toolcraft 0.0.749 → 0.0.750

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resumable.js

@@ -17,10 +17,14 @@ function timestamp(now) {
         throw new Error();
     return value;
 }
-/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
-export async function beginRemoteMcpAuthorization(options) {
+/** Prepare consent for a host that owns a durable issuance journal.
+ * The transaction contains secrets: persist privately before exposing the URL.
+ * The host must consume state once, validate callback issuer/redirect/expiry,
+ * and fence token persistence against reset or superseding grants.
+ */
+export async function prepareRemoteMcpAuthorization(options) {
     try {
-        const { store, signal, discover } = options;
+        const { signal, discover } = options;
         const now = options.now?.bind(options) ?? Date.now;
         const resource = httpsUrl(options.resource).href;
         const redirect = httpsUrl(options.redirectUri);
@@ -32,8 +36,6 @@ export async function beginRemoteMcpAuthorization(options) {
         const method = normalizeOAuthTokenEndpointAuthMethod(client.tokenEndpointAuthMethod) ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
         if (client.clientSecret !== undefined && (typeof client.clientSecret !== "string" || !client.clientSecret.trim()))
             throw new Error();
-        if (method !== "none" && client.clientSecret === undefined)
-            throw new Error();
         if (client.registration !== undefined && (client.registration.client_id !== client.clientId ||
             (client.registration.client_secret != null && client.registration.client_secret !== client.clientSecret) ||
             (client.registration.token_endpoint_auth_method != null && client.registration.token_endpoint_auth_method !== method)))
@@ -43,6 +45,9 @@ export async function beginRemoteMcpAuthorization(options) {
             throw new Error();
         if (client.registration?.redirect_uris != null && !client.registration.redirect_uris.includes(redirect.href))
             throw new Error();
+        const statePrefix = options.statePrefix ?? "";
+        if (typeof statePrefix !== "string" || statePrefix.length > 32 || [...statePrefix].some(c => !(c >= "a" && c <= "z") && !(c >= "A" && c <= "Z") && !(c >= "0" && c <= "9") && c !== "_" && c !== "-"))
+            throw new Error();
         const scope = normalizeOAuthScope(options.scope);
         const ttl = options.ttlMs ?? 600_000;
         if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > 600_000)
@@ -58,7 +63,7 @@ export async function beginRemoteMcpAuthorization(options) {
         httpsUrl(server.issuer);
         httpsUrl(server.token_endpoint);
         const authorization = httpsUrl(server.authorization_endpoint);
-        const state = base64url(crypto.getRandomValues(new Uint8Array(32)));
+        const state = statePrefix + base64url(crypto.getRandomValues(new Uint8Array(32)));
         const codeVerifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
         const challenge = base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier))));
         const expiresAt = timestamp(now) + ttl;
@@ -73,10 +78,25 @@ export async function beginRemoteMcpAuthorization(options) {
         if (scope !== undefined)
             authorization.searchParams.set("scope", scope);
         signal?.throwIfAborted();
-        await store.create({ state, expiresAt, redirectUri: redirect.href, codeVerifier,
-            requireIssuer: server.authorization_response_iss_parameter_supported === true, session });
+        return { authorizationUrl: authorization.href, transaction: { state, expiresAt, redirectUri: redirect.href, codeVerifier,
+                requireIssuer: server.authorization_response_iss_parameter_supported === true, session } };
+    }
+    catch {
+        throw new Error("Unable to prepare MCP authorization");
+    }
+}
+/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
+export async function beginRemoteMcpAuthorization(options) {
+    try {
+        const { store, signal } = options;
+        const method = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+        if (method !== undefined && method !== "none" && options.client.clientSecret === undefined)
+            throw new Error();
+        const { authorizationUrl, transaction } = await prepareRemoteMcpAuthorization(options);
+        signal?.throwIfAborted();
+        await store.create(transaction);
         signal?.throwIfAborted();
-        return { authorizationUrl: authorization.href, expiresAt };
+        return { authorizationUrl, expiresAt: transaction.expiresAt };
     }
     catch {
         throw new Error("Unable to begin MCP authorization");

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/revoke-token.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthMetadataFetch, OAuthTokenEndpointAuthMethod } from "./types.js";
+/** RFC 7009 revocation; no retries or host persistence changes. */
+export declare function revokeOAuthToken(input: {
+    revocationEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    token: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+    fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
+}): Promise<void>;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/revoke-token.js

@@ -0,0 +1,23 @@
+import { fetchMcpResponse } from "../http-fetch.js";
+import { readBoundedResponseText } from "../http-response.js";
+import { createOAuthFormRequest } from "./oauth-form.js";
+import { readOAuthJsonObjectResponse } from "./token-endpoint.js";
+/** RFC 7009 revocation; no retries or host persistence changes. */
+export async function revokeOAuthToken(input) {
+    if (typeof input.token !== "string" || input.token.trim() === "")
+        throw new Error("OAuth revocation requires a token");
+    const { body, headers } = createOAuthFormRequest({
+        ...input,
+        params: { token: input.token, ...(input.tokenTypeHint === undefined ? {} : { token_type_hint: input.tokenTypeHint }) }
+    });
+    input.signal?.throwIfAborted();
+    const deadline = AbortSignal.timeout(30_000);
+    const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
+    const response = await fetchMcpResponse(input.fetch, input.revocationEndpoint, {
+        method: "POST", headers, body: body.toString(), signal
+    });
+    if (!response.ok)
+        await readOAuthJsonObjectResponse(response, signal);
+    // RFC 7009 intentionally permits an empty body, including for an invalid token.
+    await readBoundedResponseText(response, 1024 * 1024, undefined, signal);
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,4 +1,4 @@
-import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+import { createOAuthFormRequest } from "./oauth-form.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -64,38 +64,25 @@ export async function exchangeAuthorizationCode(input) {
 }
 export async function refreshAccessToken(input) {
     const resource = canonicalizeResourceIndicator(input.resource);
-    return requestTokens({
+    const refreshToken = input.refreshToken;
+    const tokens = await requestTokens({
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
         tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
-            refresh_token: input.refreshToken,
+            refresh_token: refreshToken,
             resource
         },
         fetch: input.fetch,
         signal: input.signal,
         now: input.now
     });
+    return { ...tokens, refreshToken: tokens.refreshToken ?? refreshToken };
 }
 async function requestTokens(input) {
-    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
-        (input.clientSecret === undefined ? "none" : "client_secret_post");
-    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
-        throw new Error("OAuth token endpoint authentication requires a client secret");
-    const body = new URLSearchParams(input.params);
-    const headers = new Headers({ Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" });
-    if (method === "client_secret_basic") {
-        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
-        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
-        headers.set("Authorization", `Basic ${btoa(`${encoded}:${encodedSecret}`)}`);
-    }
-    else {
-        body.set("client_id", input.clientId);
-        if (method === "client_secret_post")
-            body.set("client_secret", input.clientSecret);
-    }
+    const { body, headers } = createOAuthFormRequest(input);
     input.signal?.throwIfAborted();
     const deadline = AbortSignal.timeout(30_000);
     const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-fetch.js

@@ -34,7 +34,7 @@ export async function fetchMcpResponse(fetchImplementation, input, init = {}) {
                     abort();
                 return;
             }
-            if (response.redirected || response.type === "opaqueredirect") {
+            if (response.redirected || response.type === "opaqueredirect" || (response.status >= 300 && response.status < 400)) {
                 void response.body?.cancel().catch(() => undefined);
                 finish(new Error("MCP HTTP redirects are not allowed"));
             }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.d.ts

