorizationRedirect(browser);
     assertPersistenceNamespace(options.persistenceNamespace);
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
@@ -647,7 +647,7 @@ function normalizeStoredTokens(value) {
     const scope = getOwnEntry(value, "scope");
     const normalizedAccessToken = accessToken?.trim();
     const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
-    const normalizedScope = normalizeOAuthScope(scope);
+    const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
     if (accessToken === undefined ||
         normalizedAccessToken === undefined ||
         normalizedAccessToken.length === 0 ||
@@ -668,7 +668,7 @@ function normalizeStoredTokens(value) {
         tokenType,
         expiresAt,
         ...(normalizedRefreshToken === undefined ? {} : { refreshToken: normalizedRefreshToken }),
-        ...(normalizedScope === undefined || normalizedScope.length === 0
+        ...(normalizedScope === undefined
             ? {}
             : { scope: normalizedScope })
     };

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -7,6 +7,12 @@ export interface OAuthLandingPage {
 export interface LoopbackAuthorizationOptions {
     openBrowser?: (url: string) => Promise<void>;
     readLine?: () => Promise<string>;
+    /** Host receives the full callback URL; this mode never opens a local listener. */
+    waitForCallback?: (request: {
+        authorizationUrl: string;
+        redirectUri: string;
+        signal: AbortSignal;
+    }) => Promise<string>;
     createServer?: () => http.Server;
     landingPage?: OAuthLandingPage;
     callbackPath?: string;
@@ -30,5 +36,8 @@ export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
     host: string;
     callbackPath: string;
 };
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export declare function validateAuthorizationRedirect(options: LoopbackAuthorizationOptions): void;
+export declare function validateHostedOAuthRedirect(redirectUri: string, callbackPath?: string): void;
 export declare function extractCodeFromInput(input: string): string | null;
 export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -5,7 +5,7 @@ export { OAuthAuthorizationError } from "./authorization-error.js";
 const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
 /** Capture declared configuration regardless of property enumerability. */
 export function snapshotLoopbackAuthorizationOptions(options) {
-    return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), createServer: options.createServer?.bind(options),
+    return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), waitForCallback: options.waitForCallback?.bind(options), createServer: options.createServer?.bind(options),
         callbackPath: options.callbackPath, redirectUri: options.redirectUri, signal: options.signal, timeoutMs: options.timeoutMs,
         landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body } };
 }
@@ -16,6 +16,8 @@ export async function createLoopbackAuthorizationSession(options = {}) {
     const timeoutMs = options.timeoutMs ?? 120_000;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
         throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+    if (options.waitForCallback !== undefined)
+        return createHostedAuthorizationSession(options, timeoutMs);
     const target = loopbackTarget(options);
     const server = options.createServer ? options.createServer() : http.createServer();
     const controller = new AbortController();
@@ -88,6 +90,80 @@ export function loopbackTarget(options) {
         throw new Error("Invalid OAuth loopback callback path");
     return { port: 0, host: "127.0.0.1", callbackPath };
 }
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export function validateAuthorizationRedirect(options) {
+    if (options.waitForCallback === undefined) {
+        loopbackTarget(options);
+        return;
+    }
+    if (typeof options.waitForCallback !== "function" || options.redirectUri === undefined)
+        throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
+    validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
+}
+export function validateHostedOAuthRedirect(redirectUri, callbackPath) {
+    const url = new URL(redirectUri);
+    if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0"
+        || oauthCallbackParameters.some(name => url.searchParams.has(name))
+        || [...redirectUri].some(char => char.codePointAt(0) <= 32)
+        || (callbackPath !== undefined && callbackPath !== url.pathname))
+        throw new Error("Invalid hosted OAuth redirect URI");
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+    validateAuthorizationRedirect(options);
+    const redirectUri = options.redirectUri, controller = new AbortController();
+    let used = false;
+    const aborted = () => controller.abort(options.signal?.reason);
+    const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer.unref?.();
+    const cleanup = () => { clearTimeout(timer); options.signal?.removeEventListener("abort", aborted); };
+    controller.signal.addEventListener("abort", cleanup, { once: true });
+    options.signal?.addEventListener("abort", aborted, { once: true });
+    if (options.signal?.aborted)
+        aborted();
+    return {
+        redirectUri,
+        async waitForCode(authorizationUrl) {
+            controller.signal.throwIfAborted();
+            if (used)
+                throw new Error("OAuth authorization session has already been used");
+            used = true;
+            try {
+                const authorization = new URL(authorizationUrl);
+                if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+                    throw new Error("OAuth authorization redirect mismatch");
+                const callback = await new Promise((resolve, reject) => {
+                    const onAbort = () => reject(controller.signal.reason);
+                    controller.signal.addEventListener("abort", onAbort, { once: true });
+                    void Promise.resolve().then(() => {
+                        controller.signal.throwIfAborted();
+                        return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+                    }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+                });
+                controller.signal.throwIfAborted();
+                const url = new URL(callback), base = new URL(redirectUri);
+                if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#")
+                    || [...callback].some(char => char.codePointAt(0) <= 32))
+                    throw new Error("OAuth callback redirect mismatch");
+                const params = readAuthorizationCallbackParameters(url);
+                for (const name of oauthCallbackParameters)
+                    url.searchParams.delete(name);
+                if (url.searchParams.toString() !== base.searchParams.toString())
+                    throw new Error("OAuth callback redirect mismatch");
+                const expected = readExpectedAuthorizationCallback(authorizationUrl);
+                if (expected.state === null)
+                    throw new Error("OAuth authorization missing state");
+                validateAuthorizationCallbackBinding(params, expected);
+                if (params.error !== null)
+                    throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
+                return validateAuthorizationCallbackParameters(params, expected);
+            }
+            finally {
+                controller.abort(new Error("OAuth authorization session closed"));
+            }
+        },
+        close() { controller.abort(new Error("OAuth authorization session closed")); }
+    };
+}
 async function startServer(server, port, host, signal) {
     signal.throwIfAborted();
     return new Promise((resolve, reject) => {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -147,7 +147,7 @@ async function requestTokens(input) {
     const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
         ? refreshToken.trim()
         : undefined;
-    const normalizedScope = normalizeOAuthScope(scope);
+    const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
     if (scope !== undefined && normalizedScope === undefined)
         throw new Error("Invalid OAuth scope syntax in token response");
     return {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -170,6 +170,12 @@ export interface DefaultOAuthClientProviderOptions {
     };
     browser: {
         openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
         /** Exact registered HTTP loopback redirect URI. */
         redirectUri?: string;
         signal?: AbortSignal;

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.109",
+  "version": "0.1.111",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.browser.d.ts

@@ -273,6 +273,12 @@ interface DefaultOAuthClientProviderOptions {
     };
     browser: {
         openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
         /** Exact registered HTTP loopback redirect URI. */
         redirectUri?: string;
         signal?: AbortSignal;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -273,6 +273,12 @@ interface DefaultOAuthClientProviderOptions {
     };
     browser: {
         openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
         /** Exact registered HTTP loopback redirect URI. */
         redirectUri?: string;
         signal?: AbortSignal;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3637,6 +3637,7 @@ function snapshotLoopbackAuthorizationOptions(options) {
     ...options,
     openBrowser: options.openBrowser?.bind(options),
     readLine: options.readLine?.bind(options),
+    waitForCallback: options.waitForCallback?.bind(options),
     createServer: options.createServer?.bind(options),
     callbackPath: options.callbackPath,
     redirectUri: options.redirectUri,
@@ -3651,6 +3652,8 @@ async function createLoopbackAuthorizationSession(options = {}) {
   const timeoutMs = options.timeoutMs ?? 12e4;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
     throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  if (options.waitForCallback !== void 0)
+    return createHostedAuthorizationSession(options, timeoutMs);
   const target = loopbackTarget(options);
   const server = options.createServer ? options.createServer() : http.createServer();
   const controller = new AbortController();
@@ -3716,6 +3719,79 @@ function loopbackTarget(options) {
     throw new Error("Invalid OAuth loopback callback path");
   return { port: 0, host: "127.0.0.1", callbackPath };
 }
+function validateAuthorizationRedirect(options) {
+  if (options.waitForCallback === void 0) {
+    loopbackTarget(options);
+    return;
+  }
+  if (typeof options.waitForCallback !== "function" || options.redirectUri === void 0)
+    throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
+  validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
+}
+function validateHostedOAuthRedirect(redirectUri, callbackPath) {
+  const url = new URL(redirectUri);
+  if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...redirectUri].some((char) => char.codePointAt(0) <= 32) || callbackPath !== void 0 && callbackPath !== url.pathname)
