@prefecthq/fastmcp-ts 1.8.0 → 1.8.1

package/dist/cli/index.cjs

@@ -1180,8 +1180,8 @@ var init_version = __esm({
       async run({ args }) {
         if (args.json) setJsonMode(true);
         const data = {
-          fastmcp: "1.8.0",
-          "mcp-sdk": "2.0.0",
+          fastmcp: "1.8.1",
+          "mcp-sdk": "2.3.1",
           node: process.version,
           platform: `${process.platform} ${process.arch}`
         };
@@ -8965,10 +8965,10 @@ var init_v4 = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var LATEST_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, PROTOCOL_VERSION_META_KEY, CLIENT_INFO_META_KEY, SERVER_INFO_META_KEY, CLIENT_CAPABILITIES_META_KEY, SUBSCRIPTION_ID_META_KEY, LOG_LEVEL_META_KEY, JSONRPC_VERSION, JSONValueSchema, JSONObjectSchema, JSONArraySchema, ProgressTokenSchema, CursorSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultMetaObjectSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, JSONRPCNotificationSchema, JSONRPCResultResponseSchema, JSONRPCErrorResponseSchema, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, DiscoverRequestSchema, DiscoverResultSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, SubscriptionFilterSchema, SubscriptionsListenRequestParamsSchema, SubscriptionsListenRequestSchema, SubscriptionsAcknowledgedNotificationParamsSchema, SubscriptionsAcknowledgedNotificationSchema, SubscriptionsListenResultMetaSchema, SubscriptionsListenResultSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, TaskCreationParamsSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, SafeUrlSchema, OAuthProtectedResourceMetadataSchema, OAuthMetadataSchema, OpenIdProviderMetadataSchema, OpenIdProviderDiscoveryMetadataSchema, OAuthTokensSchema, IdJagTokenExchangeResponseSchema, OAuthErrorResponseSchema, OptionalSafeUrlSchema, OAuthClientMetadataSchema, OAuthClientInformationSchema, OAuthClientInformationFullSchema, OAuthClientRegistrationErrorSchema, OAuthTokenRevocationRequestSchema;
 var init_auth_BNDyLTqp = __esm({
-  "node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs"() {
+  "node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs"() {
     "use strict";
     init_v4();
     LATEST_PROTOCOL_VERSION = "2025-11-25";
@@ -9913,15 +9913,15 @@ var init_auth_BNDyLTqp = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/dist/internal.mjs
+// node_modules/@modelcontextprotocol/core/dist/internal.mjs
 var init_internal = __esm({
-  "node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/dist/internal.mjs"() {
+  "node_modules/@modelcontextprotocol/core/dist/internal.mjs"() {
     "use strict";
     init_auth_BNDyLTqp();
   }
 });
 
-// node_modules/@modelcontextprotocol/client/dist/src-xKF0PJN-.mjs
+// node_modules/@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
   let current = ctor;
@@ -11882,7 +11882,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 function buildSchemas2026() {
@@ -12080,6 +12081,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
@@ -12709,9 +12713,61 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
     });
   };
 }
-var BRANDS, OAuthErrorCode, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, isInitializeRequest, isInitializedNotification, MCP_PARAM_HEADER_PREFIX, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, BASE64_SENTINEL_PREFIX, BASE64_SENTINEL_SUFFIX, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, MCP_NAME_HEADER_SOURCE, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, DEFAULT_INPUT_REQUIRED_AUTO_FULFILL, DEFAULT_INPUT_REQUIRED_MAX_ROUNDS, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, InMemoryTransport;
-var init_src_xKF0PJN = __esm({
-  "node_modules/@modelcontextprotocol/client/dist/src-xKF0PJN-.mjs"() {
+function isWithinOrigin(from, to) {
+  if (from.protocol === to.protocol && from.host === to.host) return true;
+  return from.protocol === "http:" && to.protocol === "https:" && from.hostname === to.hostname && !from.port && !to.port;
+}
+function redirectTarget(url2, response) {
+  const location = REDIRECT_STATUSES.has(response.status) ? response.headers?.get("location") : void 0;
+  if (!location) return void 0;
+  try {
+    return new URL(location, url2);
+  } catch {
+    return;
+  }
+}
+function fetchLeavingRedirects(baseFetch) {
+  const copy = (url2, init) => baseFetch(url2, init);
+  leftToFetch.add(copy);
+  return copy;
+}
+function fetchWithinOrigin(baseFetch) {
+  if (leftToFetch.has(baseFetch)) return baseFetch;
+  return async (url2, init) => {
+    if (init?.redirect === "error" || init?.redirect === "manual") return baseFetch(url2, init);
+    const method = (init?.method ?? "GET").toUpperCase();
+    let current = url2;
+    for (let followed = 0; ; followed++) {
+      const response = await baseFetch(current, {
+        ...init,
+        redirect: "manual"
+      });
+      const target = redirectTarget(current, response);
+      if (!target || followed === MAX_REDIRECTS) return response;
+      const from = new URL(current);
+      const keepsMethod = method === "GET" || response.status === 307 || response.status === 308;
+      const keepsUserinfo = !(target.username || target.password) || target.username === from.username && target.password === from.password;
+      if (!keepsMethod || !keepsUserinfo || !isWithinOrigin(from, target)) return response;
+      await response.text?.().catch(() => {
+      });
+      current = target;
+    }
+  };
+}
+function unfollowedRedirect(url2, response) {
+  if (response.type === "opaqueredirect") return "Redirect not followed: this runtime does not expose where it points";
+  const target = redirectTarget(response.url || url2, response);
+  if (!target) return void 0;
+  target.username = target.password = target.search = target.hash = "";
+  if (target.protocol === "http:" && new URL(response.url || url2).protocol === "https:") {
+    target.protocol = "https:";
+    return `Redirect from https to plain http not followed; try ${target.href} as the endpoint`;
+  }
+  return `Redirect to ${target.href} not followed; use that URL as the endpoint if it is the intended server`;
+}
+var BRANDS, OAuthErrorCode, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, isInitializeRequest, isInitializedNotification, MCP_PARAM_HEADER_PREFIX, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, BASE64_SENTINEL_PREFIX, BASE64_SENTINEL_SUFFIX, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, MCP_NAME_HEADER_SOURCE, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, DEFAULT_INPUT_REQUIRED_AUTO_FULFILL, DEFAULT_INPUT_REQUIRED_MAX_ROUNDS, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, REDIRECT_STATUSES, MAX_REDIRECTS, leftToFetch, InMemoryTransport;
+var init_src_WCy6ifGf = __esm({
+  "node_modules/@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs"() {
     "use strict";
     init_chunk_Br0eD_fh();
     init_dialects_BOhdv1Fc();
@@ -13850,6 +13906,8 @@ var init_src_xKF0PJN = __esm({
       _transport;
       _requestMessageId = 0;
       _requestHandlers = /* @__PURE__ */ new Map();
+      /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+      _customSchemaRequestMethods = /* @__PURE__ */ new Set();
       _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
       _notificationHandlers = /* @__PURE__ */ new Map();
       _responseHandlers = /* @__PURE__ */ new Map();
@@ -14133,7 +14191,7 @@ var init_src_xKF0PJN = __esm({
             return;
           }
         }
-        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
           sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
           return;
         }
@@ -14266,8 +14324,11 @@ var init_src_xKF0PJN = __esm({
       }
       request(request, schemaOrOptions, maybeOptions) {
         const codec2 = this._resolveOutboundCodec(request.method);
+        if (isStandardSchema(schemaOrOptions)) {
+          if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+          return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+        }
         this._assertOutboundRequestInEra(codec2, request.method);
-        if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
         const validate2 = codecResultValidator(codec2, request.method);
         if (validate2 === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
         return this._requestWithSchemaViaCodec(codec2, request, validate2, schemaOrOptions);
@@ -14511,6 +14572,8 @@ var init_src_xKF0PJN = __esm({
           return maybeHandler(parsed.data, ctx);
         };
         else throw new TypeError("setRequestHandler: handler is required");
+        if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+        else this._customSchemaRequestMethods.add(method);
         this._requestHandlers.set(method, this._wrapHandler(method, stored));
       }
       /**
@@ -14540,6 +14603,7 @@ var init_src_xKF0PJN = __esm({
       */
       removeRequestHandler(method) {
         this._requestHandlers.delete(method);
+        this._customSchemaRequestMethods.delete(method);
       }
       /**
       * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -14653,6 +14717,15 @@ var init_src_xKF0PJN = __esm({
         this._buffer = void 0;
       }
     };
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+      301,
+      302,
+      303,
+      307,
+      308
+    ]);
+    MAX_REDIRECTS = 5;
+    leftToFetch = /* @__PURE__ */ new WeakSet();
     InMemoryTransport = class InMemoryTransport2 {
       _otherTransport;
       _messageQueue = [];
@@ -22703,12 +22776,13 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
   return OAuthProtectedResourceMetadataSchema.parse(await response.json());
 }
 async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  const withinOrigin = fetchWithinOrigin(fetchFn);
   try {
-    return await fetchFn(url2, { headers });
+    return await withinOrigin(url2, { headers });
   } catch (error2) {
     if (!(error2 instanceof TypeError) || !CORS_IS_POSSIBLE) throw error2;
     if (headers) try {
-      return await fetchFn(url2, {});
+      return await withinOrigin(url2, {});
     } catch (retryError) {
       if (!(retryError instanceof TypeError)) throw retryError;
       return;
@@ -22726,7 +22800,7 @@ async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
 function shouldAttemptFallback(response, pathname) {
   if (!response) return true;
   if (pathname === "/") return false;
-  return response.status >= 400 && response.status < 500 || response.status === 502;
+  return !response.ok && response.status < 500 || response.status === 502;
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   const issuer = new URL(serverUrl);
@@ -22783,7 +22857,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
     if (!response.ok) {
       await response.text?.().catch(() => {
       });
-      if (response.status >= 400 && response.status < 500 || response.status === 502) continue;
+      if (response.status < 500 || response.status === 502) continue;
       throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
     }
     const parsed = type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
@@ -22864,7 +22938,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
       htm: "POST",
       htu: tokenUrl
     }));
-    return (fetchFn ?? fetch)(tokenUrl, {
+    return fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
       method: "POST",
       headers: requestHeaders,
       body: tokenRequestParams
@@ -22948,7 +23022,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     ...clientMetadata,
     ...scope === void 0 ? {} : { scope }
   };
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(submittedMetadata)
@@ -22999,6 +23073,11 @@ function classifyProbeOutcome(outcome, context) {
       return classifyHttpError(outcome, context);
     case "network-error":
       return classifyNetworkError(outcome.error, context);
+    case "unusable-reply":
+      return {
+        kind: "error",
+        error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: the server answered with an unusable reply (${describeError(outcome.error)})`, { cause: outcome.error }, { cause: outcome.error })
+      };
     case "auth-required":
       return {
         kind: "error",
@@ -23173,6 +23252,10 @@ function buildProbeRequest(id, protocolVersion, clientInfo, capabilities) {
     }) }
   };
 }
+function isUnusableReplyError(error2) {
+  if (error2 instanceof SdkError && error2.code === SdkErrorCode.ClientHttpUnexpectedContent) return true;
+  return error2 instanceof Error && error2.name === "SyntaxError";
+}
 function normalizeReply(reply, timeoutMs) {
   switch (reply.kind) {
     case "response":
@@ -23198,6 +23281,10 @@ function normalizeReply(reply, timeoutMs) {
           statusText: error2.data.statusText
         };
       }
+      if (isUnusableReplyError(error2)) return {
+        kind: "unusable-reply",
+        error: error2
+      };
       return {
         kind: "network-error",
         error: error2
@@ -23395,7 +23482,7 @@ var OAuthClientFlowError, IssuerMismatchError, RegistrationRejectedError, Insecu
 var init_dist4 = __esm({
   "node_modules/@modelcontextprotocol/client/dist/index.mjs"() {
     "use strict";
-    init_src_xKF0PJN();
+    init_src_WCy6ifGf();
     init_shimsNode();
     init_index_node();
     init_dist3();
@@ -25546,6 +25633,7 @@ var init_dist4 = __esm({
       _skipIssuerMetadataValidation;
       _fetch;
       _fetchWithInit;
+      _redirectPolicy;
       _dpop;
       _protocolVersion;
       onclose;
@@ -25567,9 +25655,21 @@ var init_dist4 = __esm({
             this._fetch = this._dpop(opts.fetch ?? fetch);
           }
         } else this._authProvider = opts?.authProvider;
+        this._redirectPolicy = opts?.redirectPolicy;
         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+        if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
       }
       _last401Response;
+      _connectAuthRetried = false;
+      /** `baseFetch` with redirects handled as `redirectPolicy` says. */
+      _redirects(baseFetch) {
+        return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+      }
+      /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+      _unfollowedRedirect(url2, response) {
+        const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url2, response);
+        return text && `${text} (redirectPolicy: 'same-origin')`;
+      }
       async _commonHeaders() {
         const headers = new Headers(this._requestInit?.headers || void 0);
         let token;
@@ -25584,7 +25684,8 @@ var init_dist4 = __esm({
       }
       _startOrAuth() {
         const eventSourceFetch = this._eventSourceInit?.fetch;
-        const fetchImpl = eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch;
+        const fetchImpl = this._redirects(eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch);
+        let redirect;
         return new Promise((resolve5, reject) => {
           this._eventSource = new EventSource(this._url.href, {
             ...this._eventSourceInit,
@@ -25595,6 +25696,7 @@ var init_dist4 = __esm({
                 ...init,
                 headers
               });
+              redirect = this._unfollowedRedirect(url2, response);
               if (response.status === 401) {
                 this._last401Response = response;
                 if (response.headers.has("www-authenticate")) {
@@ -25609,31 +25711,41 @@ var init_dist4 = __esm({
           this._abortController = new AbortController();
           this._eventSource.onerror = (event) => {
             if (event.code === 401 && this._authProvider) {
-              if (this._authProvider.onUnauthorized && this._last401Response) {
+              if (this._authProvider.onUnauthorized && this._last401Response && !this._connectAuthRetried) {
                 const response = this._last401Response;
                 this._last401Response = void 0;
+                this._connectAuthRetried = true;
                 this._eventSource?.close();
                 this._authProvider.onUnauthorized({
                   response,
                   serverUrl: this._url,
                   fetchFn: this._fetchWithInit
                 }).then(() => this._startOrAuth().then(resolve5, reject), (error$2) => {
+                  this._connectAuthRetried = false;
                   markAuthSeamEscape(error$2);
                   this.onerror?.(error$2);
                   reject(error$2);
                 });
                 return;
               }
-              const error$1 = markAuthSeamEscape(new UnauthorizedError());
+              const retried = this._connectAuthRetried;
+              this._connectAuthRetried = false;
+              const error$1 = markAuthSeamEscape(retried ? new SdkHttpError(SdkErrorCode.ClientHttpAuthentication, "Server returned 401 after re-authentication", {
+                status: 401,
+                statusText: this._last401Response?.statusText ?? ""
+              }) : new UnauthorizedError());
+              this._last401Response = void 0;
               reject(error$1);
               this.onerror?.(error$1);
               return;
             }
-            const error2 = new SseError(event.code, event.message, event);
+            this._connectAuthRetried = false;
+            const error2 = new SseError(event.code, redirect ?? event.message, event);
             reject(error2);
             this.onerror?.(error2);
           };
           this._eventSource.onopen = () => {
+            this._connectAuthRetried = false;
           };
           this._eventSource.addEventListener("endpoint", (event) => {
             const messageEvent = event;
@@ -25701,7 +25813,7 @@ var init_dist4 = __esm({
             body: JSON.stringify(message),
             signal: this._abortController?.signal
           };
-          const response = await (this._fetch ?? fetch)(this._endpoint, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._endpoint, init);
           if (!response.ok) {
             if (response.status === 401 && this._authProvider) {
               if (response.headers.has("www-authenticate")) {
@@ -25732,7 +25844,7 @@ var init_dist4 = __esm({
               throw markAuthSeamEscape(new UnauthorizedError());
             }
             const text = await response.text?.().catch(() => null);
-            throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${text}`);
+            throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${this._unfollowedRedirect(this._endpoint, response) ?? text}`);
           }
           await response.text?.().catch(() => {
           });
@@ -25772,6 +25884,7 @@ var init_dist4 = __esm({
       _skipIssuerMetadataValidation;
       _fetch;
       _fetchWithInit;
+      _redirectPolicy;
       _sessionId;
       _reconnectionOptions;
       _protocolVersion;
@@ -25802,7 +25915,9 @@ var init_dist4 = __esm({
           this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
           if (opts.authProvider.dpop) this._fetch = withDpopFromProvider(opts.authProvider)(opts.fetch ?? fetch);
         } else this._authProvider = opts?.authProvider;
+        this._redirectPolicy = opts?.redirectPolicy;
         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+        if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
         this._sessionId = opts?.sessionId;
         this._protocolVersion = opts?.protocolVersion;
         this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
@@ -25854,6 +25969,15 @@ var init_dist4 = __esm({
           skipIssuerMetadataValidation: this._skipIssuerMetadataValidation
         });
       }
+      /** `baseFetch` with redirects handled as `redirectPolicy` says. */
+      _redirects(baseFetch) {
+        return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+      }
+      /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+      _unfollowedRedirect(url2, response) {
+        const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url2, response);
+        return text && `${text} (redirectPolicy: 'same-origin')`;
+      }
       async _commonHeaders() {
         const headers = new Headers(this._requestInit?.headers || void 0);
         let token;
@@ -25905,7 +26029,7 @@ var init_dist4 = __esm({
           if (resumptionToken) headers.set("last-event-id", resumptionToken);
           const transportSignal = this._abortController?.signal;
           const signal = requestSignal !== void 0 && transportSignal !== void 0 ? anySignal(transportSignal, requestSignal) : requestSignal ?? transportSignal;
-          const response = await (this._fetch ?? fetch)(this._url, {
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, {
             ...this._requestInit,
             method: "GET",
             headers,
@@ -25960,7 +26084,8 @@ var init_dist4 = __esm({
               options.onRequestStreamEnd?.();
               return;
             }
-            throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${response.statusText}`, {
+            const reason = this._unfollowedRedirect(this._url, response) ?? response.statusText;
+            throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${reason}`, {
               status: response.status,
               statusText: response.statusText
             });
@@ -26149,7 +26274,7 @@ var init_dist4 = __esm({
             body: JSON.stringify(message),
             signal
           };
-          const response = await (this._fetch ?? fetch)(this._url, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
           if (isHandshake && response.ok) this._sessionId = response.headers.get("mcp-session-id") || void 0;
           if (!response.ok) {
             if (response.status === 401 && this._authProvider) {
@@ -26203,7 +26328,8 @@ var init_dist4 = __esm({
               }
             } catch {
             }
-            throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${text}`, {
+            const reason = this._unfollowedRedirect(this._url, response) ?? text;
+            throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${reason}`, {
               status: response.status,
               statusText: response.statusText,
               text
@@ -26263,10 +26389,10 @@ var init_dist4 = __esm({
             headers,
             signal: this._abortController?.signal
           };
-          const response = await (this._fetch ?? fetch)(this._url, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
           await response.text?.().catch(() => {
           });
-          if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${response.statusText}`, {
+          if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${this._unfollowedRedirect(this._url, response) ?? response.statusText}`, {
             status: response.status,
             statusText: response.statusText
           });
@@ -29575,7 +29701,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@prefecthq/fastmcp-ts",
-      version: "1.8.0",
+      version: "1.8.1",
       description: "\u{1F3CE}\uFE0F  The official FastMCP TypeScript library - build MCP servers and clients, fast \u{1F3CE}\uFE0F",
       type: "module",
       exports: {
@@ -29703,11 +29829,11 @@ var init_package = __esm({
       },
       dependencies: {
         "@clack/prompts": "^1.2.0",
-        "@modelcontextprotocol/client": "^2.0.0",
+        "@modelcontextprotocol/client": "^2.3.1",
         "@modelcontextprotocol/core": "^2.0.0",
         "@modelcontextprotocol/node": "^2.0.0",
-        "@modelcontextprotocol/server": "^2.0.0",
-        "@modelcontextprotocol/server-legacy": "^2.0.0",
+        "@modelcontextprotocol/server": "^2.3.1",
+        "@modelcontextprotocol/server-legacy": "^2.3.1",
         "@standard-schema/spec": "^1.1.0",
         "@types/express": "^5.0.6",
         chalk: "^5.6.2",
@@ -30274,7 +30400,7 @@ var import_node_process4, import_node_stream2, import_cross_spawn, DEFAULT_INHER
 var init_stdio = __esm({
   "node_modules/@modelcontextprotocol/client/dist/stdio.mjs"() {
     "use strict";
-    init_src_xKF0PJN();
+    init_src_WCy6ifGf();
     import_node_process4 = __toESM(require("process"), 1);
     import_node_stream2 = require("stream");
     import_cross_spawn = __toESM(require_cross_spawn(), 1);
@@ -33973,8 +34099,8 @@ var init_inspect = __esm({
               // only case Python's inspect supports); over --url/--command the
               // generation is unknowable from the wire.
               generation: mode.kind === "inprocess" ? 2 : null,
-              fastmcpVersion: "1.8.0",
-              mcpVersion: "2.0.0",
+              fastmcpVersion: "1.8.1",
+              mcpVersion: "2.3.1",
               tools: tools2,
               prompts: prompts2,
               resources: resources2,
@@ -47502,7 +47628,7 @@ init_format();
 var main = defineCommand({
   meta: {
     name: "fastmcp",
-    version: "1.8.0",
+    version: "1.8.1",
     description: "FastMCP CLI \u2014 build, run, and manage MCP servers"
   },
   args: {
@@ -47527,7 +47653,7 @@ var main = defineCommand({
 runMain(main);
 /*! Bundled license information:
 
-@modelcontextprotocol/client/dist/src-xKF0PJN-.mjs:
+@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson