toolcraft 0.0.91 → 0.0.93

package/node_modules/tiny-mcp-client/package.json

@@ -1,13 +1,11 @@
 {
-  "name": "tiny-mcp-client",
-  "version": "0.1.0",
-  "license": "MIT",
   "private": true,
+  "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "scripts": {
-    "build": "node ../../scripts/guard-package-dist.mjs && tsc"
+    "build": "node scripts/build.mjs"
   },
   "repository": {
     "type": "git",
@@ -16,6 +14,12 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "mcp-oauth": "*",
     "tiny-stdio-mcp-server": "*"
+  },
+  "poeCode": {
+    "inlinedDependencies": [
+      "mcp-oauth"
+    ]
   }
 }

package/node_modules/tiny-mcp-client/scripts/build.mjs

@@ -0,0 +1,63 @@
+import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { cp, mkdir, mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+import { rollup } from "rollup";
+import { dts } from "rollup-plugin-dts";
+import { assertSafeOutputDirectory } from "../../../scripts/guard-package-dist.mjs";
+
+const require = createRequire(import.meta.url);
+const packageDir = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const packagesDir = path.dirname(packageDir);
+const distDir = path.join(packageDir, "dist");
+const temporaryDir = await mkdtemp(path.join(os.tmpdir(), "tiny-mcp-client-build-"));
+
+const declarationAliases = new Map([
+  ["mcp-oauth", path.join(packagesDir, "mcp-oauth", "dist", "index.d.ts")],
+  ["auth-store", path.join(packagesDir, "auth-store", "dist", "index.d.ts")]
+]);
+
+const inlineWorkspaceDeclarations = {
+  name: "inline-workspace-declarations",
+  resolveId(source) {
+    return declarationAliases.get(source) ?? null;
+  }
+};
+
+try {
+  await assertSafeOutputDirectory(packageDir, distDir);
+  await rm(distDir, { recursive: true, force: true });
+  execFileSync(
+    process.execPath,
+    [require.resolve("typescript/bin/tsc"), "--emitDeclarationOnly"],
+    { cwd: packageDir, stdio: "inherit" }
+  );
+
+  const declarationBundle = await rollup({
+    input: path.join(distDir, "index.d.ts"),
+    external: (source) => source.startsWith("node:"),
+    plugins: [inlineWorkspaceDeclarations, dts()]
+  });
+  await declarationBundle.write({
+    file: path.join(temporaryDir, "index.d.ts"),
+    format: "es"
+  });
+  await declarationBundle.close();
+
+  await rm(distDir, { recursive: true, force: true });
+  await mkdir(distDir, { recursive: true });
+  await build({
+    entryPoints: [path.join(packageDir, "src", "index.ts")],
+    outfile: path.join(distDir, "index.js"),
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node18"
+  });
+  await cp(path.join(temporaryDir, "index.d.ts"), path.join(distDir, "index.d.ts"));
+} finally {
+  await rm(temporaryDir, { recursive: true, force: true });
+}

package/node_modules/toolcraft-design/package.json

@@ -1,8 +1,6 @@
 {
-  "name": "toolcraft-design",
-  "version": "0.0.2",
-  "license": "MIT",
   "private": true,
+  "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,7 +16,8 @@
     "generate:design-docs:all": "tsx scripts/generate-docs.ts all"
   },
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "dependencies": {
     "fast-string-width": "^3.0.2",
@@ -46,8 +45,5 @@
     "type": "git",
     "url": "git+https://github.com/poe-platform/poe-code.git",
     "directory": "packages/toolcraft-design"
-  },
-  "publishConfig": {
-    "access": "public"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.91",
+  "version": "0.0.93",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -14,6 +14,10 @@
       "types": "./dist/cli.d.ts",
       "import": "./dist/cli.js"
     },
+    "./composition": {
+      "types": "./dist/composition.d.ts",
+      "import": "./dist/composition.js"
+    },
     "./design": {
       "types": "./dist/design.d.ts",
       "import": "./dist/design.js"
@@ -48,15 +52,15 @@
     }
   },
   "scripts": {
-    "build": "rm -rf dist && tsc",
+    "build": "rm -rf dist && tsc && cp src/composition.json dist/composition.json",
     "test": "cd ../.. && vitest run packages/toolcraft/src",
     "test:unit": "cd ../.. && vitest run packages/toolcraft/src",
     "lint": "cd ../.. && eslint packages/toolcraft/src --ext ts && tsc -p packages/toolcraft/tsconfig.json --noEmit",
-    "prepack": "node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client mcp-oauth auth-store",
-    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client mcp-oauth auth-store"
+    "prepack": "node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client auth-store",
+    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-design @poe-code/frontmatter @poe-code/agent-mcp-config @poe-code/agent-human-in-loop @poe-code/task-list @poe-code/agent-defs @poe-code/config-mutations @poe-code/process-runner tiny-mcp-client auth-store"
   },
   "dependencies": {
-    "toolcraft-schema": "0.0.91",
+    "toolcraft-schema": "0.0.93",
     "commander": "^13.1.0",
     "fast-string-width": "^3.0.2",
     "fast-wrap-ansi": "^0.2.0",
@@ -70,8 +74,10 @@
   },
   "files": [
     "LICENSE",
+    "composition.json",
     "dist"
   ],
+  "toolcraftComposition": "./composition.json",
   "engines": {
     "node": ">=18.18"
   },
@@ -90,7 +96,6 @@
     "@poe-code/config-mutations",
     "@poe-code/process-runner",
     "tiny-mcp-client",
-    "mcp-oauth",
     "auth-store"
   ],
   "optionalDependencies": {
@@ -103,7 +108,6 @@
     "@poe-code/config-mutations": "*",
     "@poe-code/process-runner": "*",
     "tiny-mcp-client": "*",
-    "mcp-oauth": "*",
     "auth-store": "*"
   }
 }

package/node_modules/mcp-oauth/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Poe Platform
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/mcp-oauth/README.md

@@ -1,31 +0,0 @@
-# mcp-oauth
-
-OAuth client primitives for MCP HTTP transports.
-
-## Config
-
-`createDefaultOAuthClientProvider(options)` accepts:
-
-- `client`
-  - `mode: "dynamic"` with optional `metadata`
-  - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
-- `browser.openBrowser(url)`
-- `browser.readLine()` optional
-- `browser.createServer()` optional
-- `browser.landingPage` optional
-- `sessionStore` optional
-- `authStore` optional `auth-store` backend config for the default session store
-- `now()` optional clock override
-
-`createJwksTokenVerifier(options)` accepts:
-
-- `jwksUrl`
-- `clockSkewSeconds` optional, defaults to `30`
-- `allowedAlgorithms` optional asymmetric allow-list
-- `fetch` optional override
-
-`createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
-
-## Environment Variables
-
-None directly. When `authStore` is used, `auth-store` honors its own backend env var configuration.

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,14 +0,0 @@
-import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore } from "./types.js";
-interface StoredOAuthClient {
-    clientId: string;
-    clientSecret?: string;
-}
-export interface OAuthClientStore {
-    load(issuer: string): Promise<StoredOAuthClient | null>;
-    save(issuer: string, client: StoredOAuthClient): Promise<void>;
-    clear(issuer: string): Promise<void>;
-}
-export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput): OAuthSessionStore;
-export declare function createAuthStoreClientStore(options: CreateSecretStoreInput): OAuthClientStore;
-export {};

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -1,169 +0,0 @@
-import crypto from "node:crypto";
-import path from "node:path";
-import { createSecretStore } from "auth-store";
-import { canonicalizeResourceIndicator } from "../resource-indicator.js";
-const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
-const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
-const DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
-const DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
-const DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
-const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
-const MAX_JS_DATE_MS = 8_640_000_000_000_000;
-export function createAuthStoreSessionStore(options = {}) {
-    return {
-        async load(resource) {
-            const store = createResourceSecretStore(resource, options);
-            const value = await store.get();
-            if (value === null) {
-                return null;
-            }
-            const parsed = JSON.parse(value);
-            if (isStoredOAuthSession(parsed)) {
-                return parsed;
-            }
-            throw new Error("Stored OAuth session must match the expected shape");
-        },
-        async save(resource, session) {
-            const store = createResourceSecretStore(resource, options);
-            await store.set(JSON.stringify(session));
-        },
-        async clear(resource) {
-            const store = createResourceSecretStore(resource, options);
-            await store.delete();
-        }
-    };
-}
-export function createAuthStoreClientStore(options) {
-    return {
-        async load(issuer) {
-            const store = createIssuerSecretStore(issuer, options);
-            const value = await store.get();
-            if (value === null) {
-                return null;
-            }
-            const parsed = JSON.parse(value);
-            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
-            if (clientId !== undefined) {
-                const client = { clientId };
-                if (isObjectRecord(parsed) &&
-                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
-                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
-                }
-                return client;
-            }
-            throw new Error("Stored OAuth client must be a JSON object with clientId");
-        },
-        async save(issuer, client) {
-            const store = createIssuerSecretStore(issuer, options);
-            await store.set(JSON.stringify(client));
-        },
-        async clear(issuer) {
-            const store = createIssuerSecretStore(issuer, options);
-            await store.delete();
-        }
-    };
-}
-function createNamedSecretStore(key, options, defaults) {
-    const hash = crypto.createHash("sha256").update(key).digest("hex");
-    const configuredFilePath = options.fileStore?.filePath;
-    const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
-    const fileStore = {
-        ...options.fileStore,
-        filePath: parsedFilePath === null
-            ? undefined
-            : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
-        salt: options.fileStore?.salt ?? defaults.salt,
-        defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
-        defaultFileName: parsedFilePath === null
-            ? `${hash}.enc`
-            : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
-    };
-    const keychainStore = {
-        ...options.keychainStore,
-        service: options.keychainStore?.service ?? defaults.service,
-        account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
-    };
-    return createSecretStore({ ...options, fileStore, keychainStore }).store;
-}
-function createResourceSecretStore(resource, options) {
-    return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
-        salt: DEFAULT_FILE_SALT,
-        directory: DEFAULT_FILE_DIRECTORY,
-        service: DEFAULT_KEYCHAIN_SERVICE,
-        accountPrefix: "provider"
-    });
-}
-function createIssuerSecretStore(issuer, options) {
-    return createNamedSecretStore(issuer, options, {
-        salt: DEFAULT_CLIENT_FILE_SALT,
-        directory: DEFAULT_CLIENT_FILE_DIRECTORY,
-        service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
-        accountPrefix: "issuer"
-    });
-}
-function isObjectRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getOwnEntry(record, key) {
-    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
-}
-function getOwnString(record, key) {
-    const value = getOwnEntry(record, key);
-    return typeof value === "string" ? value : undefined;
-}
-function isStoredOAuthSession(value) {
-    if (!isObjectRecord(value)) {
-        return false;
-    }
-    return (isNonBlankOwnString(value, "resource") &&
-        isNonBlankOwnString(value, "authorizationServer") &&
-        isStoredOAuthClient(getOwnEntry(value, "client")) &&
-        isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
-        isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
-}
-function isStoredOAuthClient(value) {
-    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
-        return false;
-    }
-    const clientSecret = getOwnEntry(value, "clientSecret");
-    return (clientSecret === undefined ||
-        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
-}
-function isStoredOAuthDiscovery(value) {
-    if (!isObjectRecord(value)) {
-        return false;
-    }
-    return (isNonBlankOwnString(value, "resourceMetadataUrl") &&
-        isObjectRecord(getOwnEntry(value, "resourceMetadata")) &&
-        isObjectRecord(getOwnEntry(value, "authorizationServerMetadata")));
-}
-function isStoredOAuthTokensOrMissing(value) {
-    if (value === undefined) {
-        return true;
-    }
-    if (!isObjectRecord(value)) {
-        return false;
-    }
-    if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
-        return false;
-    }
-    const expiresAt = getOwnEntry(value, "expiresAt");
-    if (expiresAt !== null &&
-        (typeof expiresAt !== "number" ||
-            !Number.isSafeInteger(expiresAt) ||
-            expiresAt > MAX_JS_DATE_MS ||
-            !Number.isFinite(new Date(expiresAt).getTime()))) {
-        return false;
-    }
-    const refreshToken = getOwnEntry(value, "refreshToken");
-    if (refreshToken !== undefined &&
-        (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
-        return false;
-    }
-    const scope = getOwnEntry(value, "scope");
-    return scope === undefined || (typeof scope === "string" && scope.trim().length > 0);
-}
-function isNonBlankOwnString(record, key) {
-    const value = getOwnString(record, key);
-    return value !== undefined && value.trim().length > 0;
-}

package/node_modules/mcp-oauth/dist/client/authorization-state.d.ts

@@ -1,8 +0,0 @@
-export declare function createAuthorizationState(input: {
-    issuer: string;
-    requireIssuer: boolean;
-}): string;
-export declare function parseAuthorizationState(value: string | null): {
-    issuer: string;
-    requireIssuer: boolean;
-} | null;

package/node_modules/mcp-oauth/dist/client/authorization-state.js

@@ -1,47 +0,0 @@
-import crypto from "node:crypto";
-export function createAuthorizationState(input) {
-    const payload = {
-        v: 1,
-        n: crypto.randomBytes(16).toString("base64url"),
-        i: input.issuer,
-        r: input.requireIssuer,
-    };
-    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-}
-export function parseAuthorizationState(value) {
-    if (value === null || value.length === 0) {
-        return null;
-    }
-    try {
-        const decoded = Buffer.from(value, "base64url").toString("utf8");
-        const parsed = JSON.parse(decoded);
-        if (!isObjectRecord(parsed)) {
-            return null;
-        }
-        const version = getOwnEntry(parsed, "v");
-        const nonce = getOwnEntry(parsed, "n");
-        const issuer = getOwnEntry(parsed, "i");
-        const requireIssuer = getOwnEntry(parsed, "r");
-        if (version !== 1
-            || typeof nonce !== "string"
-            || nonce.length === 0
-            || typeof issuer !== "string"
-            || issuer.length === 0
-            || typeof requireIssuer !== "boolean") {
-            return null;
-        }
-        return {
-            issuer,
-            requireIssuer,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function isObjectRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getOwnEntry(record, key) {
-    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
-}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.d.ts

@@ -1,3 +0,0 @@
-import type { DefaultOAuthClientProviderOptions, OAuthClientProvider, OAuthClientProviderOptions } from "./types.js";
-export declare function createOAuthClientProvider(options: OAuthClientProviderOptions): OAuthClientProvider;
-export declare function createDefaultOAuthClientProvider(options: DefaultOAuthClientProviderOptions): OAuthClientProvider;