+    throw new Error("Invalid hosted OAuth redirect URI");
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+  validateAuthorizationRedirect(options);
+  const redirectUri = options.redirectUri, controller = new AbortController();
+  let used = false;
+  const aborted = () => controller.abort(options.signal?.reason);
+  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer.unref?.();
+  const cleanup = () => {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", aborted);
+  };
+  controller.signal.addEventListener("abort", cleanup, { once: true });
+  options.signal?.addEventListener("abort", aborted, { once: true });
+  if (options.signal?.aborted)
+    aborted();
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used)
+        throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        const authorization = new URL(authorizationUrl);
+        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+          throw new Error("OAuth authorization redirect mismatch");
+        const callback = await new Promise((resolve, reject) => {
+          const onAbort = () => reject(controller.signal.reason);
+          controller.signal.addEventListener("abort", onAbort, { once: true });
+          void Promise.resolve().then(() => {
+            controller.signal.throwIfAborted();
+            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+        });
+        controller.signal.throwIfAborted();
+        const url = new URL(callback), base = new URL(redirectUri);
+        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32))
+          throw new Error("OAuth callback redirect mismatch");
+        const params = readAuthorizationCallbackParameters(url);
+        for (const name of oauthCallbackParameters)
+          url.searchParams.delete(name);
+        if (url.searchParams.toString() !== base.searchParams.toString())
+          throw new Error("OAuth callback redirect mismatch");
+        const expected = readExpectedAuthorizationCallback(authorizationUrl);
+        if (expected.state === null)
+          throw new Error("OAuth authorization missing state");
+        validateAuthorizationCallbackBinding(params, expected);
+        if (params.error !== null)
+          throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
+        return validateAuthorizationCallbackParameters(params, expected);
+      } finally {
+        controller.abort(new Error("OAuth authorization session closed"));
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
 async function startServer(server, port, host, signal) {
   signal.throwIfAborted();
   return new Promise((resolve, reject) => {
@@ -3975,7 +4051,10 @@ function normalizeStoredOAuthClient(value) {
     try {
       if (typeof requestedRedirectUri !== "string")
         throw new Error("Invalid redirect identity");
-      loopbackTarget({ redirectUri: requestedRedirectUri });
+      if (new URL(requestedRedirectUri).protocol === "https:")
+        validateHostedOAuthRedirect(requestedRedirectUri);
+      else
+        loopbackTarget({ redirectUri: requestedRedirectUri });
     } catch {
       throw new Error("Invalid stored OAuth registration redirect identity");
     }
@@ -4871,7 +4950,7 @@ function isStoredOAuthTokensOrMissing(value) {
     return false;
   }
   const scope = getOwnEntry4(value, "scope");
-  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
+  return scope === void 0 || scope === "" || typeof scope === "string" && scope.trim().length > 0;
 }
 function isNonBlankOwnString(record2, key2) {
   const value = getOwnString(record2, key2);
@@ -5292,7 +5371,7 @@ async function requestTokens(input) {
     throw new Error("OAuth token response has invalid refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = normalizeOAuthScope(scope);
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
   if (scope !== void 0 && normalizedScope === void 0)
     throw new Error("Invalid OAuth scope syntax in token response");
   return {
@@ -5425,7 +5504,7 @@ function createDefaultOAuthClientProvider(options) {
   const clientMode = options.client.mode;
   const interactiveEnabled = options.allowInteractive !== false;
   const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
-  loopbackTarget(browser);
+  validateAuthorizationRedirect(browser);
   assertPersistenceNamespace(options.persistenceNamespace);
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
@@ -6022,7 +6101,7 @@ function normalizeStoredTokens(value) {
   const scope = getOwnEntry6(value, "scope");
   const normalizedAccessToken = accessToken?.trim();
   const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
-  const normalizedScope = normalizeOAuthScope(scope);
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
   if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
@@ -6031,7 +6110,7 @@ function normalizeStoredTokens(value) {
     tokenType,
     expiresAt,
     ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
-    ...normalizedScope === void 0 || normalizedScope.length === 0 ? {} : { scope: normalizedScope }
+    ...normalizedScope === void 0 ? {} : { scope: normalizedScope }
   };
 }
 function getClientMetadata(client) {

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.731",
+      "version": "0.0.733",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.731",
+  "version": "0.0.733",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.731",
+  "version": "0.0.733",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -162,7 +162,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.731",
+    "toolcraft-schema": "0.0.733",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",