fastmcp 4.12.6 → 4.12.8

package/README.md

@@ -2,9 +2,9 @@
 
 A TypeScript framework for building [MCP](https://glama.ai/mcp) servers capable of handling client sessions.
 
-> [!NOTE]
+> [!IMPORTANT]
 >
-> For a Python implementation, see [FastMCP](https://github.com/jlowin/fastmcp).
+> FastMCP implements the legacy, handshake-based MCP revisions (`2025-11-25` and earlier). It does not support the current specification, [`2026-07-28`](https://modelcontextprotocol.io/specification/2026-07-28/), which made the protocol stateless — no `initialize` handshake and no `Mcp-Session-Id`. For a framework targeting the current spec, use [ViteMCP](https://github.com/vitemcp/server).
 
 ## Features
 

package/dist/FastMCP.cjs

@@ -24,7 +24,7 @@ var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
-var _chunkRQ6222DUcjs = require('./chunk-RQ6222DU.cjs');
+var _chunkKMG3C24Zcjs = require('./chunk-KMG3C24Z.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkRQ6222DUcjs = require('./chunk-RQ6222DU.cjs');
 
 
 
-exports.AuthProvider = _chunkRQ6222DUcjs.AuthProvider; exports.AzureProvider = _chunkRQ6222DUcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkRQ6222DUcjs.GitHubProvider; exports.GoogleProvider = _chunkRQ6222DUcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkRQ6222DUcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkRQ6222DUcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkRQ6222DUcjs.requireAll; exports.requireAny = _chunkRQ6222DUcjs.requireAny; exports.requireAuth = _chunkRQ6222DUcjs.requireAuth; exports.requireRole = _chunkRQ6222DUcjs.requireRole; exports.requireScopes = _chunkRQ6222DUcjs.requireScopes;
+exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-SZ4XCW5X.js";
+} from "./chunk-Y7GSHCYB.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-B_OJFNC0.d.cts → OAuthProvider-zVRjvkf8.d.cts}

@@ -454,6 +454,14 @@ declare class OAuthProxy {
     private config;
     private consentManager;
     private jwtIssuer?;
+    /**
+     * The fallback storage this proxy created for itself, if any. It runs a
+     * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+     * it — and once the storage is wrapped for encryption it is reachable
+     * through nothing else. A caller-supplied storage is deliberately not
+     * recorded here: its lifetime belongs to the caller.
+     */
+    private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
      * for the defence-in-depth callback checks. A registration never changes

package/dist/{OAuthProvider-B_OJFNC0.d.ts → OAuthProvider-zVRjvkf8.d.ts}

@@ -454,6 +454,14 @@ declare class OAuthProxy {
     private config;
     private consentManager;
     private jwtIssuer?;
+    /**
+     * The fallback storage this proxy created for itself, if any. It runs a
+     * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+     * it — and once the storage is wrapped for encryption it is reachable
+     * through nothing else. A caller-supplied storage is deliberately not
+     * recorded here: its lifetime belongs to the caller.
+     */
+    private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
      * for the defence-in-depth callback checks. A registration never changes

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkRQ6222DUcjs = require('../chunk-RQ6222DU.cjs');
+var _chunkKMG3C24Zcjs = require('../chunk-KMG3C24Z.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkRQ6222DUcjs = require('../chunk-RQ6222DU.cjs');
 
 
 
-exports.AuthProvider = _chunkRQ6222DUcjs.AuthProvider; exports.AzureProvider = _chunkRQ6222DUcjs.AzureProvider; exports.ConsentManager = _chunkRQ6222DUcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkRQ6222DUcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkRQ6222DUcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkRQ6222DUcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkRQ6222DUcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkRQ6222DUcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkRQ6222DUcjs.DiskStore; exports.EncryptedTokenStorage = _chunkRQ6222DUcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkRQ6222DUcjs.GitHubProvider; exports.GoogleProvider = _chunkRQ6222DUcjs.GoogleProvider; exports.JWKSVerifier = _chunkRQ6222DUcjs.JWKSVerifier; exports.JWTIssuer = _chunkRQ6222DUcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkRQ6222DUcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkRQ6222DUcjs.OAuthProvider; exports.OAuthProxy = _chunkRQ6222DUcjs.OAuthProxy; exports.OAuthProxyError = _chunkRQ6222DUcjs.OAuthProxyError; exports.PKCEUtils = _chunkRQ6222DUcjs.PKCEUtils; exports.getAuthSession = _chunkRQ6222DUcjs.getAuthSession; exports.requireAll = _chunkRQ6222DUcjs.requireAll; exports.requireAny = _chunkRQ6222DUcjs.requireAny; exports.requireAuth = _chunkRQ6222DUcjs.requireAuth; exports.requireRole = _chunkRQ6222DUcjs.requireRole; exports.requireScopes = _chunkRQ6222DUcjs.requireScopes;
+exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.ConsentManager = _chunkKMG3C24Zcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkKMG3C24Zcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkKMG3C24Zcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkKMG3C24Zcjs.DiskStore; exports.EncryptedTokenStorage = _chunkKMG3C24Zcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.JWKSVerifier = _chunkKMG3C24Zcjs.JWKSVerifier; exports.JWTIssuer = _chunkKMG3C24Zcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkKMG3C24Zcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.OAuthProxy = _chunkKMG3C24Zcjs.OAuthProxy; exports.OAuthProxyError = _chunkKMG3C24Zcjs.OAuthProxyError; exports.PKCEUtils = _chunkKMG3C24Zcjs.PKCEUtils; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-SZ4XCW5X.js";
+} from "../chunk-Y7GSHCYB.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-RQ6222DU.cjs → chunk-KMG3C24Z.cjs}

@@ -938,11 +938,11 @@ var PKCEUtils = class _PKCEUtils {
       return false;
     }
     if (method === "plain") {
-      return verifier === challenge;
+      return equalsConstantTime(verifier, challenge);
     }
     if (method === "S256") {
       const computedChallenge = _PKCEUtils.generateChallenge(verifier, "S256");
-      return computedChallenge === challenge;
+      return equalsConstantTime(computedChallenge, challenge);
     }
     return false;
   }
@@ -955,6 +955,11 @@ var PKCEUtils = class _PKCEUtils {
     return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
   }
 };
+function equalsConstantTime(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
+}
 
 // src/auth/utils/tokenStore.ts
 
@@ -1135,16 +1140,24 @@ var OAuthProxy = (_class4 = class {
   
   
   
+  /**
+   * The fallback storage this proxy created for itself, if any. It runs a
+   * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+   * it — and once the storage is wrapped for encryption it is reachable
+   * through nothing else. A caller-supplied storage is deliberately not
+   * recorded here: its lifetime belongs to the caller.
+   */
+  __init7() {this.ownedTokenStorage = null}
   /**
    * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
    * for the defence-in-depth callback checks. A registration never changes
    * after it is written, so caching it locally cannot go stale; it is also
    * persisted, so another instance can hydrate it.
    */
-  __init7() {this.registeredClientsByClientId = /* @__PURE__ */ new Map()}
+  __init8() {this.registeredClientsByClientId = /* @__PURE__ */ new Map()}
   
   
-  constructor(config) {;_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);_class4.prototype.__init7.call(this);
+  constructor(config) {;_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);_class4.prototype.__init7.call(this);_class4.prototype.__init8.call(this);
     this.config = {
       authorizationCodeTtl: DEFAULT_AUTHORIZATION_CODE_TTL,
       consentRequired: true,
@@ -1156,7 +1169,11 @@ var OAuthProxy = (_class4 = class {
       upstreamTokenEndpointAuthMethod: "client_secret_basic",
       ...config
     };
-    let storage = config.tokenStorage || new MemoryTokenStorage();
+    let storage = config.tokenStorage;
+    if (!storage) {
+      this.ownedTokenStorage = new MemoryTokenStorage();
+      storage = this.ownedTokenStorage;
+    }
     const isAlreadyEncrypted = storage.constructor.name === "EncryptedTokenStorage";
     if (!isAlreadyEncrypted && config.encryptionKey !== false) {
       const encryptionKey = typeof config.encryptionKey === "string" ? config.encryptionKey : this.generateSigningKey();
@@ -1233,6 +1250,7 @@ var OAuthProxy = (_class4 = class {
       clearInterval(this.cleanupInterval);
       this.cleanupInterval = null;
     }
+    _optionalChain([this, 'access', _8 => _8.ownedTokenStorage, 'optionalAccess', _9 => _9.destroy, 'call', _10 => _10()]);
     this.registeredClientsByClientId.clear();
   }
   /**
@@ -1443,7 +1461,7 @@ var OAuthProxy = (_class4 = class {
       return null;
     }
     const result = await this.jwtIssuer.verify(fastmcpToken);
-    if (!result.valid || !_optionalChain([result, 'access', _8 => _8.claims, 'optionalAccess', _9 => _9.jti])) {
+    if (!result.valid || !_optionalChain([result, 'access', _11 => _11.claims, 'optionalAccess', _12 => _12.jti])) {
       return null;
     }
     const mapping = await this.tokenStorage.get(
@@ -1630,7 +1648,7 @@ var OAuthProxy = (_class4 = class {
       throw new Error("JWT issuer not initialized");
     }
     const result = await this.jwtIssuer.verify(token);
-    if (!result.valid || !_optionalChain([result, 'access', _10 => _10.claims, 'optionalAccess', _11 => _11.jti])) {
+    if (!result.valid || !_optionalChain([result, 'access', _13 => _13.claims, 'optionalAccess', _14 => _14.jti])) {
       throw new Error("Failed to extract JTI from token");
     }
     return result.claims.jti;
@@ -1798,7 +1816,7 @@ var OAuthProxy = (_class4 = class {
         "Invalid or expired refresh token"
       );
     }
-    const jti = _optionalChain([verifyResult, 'access', _12 => _12.claims, 'optionalAccess', _13 => _13.jti]);
+    const jti = _optionalChain([verifyResult, 'access', _15 => _15.claims, 'optionalAccess', _16 => _16.jti]);
     if (!jti) {
       throw new OAuthProxyError("invalid_grant", "Refresh token missing JTI");
     }
@@ -2247,7 +2265,7 @@ var AuthProvider = class {
     if (!request) {
       return void 0;
     }
-    const authHeader = _optionalChain([request, 'access', _14 => _14.headers, 'optionalAccess', _15 => _15.authorization]);
+    const authHeader = _optionalChain([request, 'access', _17 => _17.headers, 'optionalAccess', _18 => _18.authorization]);
     if (!authHeader || !authHeader.startsWith("Bearer ")) {
       return void 0;
     }
@@ -2448,10 +2466,10 @@ var OAuthProvider = class extends AuthProvider {
 var _promises = require('fs/promises');
 var _path = require('path');
 var DiskStore = (_class5 = class {
-  __init8() {this.cleanupInterval = null}
+  __init9() {this.cleanupInterval = null}
   
   
-  constructor(options) {;_class5.prototype.__init8.call(this);
+  constructor(options) {;_class5.prototype.__init9.call(this);
     this.directory = options.directory;
     this.fileExtension = options.fileExtension || ".json";
     void this.ensureDirectory();
@@ -2624,9 +2642,9 @@ var DiskStore = (_class5 = class {
 var JWKSVerifier = (_class6 = class {
   
   
-  __init9() {this.joseLoaded = false}
+  __init10() {this.joseLoaded = false}
   
-  constructor(config) {;_class6.prototype.__init9.call(this);
+  constructor(config) {;_class6.prototype.__init10.call(this);
     this.config = {
       cacheDuration: 36e5,
       // 1 hour
@@ -2784,4 +2802,4 @@ Original error: ${error.message}`
 
 
 exports.getAuthSession = getAuthSession; exports.requireAll = requireAll; exports.requireAny = requireAny; exports.requireAuth = requireAuth; exports.requireRole = requireRole; exports.requireScopes = requireScopes; exports.DEFAULT_ACCESS_TOKEN_TTL = DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_REFRESH_TOKEN_TTL = DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_AUTHORIZATION_CODE_TTL = DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_TRANSACTION_TTL = DEFAULT_TRANSACTION_TTL; exports.ConsentManager = ConsentManager; exports.JWTIssuer = JWTIssuer; exports.PKCEUtils = PKCEUtils; exports.EncryptedTokenStorage = EncryptedTokenStorage; exports.MemoryTokenStorage = MemoryTokenStorage; exports.OAuthProxy = OAuthProxy; exports.OAuthProxyError = OAuthProxyError; exports.AuthProvider = AuthProvider; exports.AzureProvider = AzureProvider; exports.GitHubProvider = GitHubProvider; exports.GoogleProvider = GoogleProvider; exports.OAuthProvider = OAuthProvider; exports.DiskStore = DiskStore; exports.JWKSVerifier = JWKSVerifier;
-//# sourceMappingURL=chunk-RQ6222DU.cjs.map
+//# sourceMappingURL=chunk-KMG3C24Z.cjs.map