fastmcp 4.13.0 → 4.14.0

package/dist/{chunk-U36NARZG.cjs → chunk-XK5NJ5W2.cjs}

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/FastMCP.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/FastMCP.ts
 var _indexjs = require('@modelcontextprotocol/sdk/server/index.js');
 var _stdiojs = require('@modelcontextprotocol/sdk/server/stdio.js');
 
@@ -355,6 +355,8 @@ function assertToolSchemas(tool) {
     assertStandardSchema(tool.name, "outputSchema", tool.outputSchema);
   }
 }
+var STREAM_KEEPALIVE_LOGGER = "fastmcp-keepalive";
+var STREAM_KEEPALIVE_DEFAULT_INTERVAL_MS = 2e4;
 var TextContentZodSchema = _zod.z.object({
   /**
    * The text content of the message.
@@ -483,6 +485,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    * instance — so capabilities can never be inferred here.
    */
   #stateless;
+  #streamKeepaliveConfig;
   /**
    * Resource URIs the connected client has subscribed to via
    * `resources/subscribe`. Used to scope `notifications/resources/updated`
@@ -503,6 +506,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     roots,
     sessionId,
     stateless = false,
+    streamKeepalive,
     tools,
     transportType,
     utils,
@@ -516,6 +520,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#rootsConfig = roots;
     this.#sessionId = sessionId;
     this.#stateless = stateless;
+    this.#streamKeepaliveConfig = streamKeepalive;
     this.#needsEventLoopFlush = transportType === "httpStream";
     if (tools.length) {
       this.#capabilities.tools = {};
@@ -843,6 +848,44 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
       logLevel: pingConfig.logLevel || "debug"
     };
   }
+  /**
+   * Periodically writes to the response stream of an in-flight tool call, so an
+   * idle-connection timeout (proxy, load balancer) does not close it while a
+   * long-running tool produces no output of its own.
+   *
+   * The notification is related to the tool call, so it travels on that
+   * request's own stream, which is the only server-to-client route that exists
+   * when running stateless.
+   *
+   * @returns a function that stops the keepalive.
+   */
+  #startStreamKeepalive(extra, toolName) {
+    const config = this.#streamKeepaliveConfig;
+    if (!_optionalChain([config, 'optionalAccess', _21 => _21.enabled])) {
+      return () => {
+      };
+    }
+    const intervalMs = config.intervalMs && config.intervalMs > 0 ? config.intervalMs : STREAM_KEEPALIVE_DEFAULT_INTERVAL_MS;
+    const timer = setInterval(() => {
+      extra.sendNotification({
+        method: "notifications/message",
+        params: {
+          data: { message: `keepalive while '${toolName}' is running` },
+          level: _nullishCoalesce(config.logLevel, () => ( "debug")),
+          logger: STREAM_KEEPALIVE_LOGGER
+        }
+      }).catch((error) => {
+        this.#logger.debug(
+          `[FastMCP debug] stream keepalive for '${toolName}' failed:`,
+          error instanceof Error ? error.message : String(error)
+        );
+      });
+    }, intervalMs);
+    _optionalChain([timer, 'access', _22 => _22.unref, 'optionalCall', _23 => _23()]);
+    const stop = () => clearInterval(timer);
+    _optionalChain([extra, 'access', _24 => _24.signal, 'optionalAccess', _25 => _25.addEventListener, 'call', _26 => _26("abort", stop, { once: true })]);
+    return stop;
+  }
   async #validateStructuredContent(tool, value, toolName) {
     if (!tool.outputSchema) {
       return value;
@@ -1037,7 +1080,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         result = await prompt.load(
           args,
           this.#auth,
-          this.#createLoadContext(_optionalChain([request, 'access', _21 => _21.params, 'optionalAccess', _22 => _22._meta]))
+          this.#createLoadContext(_optionalChain([request, 'access', _27 => _27.params, 'optionalAccess', _28 => _28._meta]))
         );
       } catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -1102,7 +1145,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               const result = await resourceTemplate.load(
                 match,
                 this.#auth,
-                this.#createLoadContext(_optionalChain([request, 'access', _23 => _23.params, 'optionalAccess', _24 => _24._meta]))
+                this.#createLoadContext(_optionalChain([request, 'access', _29 => _29.params, 'optionalAccess', _30 => _30._meta]))
               );
               const resources = Array.isArray(result) ? result : [result];
               return {
@@ -1127,7 +1170,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           try {