@@ -10,11 +10,15 @@ import type { OAuthClientProvider, OAuthClientProviderOptions } from "./client/t
 export declare function createOAuthClientProvider(options: OAuthClientProviderOptions): OAuthClientProvider;
 export declare function createDefaultOAuthClientProvider(): never;
 export declare function createAuthStoreSessionStore(): never;
-export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
-export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, PrepareRemoteMcpAuthorizationOptions, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
 export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./client/client-registration.js";
 /** Native persistence needs a desktop host; portable callers provide atomic hooks. */
 export declare function createResourceBoundOAuthStores(): never;
+export { generateCodeChallenge, generateCodeVerifier } from "./client/pkce.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient, type RegisterOAuthClientOptions } from "./client/register-client.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.browser.js

@@ -16,7 +16,7 @@ export function createDefaultOAuthClientProvider() {
 export function createAuthStoreSessionStore() {
     throw new Error("Desktop OAuth persistence is unavailable in Worker MCP");
 }
-export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
 export { normalizeOAuthScope } from "./client/scope.js";
 export { waitForOAuthOperation } from "./client/cancellable-operation.js";
 export { parseOAuthTokenGrant } from "./client/token-grant.js";
@@ -25,3 +25,7 @@ export { parseOAuthClientRegistration, normalizeStoredOAuthClient } from "./clie
 export function createResourceBoundOAuthStores() {
     throw new Error("Desktop OAuth persistence is unavailable in Worker MCP; provide host-owned import/reset hooks");
 }
+export { generateCodeChallenge, generateCodeVerifier } from "./client/pkce.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient } from "./client/register-client.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.d.ts

@@ -18,5 +18,8 @@ export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessTok
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";
 export { fetchMcpResponse } from "./http-fetch.js";
-export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
-export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export type { RemoteMcpAuthorizationTransaction, RemoteMcpAuthorizationStore, PrepareRemoteMcpAuthorizationOptions, BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions } from "./client/resumable.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient, type RegisterOAuthClientOptions } from "./client/register-client.js";

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/index.js

@@ -13,4 +13,7 @@ export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
 export { readBoundedResponseText } from "./http-response.js";
 export { fetchMcpResponse } from "./http-fetch.js";
-export { beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export { prepareRemoteMcpAuthorization, beginRemoteMcpAuthorization, completeRemoteMcpAuthorization } from "./client/resumable.js";
+export { exchangeAuthorizationCode, refreshAccessToken } from "./client/token-endpoint.js";
+export { revokeOAuthToken } from "./client/revoke-token.js";
+export { registerOAuthClient } from "./client/register-client.js";

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.115",
+  "version": "0.1.124",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",
@@ -32,10 +32,10 @@
   },
   "scripts": {
     "build": "node ../../scripts/guard-package-dist.mjs && tsc",
-    "prepack": "node ../../scripts/set-bin-executable.mjs && node ../../scripts/manage-bundled-workspace-deps.mjs prepare-local . mcp-oauth auth-store tiny-mcp-client jose",
-    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup-after-pack . mcp-oauth auth-store tiny-mcp-client jose",
+    "prepack": "node ../../scripts/set-bin-executable.mjs && node ../../scripts/manage-bundled-workspace-deps.mjs prepare-local . mcp-oauth auth-store tiny-mcp-client jose @poe-code/safe-fs @poe-code/xml-ast @noble/hashes",
+    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup-after-pack . mcp-oauth auth-store tiny-mcp-client jose @poe-code/safe-fs @poe-code/xml-ast @noble/hashes",
     "prepublishOnly": "tsc",
-    "postpublish": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . mcp-oauth auth-store tiny-mcp-client jose",
+    "postpublish": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . mcp-oauth auth-store tiny-mcp-client jose @poe-code/safe-fs @poe-code/xml-ast @noble/hashes",
     "test:unit": "cd ../.. && vitest run packages/tiny-http-mcp-server/src"
   },
   "files": [

package/node_modules/tiny-mcp-client/README.md

@@ -53,6 +53,8 @@ timer; a timeout releases request capacity so later operations can proceed.
 
 ## Transports
 
+The `workerd` and `browser` exports provide HTTP transport without Node built-ins or polyfills. Supply authenticated `fetch` or a host-owned OAuth provider. `StdioTransport` can use an explicitly supplied `spawn` adapter on portable hosts; its default process launcher remains Node-only.
+
 | Transport                       | Description                                                                                                 |
 | ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
 | `StdioTransport`                | Spawns an MCP server process and communicates over stdio.                                                   |

package/node_modules/tiny-mcp-client/dist/index.browser.d.ts

@@ -1,8 +1,8 @@
-import { SpawnOptions, ChildProcessWithoutNullStreams } from 'node:child_process';
 import { Readable, Writable } from 'node:stream';
 import http from 'node:http';
 import { ContentItem as ContentItem$1, ResourceContents as ResourceContents$1, Implementation, Tool as Tool$1, Resource, ResourceTemplate, Prompt, Server } from 'tiny-stdio-mcp-server';
 export { ContentAnnotations, Icon, Implementation, Prompt, PromptArgument, Resource, ResourceLink, ResourceTemplate, ToolAnnotations, ToolExecution } from 'tiny-stdio-mcp-server';
+import { SpawnOptions, ChildProcessWithoutNullStreams } from 'node:child_process';
 
 interface NotificationFilter {
     toolsListChanged?: boolean;
@@ -701,14 +701,6 @@ interface SdkTestPair<TClient extends McpClientConnection> {
 }
 declare function createSdkTestPair<TClient extends McpClientConnection>(server: SdkServerConnection, createClient: () => TClient): Promise<SdkTestPair<TClient>>;
 declare function createTestPair<TClient extends McpClientConnection>(server: Server, createClient: () => TClient): Promise<SdkTestPair<TClient>>;
-type StdioSpawn = (command: string, args: ReadonlyArray<string>, options: SpawnOptions) => ChildProcessWithoutNullStreams;
-interface StdioTransportOptions {
-    command: string;
-    args?: string[];
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-    spawn?: StdioSpawn;
-}
 type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 declare class HttpTransportError extends Error {
     readonly status: number;
@@ -728,19 +720,6 @@ interface HttpTransportOptions {
     /** Maximum JSON response bytes or individual SSE event bytes; not a stream lifetime cap. */
     maxResponseBytes?: number;
 }
-declare class StdioTransport implements McpTransport {
-    readonly readable: Readable;
-    readonly writable: Writable;
-    readonly closed: Promise<McpTransportClosedEvent>;
-    private readonly child;
-    private disposed;
-    private stderrOutput;
-    private static readonly STDERR_MAX_LENGTH;
-    constructor({ command, args, cwd, env, spawn: spawnProcess, }: StdioTransportOptions);
-    getStderrOutput(): string;
-    private appendStderrOutput;
-    dispose(reason?: Error): void;
-}
 /** Own and validate static HTTP headers without reflecting malformed values. */
 declare function snapshotHttpTransportHeaders(headers?: RequestInit["headers"]): Headers;
 declare class HttpTransport implements McpTransport {
@@ -890,5 +869,28 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
+type StdioSpawn = (command: string, args: ReadonlyArray<string>, options: SpawnOptions) => ChildProcessWithoutNullStreams;
+interface StdioTransportOptions {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    spawn?: StdioSpawn;
+}
+declare function defaultStdioSpawn(command: string, args: ReadonlyArray<string>, options: SpawnOptions): ChildProcessWithoutNullStreams;
+declare class StdioTransport implements McpTransport {
+    readonly readable: Readable;
+    readonly writable: Writable;
+    readonly closed: Promise<McpTransportClosedEvent>;
+    private readonly child;
+    private disposed;
+    private stderrOutput;
+    private static readonly STDERR_MAX_LENGTH;
+    constructor({ command, args, cwd, env, spawn: spawnProcess, }: StdioTransportOptions);
+    getStderrOutput(): string;
+    private appendStderrOutput;
+    dispose(reason?: Error): void;
+}
+
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, defaultStdioSpawn, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpProtocolVersion, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };

package/node_modules/tiny-mcp-client/dist/index.browser.js

@@ -291,6 +291,9 @@ function dialectFor(schema, inherited) {
   return inherited;
 }
 function resolveUri(reference, baseUri) {
+  if (typeof URL === "undefined" && (reference === "" || reference.startsWith("#"))) {
+    return `${withoutFragment(baseUri)}${reference}`;
+  }
   try {
     return new URL(reference, baseUri).href;
   } catch {
@@ -3552,7 +3555,7 @@ async function fetchMcpResponse(fetchImplementation, input, init = {}) {
           abort();
         return;
       }
-      if (response.redirected || response.type === "opaqueredirect") {
+      if (response.redirected || response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
         void response.body?.cancel().catch(() => void 0);
         finish(new Error("MCP HTTP redirects are not allowed"));
       } else
@@ -6521,6 +6524,115 @@ function parseJsonRpcPayload(parsed) {
     }
   };
 }
+
+// src/spawn.browser.ts
+var spawn = () => {
+  throw new TypeError("This host requires an explicit MCP process adapter; use HTTP or supply spawn.");
+};
+
+// src/stdio-transport.ts
+function defaultStdioSpawn(command, args, options) {
+  return spawn(command, args, options);
+}
+var StdioTransport = class _StdioTransport {
+  readable;
+  writable;
+  closed;
+  child;
+  disposed = false;
+  stderrOutput = "";
+  static STDERR_MAX_LENGTH = 65536;
+  constructor({
+    command,
+    args = [],
+    cwd,
+    env,
+    spawn: spawnProcess = defaultStdioSpawn
+  }) {
+    this.child = spawnProcess(command, args, {
+      cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const child = this.child;
+    this.readable = child.stdout;
+    this.writable = child.stdin;
+    const stderrDecoder = new TextDecoder();
+    child.stderr.on("data", (chunk) => {
+      const decoded = chunk instanceof Uint8Array ? stderrDecoder.decode(chunk, { stream: true }) : `${stderrDecoder.decode()}${String(chunk)}`;
+      this.appendStderrOutput(decoded);
+    });
+    child.stderr.once("end", () => {
+      this.appendStderrOutput(stderrDecoder.decode());
+    });
+    this.closed = new Promise((resolve) => {
+      let settled = false;
+      let streamError;
+      const resolveClosed = (event) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve(event);
+      };
+      for (const stream of [child.stdin, child.stdout, child.stderr]) {
+        stream.once("error", (reason) => {
+          streamError ??= reason;
+          this.dispose(reason);
+        });
+      }
+      child.once("exit", (code, signal) => {
+        const closedEvent = {
+          reason: streamError ?? new Error("Stdio transport process exited")
+        };
+        if (code !== null) {
+          closedEvent.code = code;
+        }
+        if (signal !== null) {
+          closedEvent.signal = signal;
+        }
+        resolveClosed(closedEvent);
+      });
+      child.once("error", (error) => {
+        const closedEvent = {
+          reason: error instanceof Error ? error : new Error(String(error))
+        };
+        if (child.exitCode !== null) {
+          closedEvent.code = child.exitCode;
+        }
+        if (child.signalCode !== null) {
+          closedEvent.signal = child.signalCode;
+        }
+        resolveClosed(closedEvent);
+      });
+    });
+  }
+  getStderrOutput() {
+    return this.stderrOutput;
+  }
+  appendStderrOutput(chunk) {
+    if (chunk.length === 0) {
+      return;
+    }
+    this.stderrOutput += chunk;
+    if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
+      this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
+    }
+  }
+  dispose(reason = new Error("Stdio transport disposed")) {
+    void reason;
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    if (!this.child.stdin.destroyed && !this.child.stdin.writableEnded) {
+      this.child.stdin.end();
+    }
+    if (this.child.exitCode === null && this.child.signalCode === null && !this.child.killed) {
+      this.child.kill("SIGTERM");
+    }
+  }
+};
 export {
   HttpTransport,
   HttpTransportError,
@@ -6529,7 +6641,10 @@ export {
   McpError,
   OAuthMetadataDiscovery,
   OAuthMetadataError,
+  StdioTransport,
+  defaultStdioSpawn,
   discoverOAuthMetadata,
+  fetchMcpResponse,
   snapshotHttpTransportHeaders
 };
 /*!

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { SpawnOptions, ChildProcessWithoutNullStreams } from 'node:child_process';
 import { Readable, Writable } from 'node:stream';
 import http from 'node:http';
 import { ContentItem as ContentItem$1, ResourceContents as ResourceContents$1, Implementation, Tool as Tool$1, Resource, ResourceTemplate, Prompt, Server } from 'tiny-stdio-mcp-server';
 export { ContentAnnotations, Icon, Implementation, Prompt, PromptArgument, Resource, ResourceLink, ResourceTemplate, ToolAnnotations, ToolExecution } from 'tiny-stdio-mcp-server';
+import { SpawnOptions, ChildProcessWithoutNullStreams } from 'node:child_process';
 
 interface NotificationFilter {
     toolsListChanged?: boolean;
@@ -701,14 +701,6 @@ interface SdkTestPair<TClient extends McpClientConnection> {
 }
 declare function createSdkTestPair<TClient extends McpClientConnection>(server: SdkServerConnection, createClient: () => TClient): Promise<SdkTestPair<TClient>>;
 declare function createTestPair<TClient extends McpClientConnection>(server: Server, createClient: () => TClient): Promise<SdkTestPair<TClient>>;
-type StdioSpawn = (command: string, args: ReadonlyArray<string>, options: SpawnOptions) => ChildProcessWithoutNullStreams;
-interface StdioTransportOptions {
-    command: string;
-    args?: string[];
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-    spawn?: StdioSpawn;
-}
 type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 declare class HttpTransportError extends Error {
     readonly status: number;
@@ -728,19 +720,6 @@ interface HttpTransportOptions {
     /** Maximum JSON response bytes or individual SSE event bytes; not a stream lifetime cap. */
     maxResponseBytes?: number;
 }
-declare class StdioTransport implements McpTransport {
-    readonly readable: Readable;
-    readonly writable: Writable;
-    readonly closed: Promise<McpTransportClosedEvent>;
-    private readonly child;
-    private disposed;
-    private stderrOutput;
-    private static readonly STDERR_MAX_LENGTH;
-    constructor({ command, args, cwd, env, spawn: spawnProcess, }: StdioTransportOptions);
-    getStderrOutput(): string;
-    private appendStderrOutput;
-    dispose(reason?: Error): void;
-}
 /** Own and validate static HTTP headers without reflecting malformed values. */
 declare function snapshotHttpTransportHeaders(headers?: RequestInit["headers"]): Headers;
 declare class HttpTransport implements McpTransport {
@@ -890,5 +869,28 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
+type StdioSpawn = (command: string, args: ReadonlyArray<string>, options: SpawnOptions) => ChildProcessWithoutNullStreams;
+interface StdioTransportOptions {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    spawn?: StdioSpawn;
+}
+declare function defaultStdioSpawn(command: string, args: ReadonlyArray<string>, options: SpawnOptions): ChildProcessWithoutNullStreams;
+declare class StdioTransport implements McpTransport {
+    readonly readable: Readable;
+    readonly writable: Writable;
+    readonly closed: Promise<McpTransportClosedEvent>;
+    private readonly child;
+    private disposed;
+    private stderrOutput;
+    private static readonly STDERR_MAX_LENGTH;
+    constructor({ command, args, cwd, env, spawn: spawnProcess, }: StdioTransportOptions);
+    getStderrOutput(): string;
+    private appendStderrOutput;
+    dispose(reason?: Error): void;
+}
+
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, OAuthMetadataError, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, defaultStdioSpawn, discoverOAuthMetadata, fetchMcpResponse, snapshotHttpTransportHeaders };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpProtocolVersion, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };