@prefecthq/fastmcp-ts 1.7.2 → 1.8.0

package/dist/server.d.ts

@@ -903,8 +903,9 @@ interface FastMCPOptions {
      * Bearer-token verifier, or a RequestVerifier for header-based
      * (trusted-proxy) deployments. See each type's docs. A RequestVerifier
      * applies to HTTP transports only; stdio's FASTMCP_CLI_AUTH_TOKEN needs a
-     * TokenVerifier. When both `oauth` and `auth` are set, `oauth` serves the
-     * endpoint and `auth` is ignored.
+     * TokenVerifier. Wrap either in `remoteAuth(...)` to also serve RFC 9728
+     * protected resource metadata over HTTP. When both `oauth` and `auth` are
+     * set, `oauth` serves the endpoint and `auth` is ignored.
      */
     auth?: TokenVerifier | RequestVerifier;
     /** Full OAuth 2.1 server with Dynamic Client Registration support. */
@@ -1156,6 +1157,7 @@ declare class FastMCP {
     private _templateResources;
     private _prompts;
     private _customRoutes;
+    private _protectedResourceRoutePath;
     private _promptsPageSize;
     private _middleware;
     private _transforms;
@@ -1507,6 +1509,7 @@ declare class FastMCP {
     private _runHttpOAuth;
     private _runHttpSimple;
     close(): Promise<void>;
+    private _unregisterProtectedResourceRoute;
 }
 
 declare class Image {
@@ -1527,6 +1530,71 @@ declare class ToolResult {
 
 declare function multiAuth(...verifiers: TokenVerifier[]): TokenVerifier;
 
+/** Options for {@link remoteAuth}. */
+interface RemoteAuthOptions<V extends TokenVerifier | RequestVerifier> {
+    /** Verifier that checks each request's credentials, such as `jwtVerifier(...)`. */
+    verifier: V;
+    /** Issuer URLs of the authorization servers that mint tokens for this server. */
+    authorizationServers: Array<string | URL>;
+    /** Public URL clients use to reach this server, without the MCP path. */
+    baseUrl: string | URL;
+    /** Scopes to advertise in the metadata document and in 401 challenges. */
+    scopesSupported?: string[];
+    /** Human-readable name of this server, shown by some clients. */
+    resourceName?: string;
+    /** URL of documentation for this server. */
+    resourceDocumentation?: string | URL;
+}
+/** Validated protected-resource settings that `run()` serves as metadata. */
+interface ProtectedResourceConfig {
+    readonly baseUrl: URL;
+    readonly authorizationServers: readonly string[];
+    readonly scopesSupported?: readonly string[];
+    readonly resourceName?: string;
+    readonly resourceDocumentation?: string;
+}
+/** A verifier that also carries {@link ProtectedResourceConfig}. */
+type RemoteAuthProvider<V extends TokenVerifier | RequestVerifier> = V & {
+    readonly protectedResource: ProtectedResourceConfig;
+};
+/**
+ * Make this server an OAuth resource server for an external authorization
+ * server. Pass the result to `FastMCPOptions.auth`.
+ *
+ * Use it when another service issues the tokens, such as Auth0, Keycloak or
+ * Okta, and this server only verifies them. `verifier` checks each request, as
+ * with `jwtVerifier` or `introspectionVerifier`. `remoteAuth` adds the
+ * discovery information that lets MCP clients find the authorization server on
+ * their own.
+ *
+ * The resource URL is `baseUrl` joined with the path given to `run()`. For a
+ * `baseUrl` of `https://mcp.example.com` and the default path `/mcp`, the
+ * resource is `https://mcp.example.com/mcp`. Set `baseUrl` to the public URL
+ * that clients use, such as the address of your reverse proxy. A wrong value
+ * makes the advertised resource differ from the URL clients call.
+ *
+ * Over HTTP the server then serves the RFC 9728 metadata document at
+ * `/.well-known/oauth-protected-resource` followed by the MCP path. Each 401
+ * response also carries a `WWW-Authenticate: Bearer` challenge whose
+ * `resource_metadata` parameter points to that document.
+ *
+ * If you set both this and `oauth`, `oauth` takes precedence.
+ *
+ * @example
+ * ```ts
+ * const mcp = new FastMCP({
+ *   name: 'my-server',
+ *   auth: remoteAuth({
+ *     verifier: jwtVerifier({ jwksUri: 'https://auth.example.com/.well-known/jwks.json' }),
+ *     authorizationServers: ['https://auth.example.com'],
+ *     baseUrl: 'https://mcp.example.com',
+ *   }),
+ * })
+ * ```
+ */
+declare function remoteAuth(options: RemoteAuthOptions<TokenVerifier>): RemoteAuthProvider<TokenVerifier>;
+declare function remoteAuth(options: RemoteAuthOptions<RequestVerifier>): RemoteAuthProvider<RequestVerifier>;
+
 interface JwtVerifierOptions {
     jwksUri: string;
     issuer?: string;
@@ -1970,4 +2038,4 @@ declare class FormInput {
     constructor(options: FormInputOptions);
 }
 
-export { type AccessToken, Approval, Area, type AuthCheck, AuthorizationError, type BackendToolConfig, Badge, Bar, type BrowserPermissions, Button, type CacheKeyFn, CachingMiddleware, CancellationMiddleware, type CatalogEntry, Choice, Column, type CompleteCallback, type CompletionContext, type CompletionResult, type Component, type ComponentFn, type CorsOptions, type CspPolicy, type CustomRouteConfig, type CustomRouteHandler, type ElicitationResult, type ElicitationSchema, type EntrypointConfig, ErrorNormalizationMiddleware, FastMCP, FastMCPApp, type FastMCPAppOptions, type FastMCPOptions, File, type FileHandle, type FileStorageAdapter, FileUpload, type FileUploadOptions, FilterTransform, ForEach, FormInput, type FormInputOptions, type FrameworkLogLevel, GenerativeUI, Grid, type HTTPRoute, type HealthOptions, type HttpMethod, type HttpRequestContext, If, type IfNode, Image, Input, Line, type LogLevel, type Logger, LoggingMiddleware, type MCPType, type McpContext, type Middleware, type MiddlewareContext, NamespaceTransform, type Next, type OAuthConfig, type OAuthProviderOptions, type OAuthProxyOptions, type OpenAPIClientOptions, type OpenAPIComponent, type OpenAPIResourceComponent, type OpenAPIResourceTemplateComponent, type OpenAPIServerOptions, type OpenAPIToolComponent, type ParameterInfo, Pie, type PromptArgument, type PromptConfig, type PromptContent, type PromptMessage, PromptResult, type PromptView, PromptsAsTools, type ProxyTransport, RateLimitingMiddleware, type RequestBodyInfo, type RequestVerifier, type ResourceAnnotations, type ResourceConfig, ResourceResult, type ResourceUiMeta, type ResourceView, ResourcesAsTools, type ResponseInfo, type Root, type RouteMap, type RouteMapFn, Row, type RunOptions, Rx, type SamplingMessage, type SamplingParams, type SamplingResult, Select, type ServerAddress, SizeLimitingMiddleware, type SynthesizedTool, Table, Text, type TokenVerifier, type ToolAnnotations, type ToolConfig, ToolResult, type ToolView, type Transform, type UiToolMeta, VersionFilter, type Visibility, actionRef, createOpenAPIServer, createProxy, debugTokenVerifier, forwardableHeaders, introspectionVerifier, jwtVerifier, multiAuth, oauthProvider, oauthProxy, redescribeTool, renameTool, requireScopes, staticTokenVerifier };
+export { type AccessToken, Approval, Area, type AuthCheck, AuthorizationError, type BackendToolConfig, Badge, Bar, type BrowserPermissions, Button, type CacheKeyFn, CachingMiddleware, CancellationMiddleware, type CatalogEntry, Choice, Column, type CompleteCallback, type CompletionContext, type CompletionResult, type Component, type ComponentFn, type CorsOptions, type CspPolicy, type CustomRouteConfig, type CustomRouteHandler, type ElicitationResult, type ElicitationSchema, type EntrypointConfig, ErrorNormalizationMiddleware, FastMCP, FastMCPApp, type FastMCPAppOptions, type FastMCPOptions, File, type FileHandle, type FileStorageAdapter, FileUpload, type FileUploadOptions, FilterTransform, ForEach, FormInput, type FormInputOptions, type FrameworkLogLevel, GenerativeUI, Grid, type HTTPRoute, type HealthOptions, type HttpMethod, type HttpRequestContext, If, type IfNode, Image, Input, Line, type LogLevel, type Logger, LoggingMiddleware, type MCPType, type McpContext, type Middleware, type MiddlewareContext, NamespaceTransform, type Next, type OAuthConfig, type OAuthProviderOptions, type OAuthProxyOptions, type OpenAPIClientOptions, type OpenAPIComponent, type OpenAPIResourceComponent, type OpenAPIResourceTemplateComponent, type OpenAPIServerOptions, type OpenAPIToolComponent, type ParameterInfo, Pie, type PromptArgument, type PromptConfig, type PromptContent, type PromptMessage, PromptResult, type PromptView, PromptsAsTools, type ProtectedResourceConfig, type ProxyTransport, RateLimitingMiddleware, type RemoteAuthOptions, type RemoteAuthProvider, type RequestBodyInfo, type RequestVerifier, type ResourceAnnotations, type ResourceConfig, ResourceResult, type ResourceUiMeta, type ResourceView, ResourcesAsTools, type ResponseInfo, type Root, type RouteMap, type RouteMapFn, Row, type RunOptions, Rx, type SamplingMessage, type SamplingParams, type SamplingResult, Select, type ServerAddress, SizeLimitingMiddleware, type SynthesizedTool, Table, Text, type TokenVerifier, type ToolAnnotations, type ToolConfig, ToolResult, type ToolView, type Transform, type UiToolMeta, VersionFilter, type Visibility, actionRef, createOpenAPIServer, createProxy, debugTokenVerifier, forwardableHeaders, introspectionVerifier, jwtVerifier, multiAuth, oauthProvider, oauthProxy, redescribeTool, remoteAuth, renameTool, requireScopes, staticTokenVerifier };

package/dist/server.js

@@ -4,7 +4,7 @@ import {
 
 // src/server/FastMCP.ts
 import { hostHeaderValidation, originValidation } from "@modelcontextprotocol/node";
-import { ProtocolError as ProtocolError3, ProtocolErrorCode as ProtocolErrorCode3, ResourceNotFoundError, Server as Server2, createMcpHandler, legacyStatelessFallback, isLegacyRequest, isJsonContentType, createRequestStateCodec, localhostAllowedHostnames, localhostAllowedOrigins, assertCompleteRequestPrompt, assertCompleteRequestResourceTemplate } from "@modelcontextprotocol/server";
+import { ProtocolError as ProtocolError3, ProtocolErrorCode as ProtocolErrorCode3, ResourceNotFoundError, Server as Server2, createMcpHandler, legacyStatelessFallback, isLegacyRequest, isJsonContentType, createRequestStateCodec, localhostAllowedHostnames, localhostAllowedOrigins, getOAuthProtectedResourceMetadataUrl as getOAuthProtectedResourceMetadataUrl2, assertCompleteRequestPrompt, assertCompleteRequestResourceTemplate } from "@modelcontextprotocol/server";
 import { randomUUID as randomUUID2 } from "crypto";
 
 // src/server/auth/types.ts
@@ -18,6 +18,98 @@ var AuthorizationError = class extends Error {
   }
 };
 
+// src/server/auth/remote.ts
+import {
+  getOAuthProtectedResourceMetadataUrl
+} from "@modelcontextprotocol/server";
+var SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+function parseHttpUrl(value, option) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`remoteAuth: ${option} must be a valid URL, got "${String(value)}"`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`remoteAuth: ${option} must use http or https, got "${String(value)}"`);
+  }
+  return url;
+}
+function remoteAuth(options) {
+  const { verifier } = options;
+  const baseUrl = parseHttpUrl(options.baseUrl, "baseUrl");
+  if (baseUrl.search !== "" || baseUrl.hash !== "") {
+    throw new Error("remoteAuth: baseUrl must not have a query string or fragment");
+  }
+  if (options.authorizationServers.length === 0) {
+    throw new Error("remoteAuth: authorizationServers must contain at least one entry");
+  }
+  const authorizationServers = options.authorizationServers.map((entry) => {
+    const url = parseHttpUrl(entry, "authorizationServers entry");
+    return typeof entry === "string" ? entry : url.href;
+  });
+  for (const scope of options.scopesSupported ?? []) {
+    if (!SCOPE_TOKEN.test(scope)) {
+      throw new Error(
+        `remoteAuth: scopesSupported entry "${scope}" must not be empty or contain spaces, quotes or backslashes`
+      );
+    }
+  }
+  let resourceDocumentation;
+  if (options.resourceDocumentation !== void 0) {
+    try {
+      resourceDocumentation = new URL(options.resourceDocumentation).href;
+    } catch {
+      throw new Error(
+        `remoteAuth: resourceDocumentation must be a valid URL, got "${String(options.resourceDocumentation)}"`
+      );
+    }
+  }
+  const protectedResource = {
+    baseUrl,
+    authorizationServers,
+    ...options.scopesSupported && { scopesSupported: [...options.scopesSupported] },
+    ...options.resourceName !== void 0 && { resourceName: options.resourceName },
+    ...resourceDocumentation !== void 0 && { resourceDocumentation }
+  };
+  if (isRequestVerifier(verifier)) {
+    return { verifyRequest: (request) => verifier.verifyRequest(request), protectedResource };
+  }
+  return { verify: (token) => verifier.verify(token), protectedResource };
+}
+function getProtectedResource(auth) {
+  return auth?.protectedResource;
+}
+function resolveResourceUrl(baseUrl, mcpPath) {
+  const base = baseUrl.href.replace(/\/+$/, "");
+  return new URL(`${base}/${mcpPath.replace(/^\/+/, "")}`);
+}
+function protectedResourceRoute(config, mcpPath) {
+  const resourceUrl = resolveResourceUrl(config.baseUrl, mcpPath);
+  const metadataUrl = getOAuthProtectedResourceMetadataUrl(resourceUrl);
+  return {
+    path: new URL(metadataUrl).pathname,
+    metadataUrl,
+    metadata: {
+      resource: resourceUrl.href,
+      authorization_servers: [...config.authorizationServers],
+      ...config.scopesSupported && { scopes_supported: [...config.scopesSupported] },
+      bearer_methods_supported: ["header"],
+      ...config.resourceName !== void 0 && { resource_name: config.resourceName },
+      ...config.resourceDocumentation !== void 0 && {
+        resource_documentation: config.resourceDocumentation
+      }
+    }
+  };
+}
+function bearerChallenge(config, error) {
+  const parts = ['realm="mcp"'];
+  if (error) parts.push(`error="${error}"`);
+  if (config.scopes && config.scopes.length > 0) parts.push(`scope="${config.scopes.join(" ")}"`);
+  parts.push(`resource_metadata="${config.resourceMetadataUrl}"`);
+  return `Bearer ${parts.join(", ")}`;
+}
+
 // src/server/legacyEventStore.ts
 import { randomUUID } from "crypto";
 var DEFAULT_MAX_EVENTS = 256;
@@ -312,6 +404,10 @@ var CustomRouteRegistry = class {
     }
     this._routes.set(path, { methods: new Set(methods), handler });
   }
+  /** Remove the route at `path`, if any. */
+  unregister(path) {
+    this._routes.delete(path);
+  }
   /** Throws when a registered route sits on the MCP endpoint path. Called at HTTP startup. */
   assertNoMcpCollision(mcpPath) {
     if (this._routes.has(mcpPath)) {
@@ -996,6 +1092,9 @@ function isUiCapable(clientCapabilities) {
   const uiCapability = clientCapabilities?.extensions?.[UI_EXTENSION_KEY];
   return !!uiCapability?.mimeTypes?.includes(UI_RESOURCE_MIME_TYPE);
 }
+function shouldServeUi(clientCapabilities) {
+  return clientCapabilities === void 0 || isUiCapable(clientCapabilities);
+}
 
 // src/server/prompt.ts
 var PromptResult = class {
@@ -1483,6 +1582,9 @@ var FastMCP = class {
   _templateResources = /* @__PURE__ */ new Map();
   _prompts = /* @__PURE__ */ new Map();
   _customRoutes = new CustomRouteRegistry();
+  // The metadata route that run() registers for remoteAuth; close() removes it
+  // so that a later run() can register it again.
+  _protectedResourceRoutePath = null;
   _promptsPageSize;
   _middleware;
   _transforms;
@@ -1609,7 +1711,7 @@ var FastMCP = class {
       return contextStore.run(
         ctx,
         () => runMiddlewareChain(this._middleware, "tools/list", req.params, ctx, async () => {
-          const clientIsUiCapable = isUiCapable(server.getClientCapabilities());
+          const clientIsUiCapable = shouldServeUi(server.getClientCapabilities());
           const allVisible = (await Promise.all(
             [...this._tools.values()].map(async (t) => {
               if (t.config.disabled) return null;
@@ -1761,11 +1863,10 @@ var FastMCP = class {
             let resultValue = await executePromise;
             if (resolvedTool.config.output) resultValue = await validateInput(resolvedTool.config.output, resultValue);
             const callResult = convertResult(resultValue, opts?.stateless, this._logger);
-            if (resolvedTool.config.ui) {
-              const clientIsUi = isUiCapable(server.getClientCapabilities());
-              if (!clientIsUi && callResult.structuredContent !== void 0) {
-                return { content: [{ type: "text", text: "[UI not available in this client]" }] };
-              }
+            const uiGateClosed = resolvedTool.config.ui !== void 0 && !shouldServeUi(server.getClientCapabilities()) && !resolvedTool.config.output && !resolvedTool.config.outputSchema;
+            if (uiGateClosed && callResult.structuredContent !== void 0) {
+              const { structuredContent: _dropped, ...textResult } = callResult;
+              return textResult;
             }
             return callResult;
           })
@@ -1808,7 +1909,7 @@ var FastMCP = class {
           }
           const page = transformedResources.slice(startIdx, startIdx + pageSize);
           const nextCursor = startIdx + pageSize < transformedResources.length ? Buffer.from(page[page.length - 1].uri).toString("base64url") : void 0;
-          const clientIsUiCapableRes = isUiCapable(server.getClientCapabilities());
+          const clientIsUiCapableRes = shouldServeUi(server.getClientCapabilities());
           return {
             resources: page.map((r) => ({
               uri: r.uri,
@@ -1899,7 +2000,7 @@ var FastMCP = class {
           }
           const result = await executePromise;
           const converted = convertResourceResult(result, requestedUri, resource.config.mimeType, opts?.stateless);
-          return attachResourceUiMeta(converted, resource.config.ui, isUiCapable(server.getClientCapabilities()));
+          return attachResourceUiMeta(converted, resource.config.ui, shouldServeUi(server.getClientCapabilities()));
         })
       );
     });
@@ -2743,11 +2844,29 @@ var FastMCP = class {
           )
         );
       }
-      this._customRoutes.assertNoMcpCollision(path);
-      if (this._oauth) {
-        await this._runHttpOAuth(port, host, path);
-      } else {
-        await this._runHttpSimple(port, host, path);
+      const protectedResource = this._oauth ? void 0 : getProtectedResource(this._auth);
+      let challenge;
+      if (protectedResource) {
+        const route = protectedResourceRoute(protectedResource, path);
+        this._customRoutes.register(
+          { path: route.path },
+          (request) => Response.json(route.metadata, {
+            headers: this._cors ? corsResponseHeaders(this._cors, request.headers.get("origin") ?? void 0, this._logger) : {}
+          })
+        );
+        this._protectedResourceRoutePath = route.path;
+        challenge = { resourceMetadataUrl: route.metadataUrl, scopes: protectedResource.scopesSupported };
+      }
+      try {
+        this._customRoutes.assertNoMcpCollision(path);
+        if (this._oauth) {
+          await this._runHttpOAuth(port, host, path);
+        } else {
+          await this._runHttpSimple(port, host, path, challenge);
+        }
+      } catch (err) {
+        this._unregisterProtectedResourceRoute();
+        throw err;
       }
     }
   }
@@ -2911,16 +3030,19 @@ var FastMCP = class {
     });
     const bound = httpServer.address();
     const issuerUrl = oauth.issuerUrl ?? new URL(`http://${bound.address}:${bound.port}`);
+    const resourceServerUrl = new URL(path, issuerUrl);
+    const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl2(resourceServerUrl);
     app.use(
       mcpAuthRouter({
         provider: oauth.provider,
         issuerUrl,
+        resourceServerUrl,
         scopesSupported: oauth.scopes
       })
     );
     app.all(
       path,
-      requireBearerAuth({ verifier: oauth.provider }),
+      requireBearerAuth({ verifier: oauth.provider, resourceMetadataUrl }),
       async (req, res) => {
         await this._dispatchHttp(req, res);
       }
@@ -2931,7 +3053,7 @@ var FastMCP = class {
     this._logger.startupBanner({ name: this.name, version: this.version, transport: "http", url });
     this._logger.listening(url);
   }
-  async _runHttpSimple(port, host, path) {
+  async _runHttpSimple(port, host, path, challenge) {
     this._resolveDnsRebindingGuards(host);
     const { createServer } = await import("http");
     const auth = this._auth;
@@ -2964,7 +3086,10 @@ var FastMCP = class {
             if (err instanceof AuthorizationError) {
               res.writeHead(403, { "Content-Type": "application/json" }).end(JSON.stringify({ error: err.message }));
             } else {
-              res.writeHead(401, { "Content-Type": "application/json" }).end(JSON.stringify({ error: err instanceof Error ? err.message : "Authentication failed" }));
+              res.writeHead(401, {
+                "Content-Type": "application/json",
+                ...challenge && { "WWW-Authenticate": bearerChallenge(challenge) }
+              }).end(JSON.stringify({ error: err instanceof Error ? err.message : "Authentication failed" }));
             }
             return;
           }
@@ -2988,7 +3113,10 @@ var FastMCP = class {
           const authHeader = req.headers.authorization;
           const bearer = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
           if (!bearer) {
-            res.writeHead(401, { "Content-Type": "application/json", "WWW-Authenticate": 'Bearer realm="mcp"' }).end(JSON.stringify({ error: "Missing bearer token" }));
+            res.writeHead(401, {
+              "Content-Type": "application/json",
+              "WWW-Authenticate": challenge ? bearerChallenge(challenge) : 'Bearer realm="mcp"'
+            }).end(JSON.stringify({ error: "Missing bearer token" }));
             return;
           }
           try {
@@ -3004,7 +3132,10 @@ var FastMCP = class {
             if (err instanceof AuthorizationError) {
               res.writeHead(403, { "Content-Type": "application/json" }).end(JSON.stringify({ error: err.message }));
             } else {
-              res.writeHead(401, { "Content-Type": "application/json", "WWW-Authenticate": 'Bearer realm="mcp"' }).end(JSON.stringify({ error: err instanceof Error ? err.message : "Authentication failed" }));
+              res.writeHead(401, {
+                "Content-Type": "application/json",
+                "WWW-Authenticate": challenge ? bearerChallenge(challenge, "invalid_token") : 'Bearer realm="mcp"'
+              }).end(JSON.stringify({ error: err instanceof Error ? err.message : "Authentication failed" }));
             }
             return;
           }
@@ -3044,6 +3175,7 @@ var FastMCP = class {
       this._stdioState = null;
       this._stdioModern = false;
     }
+    this._unregisterProtectedResourceRoute();
     if (this._httpServer) {
       await new Promise((resolve, reject) => {
         this._httpServer.close((err) => err != null ? reject(err) : resolve());
@@ -3053,6 +3185,12 @@ var FastMCP = class {
     this._address = null;
     await this._primaryServer.close();
   }
+  _unregisterProtectedResourceRoute() {
+    if (this._protectedResourceRoutePath) {
+      this._customRoutes.unregister(this._protectedResourceRoutePath);
+      this._protectedResourceRoutePath = null;
+    }
+  }
 };
 
 // src/server/auth/authorization.ts
@@ -3189,7 +3327,7 @@ function debugTokenVerifier() {
 
 // src/server/auth/oauth/provider.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { UnsupportedGrantTypeError } from "@modelcontextprotocol/server-legacy/auth";
+import { InvalidTokenError, UnsupportedGrantTypeError } from "@modelcontextprotocol/server-legacy/auth";
 function oauthProvider(options = {}) {
   const clients = /* @__PURE__ */ new Map();
   const codes = /* @__PURE__ */ new Map();
@@ -3250,8 +3388,8 @@ function oauthProvider(options = {}) {
     },
     async verifyAccessToken(token) {
       const data = tokens.get(token);
-      if (!data) throw new Error("Invalid token");
-      if (data.expiresAt < Math.floor(Date.now() / 1e3)) throw new Error("Token has expired");
+      if (!data) throw new InvalidTokenError("Invalid token");
+      if (data.expiresAt < Math.floor(Date.now() / 1e3)) throw new InvalidTokenError("Token has expired");
       return {
         token,
         clientId: data.clientId,
@@ -5646,6 +5784,7 @@ export {
   oauthProvider,
   oauthProxy,
   redescribeTool,
+  remoteAuth,
   renameTool,
   requireScopes,
   staticTokenVerifier