             maybeArrayResult = await resource.load(
               this.#auth,
-              this.#createLoadContext(_optionalChain([request, 'access', _25 => _25.params, 'optionalAccess', _26 => _26._meta]))
+              this.#createLoadContext(_optionalChain([request, 'access', _31 => _31.params, 'optionalAccess', _32 => _32._meta]))
             );
           } catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
@@ -1190,7 +1233,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     );
   }
   setupRootsHandlers() {
-    if (_optionalChain([this, 'access', _27 => _27.#rootsConfig, 'optionalAccess', _28 => _28.enabled]) === false) {
+    if (_optionalChain([this, 'access', _33 => _33.#rootsConfig, 'optionalAccess', _34 => _34.enabled]) === false) {
       this.#logger.debug(
         "[FastMCP debug] roots capability explicitly disabled via config"
       );
@@ -1260,169 +1303,178 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         tools: cachedToolsList
       };
     });
-    this.#server.setRequestHandler(_typesjs.CallToolRequestSchema, async (request) => {
-      const tool = toolsMap.get(request.params.name);
-      if (!tool) {
-        throw new (0, _typesjs.McpError)(
-          _typesjs.ErrorCode.MethodNotFound,
-          `Unknown tool: ${request.params.name}`
-        );
-      }
-      let args = void 0;
-      if (tool.parameters) {
-        const parsed = await tool.parameters["~standard"].validate(
-          request.params.arguments
-        );
-        if (parsed.issues) {
-          const friendlyErrors = this.#formatSchemaIssues(parsed.issues);
+    this.#server.setRequestHandler(
+      _typesjs.CallToolRequestSchema,
+      async (request, extra) => {
+        const tool = toolsMap.get(request.params.name);
+        if (!tool) {
           throw new (0, _typesjs.McpError)(
-            _typesjs.ErrorCode.InvalidParams,
-            `Tool '${request.params.name}' parameter validation failed: ${friendlyErrors}. Please check the parameter types and values according to the tool's schema.`
+            _typesjs.ErrorCode.MethodNotFound,
+            `Unknown tool: ${request.params.name}`
           );
         }
-        args = parsed.value;
-      }
-      const progressToken = _optionalChain([request, 'access', _29 => _29.params, 'optionalAccess', _30 => _30._meta, 'optionalAccess', _31 => _31.progressToken]);
-      let result;
-      try {
-        const reportProgress = async (progress) => {
-          if (progressToken === void 0) {
-            return;
+        let args = void 0;
+        if (tool.parameters) {
+          const parsed = await tool.parameters["~standard"].validate(
+            request.params.arguments
+          );
+          if (parsed.issues) {
+            const friendlyErrors = this.#formatSchemaIssues(parsed.issues);
+            throw new (0, _typesjs.McpError)(
+              _typesjs.ErrorCode.InvalidParams,
+              `Tool '${request.params.name}' parameter validation failed: ${friendlyErrors}. Please check the parameter types and values according to the tool's schema.`
+            );
           }
-          try {
-            await this.#server.notification({
-              method: "notifications/progress",
-              params: {
-                ...progress,
-                progressToken
+          args = parsed.value;
+        }
+        const progressToken = _optionalChain([request, 'access', _35 => _35.params, 'optionalAccess', _36 => _36._meta, 'optionalAccess', _37 => _37.progressToken]);
+        let result;
+        try {
+          const reportProgress = async (progress) => {
+            if (progressToken === void 0) {
+              return;
+            }
+            try {
+              await this.#server.notification({
+                method: "notifications/progress",
+                params: {
+                  ...progress,
+                  progressToken
+                }
+              });
+              if (this.#needsEventLoopFlush) {
+                await new Promise((resolve) => setImmediate(resolve));
               }
-            });
-            if (this.#needsEventLoopFlush) {
-              await new Promise((resolve) => setImmediate(resolve));
+            } catch (progressError) {
+              this.#logger.warn(
+                `[FastMCP warning] Failed to report progress for tool '${request.params.name}':`,
+                progressError instanceof Error ? progressError.message : String(progressError)
+              );
             }
-          } catch (progressError) {
-            this.#logger.warn(
-              `[FastMCP warning] Failed to report progress for tool '${request.params.name}':`,
-              progressError instanceof Error ? progressError.message : String(progressError)
-            );
-          }
-        };
-        const log = this.#createLog();
-        const streamContent = async (content) => {
-          const contentArray = Array.isArray(content) ? content : [content];
-          try {
-            await this.#server.notification({
-              method: "notifications/tool/streamContent",
-              params: {
-                content: contentArray,
-                toolName: request.params.name
+          };
+          const log = this.#createLog();
+          const streamContent = async (content) => {
+            const contentArray = Array.isArray(content) ? content : [content];
+            try {
+              await this.#server.notification({
+                method: "notifications/tool/streamContent",
+                params: {
+                  content: contentArray,
+                  toolName: request.params.name
+                }
+              });
+              if (this.#needsEventLoopFlush) {
+                await new Promise((resolve) => setImmediate(resolve));
               }
-            });
-            if (this.#needsEventLoopFlush) {
-              await new Promise((resolve) => setImmediate(resolve));
+            } catch (streamError) {
+              this.#logger.warn(
+                `[FastMCP warning] Failed to stream content for tool '${request.params.name}':`,
+                streamError instanceof Error ? streamError.message : String(streamError)
+              );
             }
-          } catch (streamError) {
-            this.#logger.warn(
-              `[FastMCP warning] Failed to stream content for tool '${request.params.name}':`,
-              streamError instanceof Error ? streamError.message : String(streamError)
-            );
+          };
+          if (this.#onToolCall) {
+            await this.#onToolCall({
+              arguments: _nullishCoalesce(args, () => ( {})),
+              toolName: request.params.name
+            });
           }
-        };
-        if (this.#onToolCall) {
-          await this.#onToolCall({
-            arguments: _nullishCoalesce(args, () => ( {})),
-            toolName: request.params.name
-          });
-        }
-        const executeToolPromise = tool.execute(args, {
-          client: {
-            version: this.#server.getClientVersion()
-          },
-          elicit: (params, options) => this.#server.elicitInput(params, options),
-          log,
-          reportProgress,
-          requestId: typeof _optionalChain([request, 'access', _32 => _32.params, 'optionalAccess', _33 => _33._meta, 'optionalAccess', _34 => _34.requestId]) === "string" ? request.params._meta.requestId : void 0,
-          session: this.#auth,
-          sessionId: this.#sessionId,
-          streamContent
-        });
-        const maybeStringResult = await (tool.timeoutMs ? Promise.race([
-          executeToolPromise,
-          new Promise((_, reject) => {
-            const timeoutId = setTimeout(() => {
-              reject(
-                new UserError(
-                  `Tool '${request.params.name}' timed out after ${tool.timeoutMs}ms. Consider increasing timeoutMs or optimizing the tool implementation.`
-                )
+          const executeToolPromise = Promise.resolve(
+            tool.execute(args, {
+              client: {
+                version: this.#server.getClientVersion()
+              },
+              elicit: (params, options) => this.#server.elicitInput(params, options),
+              log,
+              reportProgress,
+              requestId: typeof _optionalChain([request, 'access', _38 => _38.params, 'optionalAccess', _39 => _39._meta, 'optionalAccess', _40 => _40.requestId]) === "string" ? request.params._meta.requestId : void 0,
+              session: this.#auth,
+              sessionId: this.#sessionId,
+              streamContent
+            })
+          );
+          const stopStreamKeepalive = this.#startStreamKeepalive(
+            extra,
+            request.params.name
+          );
+          const maybeStringResult = await (tool.timeoutMs ? Promise.race([
+            executeToolPromise,
+            new Promise((_, reject) => {
+              const timeoutId = setTimeout(() => {
+                reject(
+                  new UserError(
+                    `Tool '${request.params.name}' timed out after ${tool.timeoutMs}ms. Consider increasing timeoutMs or optimizing the tool implementation.`
+                  )
+                );
+              }, tool.timeoutMs);
+              executeToolPromise.then(
+                () => clearTimeout(timeoutId),
+                () => clearTimeout(timeoutId)
               );
-            }, tool.timeoutMs);
-            executeToolPromise.then(
-              () => clearTimeout(timeoutId),
-              () => clearTimeout(timeoutId)
-            );
-          })
-        ]) : executeToolPromise);
-        await _promises3.setTimeout.call(void 0, 1);
-        if (maybeStringResult === void 0 || maybeStringResult === null) {
-          result = ContentResultZodSchema.parse({
-            content: []
-          });
-        } else if (typeof maybeStringResult === "string") {
-          result = ContentResultZodSchema.parse({
-            content: [{ text: maybeStringResult, type: "text" }]
-          });
-        } else if ("type" in maybeStringResult) {
-          result = ContentResultZodSchema.parse({
-            content: [maybeStringResult]
-          });
-        } else if ("content" in maybeStringResult) {
-          result = ContentResultZodSchema.parse(maybeStringResult);
-          if (result.structuredContent !== void 0 && tool.outputSchema) {
-            result.structuredContent = await this.#validateStructuredContent(
+            })
+          ]) : executeToolPromise).finally(stopStreamKeepalive);
+          await _promises3.setTimeout.call(void 0, 1);
+          if (maybeStringResult === void 0 || maybeStringResult === null) {
+            result = ContentResultZodSchema.parse({
+              content: []
+            });
+          } else if (typeof maybeStringResult === "string") {
+            result = ContentResultZodSchema.parse({
+              content: [{ text: maybeStringResult, type: "text" }]
+            });
+          } else if ("type" in maybeStringResult) {
+            result = ContentResultZodSchema.parse({
+              content: [maybeStringResult]
+            });
+          } else if ("content" in maybeStringResult) {
+            result = ContentResultZodSchema.parse(maybeStringResult);
+            if (result.structuredContent !== void 0 && tool.outputSchema) {
+              result.structuredContent = await this.#validateStructuredContent(
+                tool,
+                result.structuredContent,
+                request.params.name
+              );
+            }
+          } else if (tool.outputSchema) {
+            const structuredContent = await this.#validateStructuredContent(
               tool,
-              result.structuredContent,
+              maybeStringResult,
               request.params.name
             );
+            result = ContentResultZodSchema.parse({
+              content: [
+                {
+                  text: JSON.stringify(structuredContent),
+                  type: "text"
+                }
+              ],
+              structuredContent
+            });
+          } else {
+            result = ContentResultZodSchema.parse(maybeStringResult);
           }
-        } else if (tool.outputSchema) {
-          const structuredContent = await this.#validateStructuredContent(
-            tool,
-            maybeStringResult,
-            request.params.name
-          );
-          result = ContentResultZodSchema.parse({
+        } catch (error) {
+          if (error instanceof UserError) {
+            return {
+              content: [{ text: error.message, type: "text" }],
+              isError: true,
+              ...error.extras ? { structuredContent: error.extras } : {}
+            };
+          }
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          return {
             content: [
               {
-                text: JSON.stringify(structuredContent),
+                text: `Tool '${request.params.name}' execution failed: ${errorMessage}`,
                 type: "text"
               }
             ],
-            structuredContent
-          });
-        } else {
-          result = ContentResultZodSchema.parse(maybeStringResult);
-        }
-      } catch (error) {
-        if (error instanceof UserError) {
-          return {
-            content: [{ text: error.message, type: "text" }],
-            isError: true,
-            ...error.extras ? { structuredContent: error.extras } : {}
+            isError: true
           };
         }
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        return {
-          content: [
-            {
-              text: `Tool '${request.params.name}' execution failed: ${errorMessage}`,
-              type: "text"
-            }
-          ],
-          isError: true
-        };
+        return result;
       }
-      return result;
-    });
+    );
   }
 };
 function camelToSnakeCase(str) {
@@ -1451,7 +1503,7 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _35 => _35.match, 'call', _36 => _36(/^Basic\s+(.+)$/)]);
+  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _41 => _41.match, 'call', _42 => _42(/^Basic\s+(.+)$/)]);
   if (!basicMatch) return null;
   try {
     const credentials = Buffer.from(basicMatch[1], "base64").toString("utf-8");
@@ -1842,9 +1894,9 @@ var FastMCP = class extends FastMCPEventEmitter {
       let auth;
       if (this.#authenticate) {
         try {
-          auth = await this.#authenticate(
+          auth = await _asyncNullishCoalesce(await this.#authenticate(
             void 0
-          );
+          ), async () => ( void 0));
         } catch (error) {
           this.#logger.error(
             "[FastMCP error] Authentication failed for stdio transport:",
@@ -1863,6 +1915,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         resources: this.#resources,
         resourcesTemplates: this.#resourcesTemplates,
         roots: this.#options.roots,
+        streamKeepalive: this.#options.streamKeepalive,
         tools: this.#tools,
         transportType: "stdio",
         utils: this.#options.utils,
@@ -1922,12 +1975,9 @@ var FastMCP = class extends FastMCPEventEmitter {
           createServer: async (request) => {
             let auth;
             if (this.#authenticate) {
-              auth = await this.#authenticate(request);
-              if (auth === void 0 || auth === null) {
-                throw this.#createUnauthorizedResponse(
-                  "Authentication required"
-                );
-              }
+              auth = this.#requireAuthenticated(
+                await this.#authenticate(request)
+              );
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId, true);
@@ -1935,7 +1985,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ..._optionalChain([this, 'access', _37 => _37.#options, 'access', _38 => _38.oauth, 'optionalAccess', _39 => _39.enabled]) && _optionalChain([this, 'access', _40 => _40.#options, 'access', _41 => _41.oauth, 'access', _42 => _42.protectedResource, 'optionalAccess', _43 => _43.resource]) ? {
+          ..._optionalChain([this, 'access', _43 => _43.#options, 'access', _44 => _44.oauth, 'optionalAccess', _45 => _45.enabled]) && _optionalChain([this, 'access', _46 => _46.#options, 'access', _47 => _47.oauth, 'access', _48 => _48.protectedResource, 'optionalAccess', _49 => _49.resource]) ? {
             oauth: {
               protectedResource: {
                 resource: this.#options.oauth.protectedResource.resource
@@ -1974,7 +2024,9 @@ var FastMCP = class extends FastMCPEventEmitter {
           createServer: async (request) => {
             let auth;
             if (this.#authenticate) {
-              auth = await this.#authenticate(request);
+              auth = this.#requireAuthenticated(
+                await this.#authenticate(request)
+              );
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId);
@@ -1982,7 +2034,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ..._optionalChain([this, 'access', _44 => _44.#options, 'access', _45 => _45.oauth, 'optionalAccess', _46 => _46.enabled]) && _optionalChain([this, 'access', _47 => _47.#options, 'access', _48 => _48.oauth, 'access', _49 => _49.protectedResource, 'optionalAccess', _50 => _50.resource]) ? {
+          ..._optionalChain([this, 'access', _50 => _50.#options, 'access', _51 => _51.oauth, 'optionalAccess', _52 => _52.enabled]) && _optionalChain([this, 'access', _53 => _53.#options, 'access', _54 => _54.oauth, 'access', _55 => _55.protectedResource, 'optionalAccess', _56 => _56.resource]) ? {
             oauth: {
               protectedResource: {
                 resource: this.#options.oauth.protectedResource.resource
@@ -2063,6 +2115,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       roots: this.#options.roots,
       sessionId,
       stateless,
+      streamKeepalive: this.#options.streamKeepalive,
       tools: allowedTools,
       transportType: "httpStream",
       utils: this.#options.utils,
@@ -2084,7 +2137,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #createUnauthorizedResponse(message) {
     const oauth = this.#options.oauth;
-    const resource = _optionalChain([oauth, 'optionalAccess', _51 => _51.enabled]) ? _optionalChain([oauth, 'access', _52 => _52.protectedResource, 'optionalAccess', _53 => _53.resource]) : void 0;
+    const resource = _optionalChain([oauth, 'optionalAccess', _57 => _57.enabled]) ? _optionalChain([oauth, 'access', _58 => _58.protectedResource, 'optionalAccess', _59 => _59.resource]) : void 0;
     const wwwAuthenticateParts = [
       'error="invalid_token"',
       `error_description="${message.replace(/"/g, '\\"')}"`
@@ -2196,7 +2249,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
     const oauthConfig = this.#options.oauth;
-    if (_optionalChain([oauthConfig, 'optionalAccess', _54 => _54.enabled]) && req.method === "GET") {
+    if (_optionalChain([oauthConfig, 'optionalAccess', _60 => _60.enabled]) && req.method === "GET") {
       const url2 = new URL(req.url || "", `http://${host}`);
       const authorizationServerMetadataPath = joinPaths(
         "",
@@ -2230,8 +2283,8 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
       }
     }
-    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _55 => _55.proxy]);
-    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _56 => _56.enabled])) {
+    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _61 => _61.proxy]);
+    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _62 => _62.enabled])) {
       const url2 = new URL(req.url || "", `http://${host}`);
       const oauthPath = basePathRelativePath;
       try {
@@ -2284,7 +2337,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _57 => _57.toJSON, 'optionalCall', _58 => _58()]) || {
+                    _optionalChain([error, 'access', _63 => _63.toJSON, 'optionalCall', _64 => _64()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2311,7 +2364,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _59 => _59.toJSON, 'optionalCall', _60 => _60()]) || {
+                _optionalChain([error, 'access', _65 => _65.toJSON, 'optionalCall', _66 => _66()]) || {
                   error: "invalid_request"
                 }
               )
@@ -2333,7 +2386,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _61 => _61.toJSON, 'optionalCall', _62 => _62()]) || {
+                _optionalChain([error, 'access', _67 => _67.toJSON, 'optionalCall', _68 => _68()]) || {
                   error: "server_error"
                 }
               )
@@ -2402,7 +2455,7 @@ var FastMCP = class extends FastMCPEventEmitter {
               } catch (error) {
                 res.writeHead(400, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _63 => _63.toJSON, 'optionalCall', _64 => _64()]) || {
+                    _optionalChain([error, 'access', _69 => _69.toJSON, 'optionalCall', _70 => _70()]) || {
                       error: "server_error"
                     }
                   )
@@ -2460,8 +2513,8 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = _optionalChain([basicAuth, 'optionalAccess', _65 => _65.clientId]) || params.get("client_id") || "";
-                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _66 => _66.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
+                const clientId = _optionalChain([basicAuth, 'optionalAccess', _71 => _71.clientId]) || params.get("client_id") || "";
+                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _72 => _72.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -2491,7 +2544,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _67 => _67.toJSON, 'optionalCall', _68 => _68()]) || {
+                    _optionalChain([error, 'access', _73 => _73.toJSON, 'optionalCall', _74 => _74()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2562,23 +2615,23 @@ var FastMCP = class extends FastMCPEventEmitter {
     const envBasePath = process.env.FASTMCP_BASE_PATH;
     const envStateless = process.env.FASTMCP_STATELESS;
     const envHost = process.env.FASTMCP_HOST;
-    const transportType = _optionalChain([overrides, 'optionalAccess', _69 => _69.transportType]) || (transportArg === "http-stream" ? "httpStream" : transportArg) || envTransport || "stdio";
+    const transportType = _optionalChain([overrides, 'optionalAccess', _75 => _75.transportType]) || (transportArg === "http-stream" ? "httpStream" : transportArg) || envTransport || "stdio";
     if (transportType === "httpStream") {
       const port = parseInt(
-        _optionalChain([overrides, 'optionalAccess', _70 => _70.httpStream, 'optionalAccess', _71 => _71.port, 'optionalAccess', _72 => _72.toString, 'call', _73 => _73()]) || portArg || envPort || "8080"
+        _optionalChain([overrides, 'optionalAccess', _76 => _76.httpStream, 'optionalAccess', _77 => _77.port, 'optionalAccess', _78 => _78.toString, 'call', _79 => _79()]) || portArg || envPort || "8080"
       );
-      const host = _optionalChain([overrides, 'optionalAccess', _74 => _74.httpStream, 'optionalAccess', _75 => _75.host]) || hostArg || envHost || "localhost";
-      const endpoint = _optionalChain([overrides, 'optionalAccess', _76 => _76.httpStream, 'optionalAccess', _77 => _77.endpoint]) || endpointArg || envEndpoint || "/mcp";
+      const host = _optionalChain([overrides, 'optionalAccess', _80 => _80.httpStream, 'optionalAccess', _81 => _81.host]) || hostArg || envHost || "localhost";
+      const endpoint = _optionalChain([overrides, 'optionalAccess', _82 => _82.httpStream, 'optionalAccess', _83 => _83.endpoint]) || endpointArg || envEndpoint || "/mcp";
       const basePath = normalizeBasePath(
-        _optionalChain([overrides, 'optionalAccess', _78 => _78.httpStream, 'optionalAccess', _79 => _79.basePath]) || basePathArg || envBasePath
+        _optionalChain([overrides, 'optionalAccess', _84 => _84.httpStream, 'optionalAccess', _85 => _85.basePath]) || basePathArg || envBasePath
       );
-      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _80 => _80.httpStream, 'optionalAccess', _81 => _81.enableJsonResponse]) || false;
-      const stateless = _optionalChain([overrides, 'optionalAccess', _82 => _82.httpStream, 'optionalAccess', _83 => _83.stateless]) || statelessArg === "true" || envStateless === "true" || false;
-      const cors = _optionalChain([overrides, 'optionalAccess', _84 => _84.httpStream, 'optionalAccess', _85 => _85.cors]);
-      const eventStore = _optionalChain([overrides, 'optionalAccess', _86 => _86.httpStream, 'optionalAccess', _87 => _87.eventStore]);
-      const sslCa = _optionalChain([overrides, 'optionalAccess', _88 => _88.httpStream, 'optionalAccess', _89 => _89.sslCa]);
-      const sslCert = _optionalChain([overrides, 'optionalAccess', _90 => _90.httpStream, 'optionalAccess', _91 => _91.sslCert]);
-      const sslKey = _optionalChain([overrides, 'optionalAccess', _92 => _92.httpStream, 'optionalAccess', _93 => _93.sslKey]);
+      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _86 => _86.httpStream, 'optionalAccess', _87 => _87.enableJsonResponse]) || false;
+      const stateless = _optionalChain([overrides, 'optionalAccess', _88 => _88.httpStream, 'optionalAccess', _89 => _89.stateless]) || statelessArg === "true" || envStateless === "true" || false;
+      const cors = _optionalChain([overrides, 'optionalAccess', _90 => _90.httpStream, 'optionalAccess', _91 => _91.cors]);
+      const eventStore = _optionalChain([overrides, 'optionalAccess', _92 => _92.httpStream, 'optionalAccess', _93 => _93.eventStore]);
+      const sslCa = _optionalChain([overrides, 'optionalAccess', _94 => _94.httpStream, 'optionalAccess', _95 => _95.sslCa]);
+      const sslCert = _optionalChain([overrides, 'optionalAccess', _96 => _96.httpStream, 'optionalAccess', _97 => _97.sslCert]);
+      const sslKey = _optionalChain([overrides, 'optionalAccess', _98 => _98.httpStream, 'optionalAccess', _99 => _99.sslKey]);
       return {
         httpStream: {
           basePath,
@@ -2615,6 +2668,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       });
     }
   }
+  /**
+   * Rejects a failed authentication result before it can become a session.
+   *
+   * Authentication is REQUIRED whenever an `authenticate` function is
+   * configured. mcp-proxy gates the HTTP Stream endpoint before `createServer`
+   * runs, but it does not gate the SSE endpoint it serves at `/sse` by default:
+   * `handleSSERequest` never receives `authenticate`. Throwing here is what
+   * stops `/sse` from handing out a session — with access to every tool, since
+   * `#createSession` skips `canAccess` filtering when `auth` is falsy — to a
+   * client that `/mcp` would have answered with a 401.
+   *
+   * The falsy test matches mcp-proxy's own check so that both endpoints agree
+   * on what counts as a failed authentication. Returning a nullish value is the
+   * idiomatic way to signal failure, and is what the built-in OAuth
+   * `AuthProvider` does for a missing or invalid bearer token.
+   */
+  #requireAuthenticated(auth) {
+    if (!auth) {
+      throw this.#createUnauthorizedResponse("Authentication required");
+    }
+    return auth;
+  }
   /**
    * Notifies all sessions that the resources list has changed.
    */
@@ -2655,4 +2730,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-U36NARZG.cjs.map
+//# sourceMappingURL=chunk-XK5NJ5W2.cjs.map