toolcraft 0.0.744 → 0.0.746

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.113",
+      "version": "0.1.115",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.744",
+      "version": "0.0.746",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.744",
+      "version": "0.0.746",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.113",
+      "version": "0.1.115",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.744",
+      "version": "0.0.746",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.744",
+      "version": "0.0.746",
       "license": "MIT"
     },
     {

package/node_modules/auth-store/dist/transaction-lock.js

@@ -4,8 +4,8 @@ import { hasOwnErrorCode } from "./error-codes.js";
 /** Filesystem bakery lock: unique claims allow dead-owner cleanup without deleting a replacement owner's lock. */
 export async function withSecretStoreFileLock(fs, lockDirectory, operation, options = {}) {
     options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
-    const timeoutMs = options.timeoutMs ?? 30_000;
-    if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647)
+    const timeoutMs = options.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2_147_483_647))
         throw new Error("Invalid secret-store transaction lock timeout");
     options.signal?.throwIfAborted();
     const deadline = performance.now() + timeoutMs;

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.113",
+      "version": "0.1.115",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -47,7 +47,7 @@ alone do not establish either native error type.
 in both Node and Worker exports, and through `@poe-platform/safe-bash/mcp`.
 They use Web Crypto and host storage, with no filesystem, listener, browser opener
 or pending callback promise. Supply a statically registered client and trusted
-discovery. See [the public MCP example](../safe-bash-mcp/README.md#resumable-https-oauth)
+discovery. See [the public MCP example](../safe-bash-command-mcp/README.md#resumable-https-oauth)
 for callback routing and the required atomic storage contract.
 
 ## Configuration

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,5 +1,5 @@
 import { copyBoundedOAuthJson } from "./bounded-json.js";
-import { loopbackTarget, validateHostedOAuthRedirect } from "./loopback-authorization.js";
+import { loopbackTarget, validateHostedOAuthRedirect } from "./redirect-target.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a JSON DCR response without quoting credential input. */

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -1,5 +1,6 @@
 import http from "node:http";
 export { OAuthAuthorizationError } from "./authorization-error.js";
+export { loopbackTarget, validateAuthorizationRedirect, validateHostedOAuthRedirect } from "./redirect-target.js";
 export interface OAuthLandingPage {
     title: string;
     body: string;
@@ -19,7 +20,7 @@ export interface LoopbackAuthorizationOptions {
     /** Exact registered HTTP loopback redirect, including its fixed port and query. */
     redirectUri?: string;
     signal?: AbortSignal;
-    /** Bounds listener setup and authorization; defaults to two minutes. */
+    /** Bounds listener setup and authorization; defaults to unlimited. */
     timeoutMs?: number;
 }
 export interface LoopbackAuthorizationSession {
@@ -31,13 +32,5 @@ export interface LoopbackAuthorizationSession {
 export declare function snapshotLoopbackAuthorizationOptions(options: LoopbackAuthorizationOptions): LoopbackAuthorizationOptions;
 /** Authorization callback denial, retaining the provider diagnostic for host observers. */
 export declare function createLoopbackAuthorizationSession(options?: LoopbackAuthorizationOptions): Promise<LoopbackAuthorizationSession>;
-export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
-    port: number;
-    host: string;
-    callbackPath: string;
-};
-/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
-export declare function validateAuthorizationRedirect(options: LoopbackAuthorizationOptions): void;
-export declare function validateHostedOAuthRedirect(redirectUri: string, callbackPath?: string): void;
 export declare function extractCodeFromInput(input: string): string | null;
 export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -2,7 +2,8 @@ import http from "node:http";
 import { parseAuthorizationState } from "./authorization-state.js";
 import { OAuthAuthorizationError } from "./authorization-error.js";
 export { OAuthAuthorizationError } from "./authorization-error.js";
-const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+import { oauthCallbackParameters, loopbackTarget, validateAuthorizationRedirect } from "./redirect-target.js";
+export { loopbackTarget, validateAuthorizationRedirect, validateHostedOAuthRedirect } from "./redirect-target.js";
 /** Capture declared configuration regardless of property enumerability. */
 export function snapshotLoopbackAuthorizationOptions(options) {
     return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), waitForCallback: options.waitForCallback?.bind(options), createServer: options.createServer?.bind(options),
@@ -13,8 +14,8 @@ export function snapshotLoopbackAuthorizationOptions(options) {
 export async function createLoopbackAuthorizationSession(options = {}) {
     options = snapshotLoopbackAuthorizationOptions(options);
     options.signal?.throwIfAborted();
-    const timeoutMs = options.timeoutMs ?? 120_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+    const timeoutMs = options.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
         throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
     if (options.waitForCallback !== undefined)
         return createHostedAuthorizationSession(options, timeoutMs);
@@ -33,8 +34,8 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         server.closeAllConnections?.();
         server.close();
     };
-    const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-    timer.unref?.();
+    const timer = timeoutMs === Infinity ? undefined : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer?.unref?.();
     controller.signal.addEventListener("abort", teardown, { once: true });
     options.signal?.addEventListener("abort", callerAbort, { once: true });
     if (options.signal?.aborted)
@@ -67,54 +68,13 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         }
     };
 }
-export function loopbackTarget(options) {
-    if (options.redirectUri !== undefined) {
-        let url;
-        try {
-            url = new URL(options.redirectUri);
-        }
-        catch (cause) {
-            throw new Error("Invalid OAuth loopback redirect URI", { cause });
-        }
-        if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
-            || url.username || url.password || url.href.includes("#") || url.port === "0"
-            || oauthCallbackParameters.some(name => url.searchParams.has(name))
-            || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
-            || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))
-            throw new Error("Invalid OAuth loopback redirect URI");
-        return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
-    }
-    const callbackPath = options.callbackPath ?? "/callback";
-    const parsed = new URL(callbackPath, "http://127.0.0.1");
-    if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
-        throw new Error("Invalid OAuth loopback callback path");
-    return { port: 0, host: "127.0.0.1", callbackPath };
-}
-/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
-export function validateAuthorizationRedirect(options) {
-    if (options.waitForCallback === undefined) {
-        loopbackTarget(options);
-        return;
-    }
-    if (typeof options.waitForCallback !== "function" || options.redirectUri === undefined)
-        throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
-    validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
-}
-export function validateHostedOAuthRedirect(redirectUri, callbackPath) {
-    const url = new URL(redirectUri);
-    if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0"
-        || oauthCallbackParameters.some(name => url.searchParams.has(name))
-        || [...redirectUri].some(char => char.codePointAt(0) <= 32)
-        || (callbackPath !== undefined && callbackPath !== url.pathname))
-        throw new Error("Invalid hosted OAuth redirect URI");
-}
 function createHostedAuthorizationSession(options, timeoutMs) {
     validateAuthorizationRedirect(options);
     const redirectUri = options.redirectUri, controller = new AbortController();
     let used = false;
     const aborted = () => controller.abort(options.signal?.reason);
-    const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-    timer.unref?.();
+    const timer = timeoutMs === Infinity ? undefined : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer?.unref?.();
     const cleanup = () => { clearTimeout(timer); options.signal?.removeEventListener("abort", aborted); };
     controller.signal.addEventListener("abort", cleanup, { once: true });
     options.signal?.addEventListener("abort", aborted, { once: true });

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/redirect-target.d.ts

@@ -0,0 +1,10 @@
+import type { LoopbackAuthorizationOptions } from "./loopback-authorization.js";
+export declare const oauthCallbackParameters: string[];
+export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
+    port: number;
+    host: string;
+    callbackPath: string;
+};
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export declare function validateAuthorizationRedirect(options: LoopbackAuthorizationOptions): void;
+export declare function validateHostedOAuthRedirect(redirectUri: string, callbackPath?: string): void;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/redirect-target.js

@@ -0,0 +1,42 @@
+export const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+export function loopbackTarget(options) {
+    if (options.redirectUri !== undefined) {
+        let url;
+        try {
+            url = new URL(options.redirectUri);
+        }
+        catch (cause) {
+            throw new Error("Invalid OAuth loopback redirect URI", { cause });
+        }
+        if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
+            || url.username || url.password || url.href.includes("#") || url.port === "0"
+            || oauthCallbackParameters.some(name => url.searchParams.has(name))
+            || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
+            || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))
+            throw new Error("Invalid OAuth loopback redirect URI");
+        return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
+    }
+    const callbackPath = options.callbackPath ?? "/callback";
+    const parsed = new URL(callbackPath, "http://127.0.0.1");
+    if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
+        throw new Error("Invalid OAuth loopback callback path");
+    return { port: 0, host: "127.0.0.1", callbackPath };
+}
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export function validateAuthorizationRedirect(options) {
+    if (options.waitForCallback === undefined) {
+        loopbackTarget(options);
+        return;
+    }
+    if (typeof options.waitForCallback !== "function" || options.redirectUri === undefined)
+        throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
+    validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
+}
+export function validateHostedOAuthRedirect(redirectUri, callbackPath) {
+    const url = new URL(redirectUri);
+    if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0"
+        || oauthCallbackParameters.some(name => url.searchParams.has(name))
+        || [...redirectUri].some(char => char.codePointAt(0) <= 32)
+        || (callbackPath !== undefined && callbackPath !== url.pathname))
+        throw new Error("Invalid hosted OAuth redirect URI");
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -54,8 +54,8 @@ export function createResourceBoundOAuthStores(options, namespace, identity) {
     async function replace(record, options) {
         options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
         options.signal?.throwIfAborted();
-        const timeoutMs = options.timeoutMs ?? 30_000;
-        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+        const timeoutMs = options.timeoutMs ?? Infinity;
+        if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
             throw new Error("OAuth replacement timeoutMs must be a positive supported timer interval");
         if (store.withLock === undefined)
             throw new Error("OAuth resource identity backend must support transaction locks");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -2,8 +2,8 @@ import { waitForOAuthOperation } from "./cancellable-operation.js";
 const queues = new WeakMap();
 /** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
 export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
-    const timeoutMs = options.timeoutMs ?? 30_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+    const timeoutMs = options.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
         throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
     options.signal?.throwIfAborted();
     const started = performance.now();
@@ -21,7 +21,8 @@ export async function withOAuthSessionTransaction(store, resource, operation, op
         const waiting = new Promise((resolve, reject) => { rejectWait = reject; previous.then(resolve, reject); });
         const abort = () => rejectWait(options.signal?.reason);
         try {
-            timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+            if (timeoutMs !== Infinity)
+                timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
             options.signal?.addEventListener("abort", abort, { once: true });
             if (options.signal?.aborted)
                 abort();

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.d.ts

@@ -12,3 +12,9 @@ export declare function createDefaultOAuthClientProvider(): never;
 export declare function createAuthStoreSessionStore(): never;
 export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
 export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
+export { parseOAuthTokenGrant } from "./client/token-grant.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
+/** Native persistence needs a desktop host; portable callers provide atomic hooks. */
+export declare function createResourceBoundOAuthStores(): never;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.js

@@ -17,3 +17,11 @@ export function createAuthStoreSessionStore() {
     throw new Error("Desktop OAuth persistence is unavailable in Worker MCP");
 }
 export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export { normalizeOAuthScope } from "./client/scope.js";
+export { waitForOAuthOperation } from "./client/cancellable-operation.js";
+export { parseOAuthTokenGrant } from "./client/token-grant.js";
+export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
+/** Native persistence needs a desktop host; portable callers provide atomic hooks. */
+export function createResourceBoundOAuthStores() {
+    throw new Error("Desktop OAuth persistence is unavailable in Worker MCP; provide host-owned import/reset hooks");
+}

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.113",
+  "version": "0.1.115",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/dist/index.browser.js

@@ -57,8 +57,63 @@ function assertHttpJsonBudget(text) {
   if (stack.length !== 0) throw new SyntaxError("Unterminated MCP HTTP JSON container");
 }
 
-// src/internal.ts
-import { PassThrough } from "node:stream";
+// src/stream.browser.ts
+var PassThrough = class {
+  destroyed = false;
+  writableEnded = false;
+  chunks = [];
+  wake;
+  failure;
+  listeners = /* @__PURE__ */ new Map();
+  once(event, listener) {
+    const listeners = this.listeners.get(event) ?? /* @__PURE__ */ new Set();
+    listeners.add(listener);
+    this.listeners.set(event, listeners);
+    return this;
+  }
+  write(value) {
+    if (this.destroyed || this.writableEnded) throw this.failure ?? new Error("HTTP message channel is closed");
+    this.chunks.push(typeof value === "string" ? new TextEncoder().encode(value) : value.slice());
+    this.wake?.();
+    return true;
+  }
+  end() {
+    this.writableEnded = true;
+    this.wake?.();
+    return this;
+  }
+  destroy(error) {
+    if (this.destroyed) return this;
+    this.destroyed = true;
+    this.failure = error;
+    this.chunks.length = 0;
+    this.wake?.();
+    const errors = this.listeners.get("error"), close = this.listeners.get("close");
+    this.listeners.clear();
+    if (error !== void 0) for (const listener of errors ?? []) listener(error);
+    for (const listener of close ?? []) listener();
+    return this;
+  }
+  async *[Symbol.asyncIterator]() {
+    try {
+      for (; ; ) {
+        if (this.failure !== void 0) throw this.failure;
+        const chunk = this.chunks.shift();
+        if (chunk !== void 0) {
+          yield chunk;
+          continue;
+        }
+        if (this.writableEnded || this.destroyed) return;
+        await new Promise((resolve) => {
+          this.wake = resolve;
+        });
+        this.wake = void 0;
+      }
+    } finally {
+      this.destroy();
+    }
+  }
+};
 
 // src/http-message-validation.ts
 var subscriptionMethods = /* @__PURE__ */ new Set([
@@ -1255,7 +1310,11 @@ var JSON_RPC_ERROR_CODES = Object.freeze({
 function isBase64(value) {
   if (value.length % 4 !== 0)
     return false;
-  return Buffer.from(value, "base64").toString("base64") === value;
+  try {
+    return btoa(atob(value)) === value;
+  } catch {
+    return false;
+  }
 }
 
 // ../tiny-stdio-mcp-server/dist/uri.js
@@ -3549,15 +3608,15 @@ function createOAuthClientProvider(options) {
 
 // ../tiny-stdio-mcp-server/dist/headers.js
 function encodeHeaderValue(value) {
-  const bytes = Buffer.from(value, "utf8");
-  if (bytes.toString("utf8") !== value)
+  const bytes = new TextEncoder().encode(value);
+  if (new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes) !== value)
     throw new Error("MCP header value must contain valid Unicode");
   const sentinel = value.startsWith("=?base64?") && value.endsWith("?=");
   const unsafe = value.trim() !== value || [...value].some((character) => {
     const code = character.charCodeAt(0);
     return code !== 9 && (code < 32 || code > 126);
   });
-  return sentinel || unsafe ? `=?base64?${bytes.toString("base64")}?=` : value;
+  return sentinel || unsafe ? `=?base64?${btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(""))}?=` : value;
 }
 var schemaMaps = /* @__PURE__ */ new Set([
   "properties",
@@ -3993,6 +4052,10 @@ var OAuthMetadataDiscovery = class {
     );
   }
 };
+async function discoverOAuthMetadata(resourceUrl, options = {}) {
+  const discovery = new OAuthMetadataDiscovery(options);
+  return discovery.discover(resourceUrl, options);
+}
 function skipOptionalWhitespace(value, start) {
   let index = start;
   while (index < value.length && (value[index] === " " || value[index] === "	")) {
@@ -5187,7 +5250,7 @@ var HttpTransport = class {
     if (this.legacyProtocolVersion !== void 0) headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     if (this.lastEventId !== void 0) {
       if (this.lastEventId === "") headers.delete("Last-Event-ID");
-      else headers.set("Last-Event-ID", Buffer.from(this.lastEventId, "utf8").toString("latin1"));
+      else headers.set("Last-Event-ID", Array.from(new TextEncoder().encode(this.lastEventId), (byte) => String.fromCharCode(byte)).join(""));
     }
     return this.authorizeRequestHeaders(headers, signal);
   }
@@ -5616,7 +5679,7 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
   let bytes = 0;
   const decoder = new TextDecoder("utf-8", { fatal: true });
   const append = (part) => {
-    bytes += Buffer.byteLength(part, "utf8");
+    bytes += new TextEncoder().encode(part).byteLength;
     if (bytes > maxLineBytes) throw new Error(`Stdio input line byte limit exceeded (${maxLineBytes} bytes)`);
     if (part.length > 0) parts.push(part);
   };
@@ -5677,7 +5740,7 @@ var SseParser = class {
         else if (index === this.buffer.length - 1) this.skipLf = true;
       }
       start = index + 1;
-      if (Buffer.byteLength(line, "utf8") > this.maxEventBytes)
+      if (new TextEncoder().encode(line).byteLength > this.maxEventBytes)
         throw new Error(`SSE event exceeds ${this.maxEventBytes} bytes`);
       this.consumeLine(line, messages);
       this.assertEventSize("");
@@ -5709,7 +5772,7 @@ var SseParser = class {
       return;
     }
     if (field === "data") {
-      this.dataBytes += Buffer.byteLength(value, "utf8") + (this.dataLines.length > 0 ? 1 : 0);
+      this.dataBytes += new TextEncoder().encode(value).byteLength + (this.dataLines.length > 0 ? 1 : 0);
       this.dataLines.push(value);
       return;
     }
@@ -5748,7 +5811,7 @@ var SseParser = class {
     this.dataBytes = 0;
   }
   assertEventSize(partialLine) {
-    if (this.dataBytes + Buffer.byteLength(this.eventType ?? "", "utf8") + Buffer.byteLength(this.eventId, "utf8") + Buffer.byteLength(partialLine, "utf8") > this.maxEventBytes)
+    if (this.dataBytes + new TextEncoder().encode(this.eventType ?? "").byteLength + new TextEncoder().encode(this.eventId).byteLength + new TextEncoder().encode(partialLine).byteLength > this.maxEventBytes)
       throw new Error(`SSE event exceeds ${this.maxEventBytes} bytes`);
   }
 };
@@ -6466,6 +6529,7 @@ export {
   McpError,
   OAuthMetadataDiscovery,
   OAuthMetadataError,
+  discoverOAuthMetadata,
   snapshotHttpTransportHeaders
 };
 /*!