fastmcp 4.17.0 → 4.17.1

package/dist/FastMCP.cjs

@@ -24,7 +24,7 @@ var _chunkSYZRGVQXcjs = require('./chunk-SYZRGVQX.cjs');
 
 
 
-var _chunkBL2SWQWPcjs = require('./chunk-BL2SWQWP.cjs');
+var _chunkE3HXGE2Ocjs = require('./chunk-E3HXGE2O.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkBL2SWQWPcjs = require('./chunk-BL2SWQWP.cjs');
 
 
 
-exports.AuthProvider = _chunkBL2SWQWPcjs.AuthProvider; exports.AzureProvider = _chunkBL2SWQWPcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkSYZRGVQXcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkSYZRGVQXcjs.FastMCP; exports.FastMCPError = _chunkSYZRGVQXcjs.FastMCPError; exports.FastMCPSession = _chunkSYZRGVQXcjs.FastMCPSession; exports.GitHubProvider = _chunkBL2SWQWPcjs.GitHubProvider; exports.GoogleProvider = _chunkBL2SWQWPcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkSYZRGVQXcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkBL2SWQWPcjs.OAuthProvider; exports.ServerState = _chunkSYZRGVQXcjs.ServerState; exports.SessionError = _chunkSYZRGVQXcjs.SessionError; exports.UnexpectedStateError = _chunkSYZRGVQXcjs.UnexpectedStateError; exports.UserError = _chunkSYZRGVQXcjs.UserError; exports.audioContent = _chunkSYZRGVQXcjs.audioContent; exports.getAuthSession = _chunkBL2SWQWPcjs.getAuthSession; exports.imageContent = _chunkSYZRGVQXcjs.imageContent; exports.jsonSchemaAdapter = _chunkSYZRGVQXcjs.jsonSchemaAdapter; exports.requireAll = _chunkBL2SWQWPcjs.requireAll; exports.requireAny = _chunkBL2SWQWPcjs.requireAny; exports.requireAuth = _chunkBL2SWQWPcjs.requireAuth; exports.requireRole = _chunkBL2SWQWPcjs.requireRole; exports.requireScopes = _chunkBL2SWQWPcjs.requireScopes;
+exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkSYZRGVQXcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkSYZRGVQXcjs.FastMCP; exports.FastMCPError = _chunkSYZRGVQXcjs.FastMCPError; exports.FastMCPSession = _chunkSYZRGVQXcjs.FastMCPSession; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkSYZRGVQXcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.ServerState = _chunkSYZRGVQXcjs.ServerState; exports.SessionError = _chunkSYZRGVQXcjs.SessionError; exports.UnexpectedStateError = _chunkSYZRGVQXcjs.UnexpectedStateError; exports.UserError = _chunkSYZRGVQXcjs.UserError; exports.audioContent = _chunkSYZRGVQXcjs.audioContent; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.imageContent = _chunkSYZRGVQXcjs.imageContent; exports.jsonSchemaAdapter = _chunkSYZRGVQXcjs.jsonSchemaAdapter; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BWezdrAA.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BWezdrAA.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Dy1PbWAT.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Dy1PbWAT.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BWezdrAA.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BWezdrAA.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Dy1PbWAT.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Dy1PbWAT.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-UKKIJDLP.js";
+} from "./chunk-KWRV7CHJ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-BWezdrAA.d.cts → OAuthProvider-Dy1PbWAT.d.cts}

@@ -354,6 +354,13 @@ interface ProxyDCRClient {
     redirectUris: string[];
     /** Client registration timestamp */
     registeredAt: Date;
+    /**
+     * How this client came to be known, when that changes the rules applied to
+     * it. `"cimd"` marks a public client whose identity is a URL anyone can
+     * name and which holds no secret, so the proxy requires S256 PKCE from it.
+     * Absent for a Dynamic Client Registration.
+     */
+    source?: "cimd";
 }
 /**
  * OAuth refresh token request

package/dist/{OAuthProvider-BWezdrAA.d.ts → OAuthProvider-Dy1PbWAT.d.ts}

@@ -354,6 +354,13 @@ interface ProxyDCRClient {
     redirectUris: string[];
     /** Client registration timestamp */
     registeredAt: Date;
+    /**
+     * How this client came to be known, when that changes the rules applied to
+     * it. `"cimd"` marks a public client whose identity is a URL anyone can
+     * name and which holds no secret, so the proxy requires S256 PKCE from it.
+     * Absent for a Dynamic Client Registration.
+     */
+    source?: "cimd";
 }
 /**
  * OAuth refresh token request

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkBL2SWQWPcjs = require('../chunk-BL2SWQWP.cjs');
+var _chunkE3HXGE2Ocjs = require('../chunk-E3HXGE2O.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkBL2SWQWPcjs = require('../chunk-BL2SWQWP.cjs');
 
 
 
-exports.AuthProvider = _chunkBL2SWQWPcjs.AuthProvider; exports.AzureProvider = _chunkBL2SWQWPcjs.AzureProvider; exports.ConsentManager = _chunkBL2SWQWPcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkBL2SWQWPcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkBL2SWQWPcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkBL2SWQWPcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkBL2SWQWPcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkBL2SWQWPcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkBL2SWQWPcjs.DiskStore; exports.EncryptedTokenStorage = _chunkBL2SWQWPcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkBL2SWQWPcjs.GitHubProvider; exports.GoogleProvider = _chunkBL2SWQWPcjs.GoogleProvider; exports.JWKSVerifier = _chunkBL2SWQWPcjs.JWKSVerifier; exports.JWTIssuer = _chunkBL2SWQWPcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkBL2SWQWPcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkBL2SWQWPcjs.OAuthProvider; exports.OAuthProxy = _chunkBL2SWQWPcjs.OAuthProxy; exports.OAuthProxyError = _chunkBL2SWQWPcjs.OAuthProxyError; exports.PKCEUtils = _chunkBL2SWQWPcjs.PKCEUtils; exports.getAuthSession = _chunkBL2SWQWPcjs.getAuthSession; exports.requireAll = _chunkBL2SWQWPcjs.requireAll; exports.requireAny = _chunkBL2SWQWPcjs.requireAny; exports.requireAuth = _chunkBL2SWQWPcjs.requireAuth; exports.requireRole = _chunkBL2SWQWPcjs.requireRole; exports.requireScopes = _chunkBL2SWQWPcjs.requireScopes;
+exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.ConsentManager = _chunkE3HXGE2Ocjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkE3HXGE2Ocjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkE3HXGE2Ocjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkE3HXGE2Ocjs.DiskStore; exports.EncryptedTokenStorage = _chunkE3HXGE2Ocjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.JWKSVerifier = _chunkE3HXGE2Ocjs.JWKSVerifier; exports.JWTIssuer = _chunkE3HXGE2Ocjs.JWTIssuer; exports.MemoryTokenStorage = _chunkE3HXGE2Ocjs.MemoryTokenStorage; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.OAuthProxy = _chunkE3HXGE2Ocjs.OAuthProxy; exports.OAuthProxyError = _chunkE3HXGE2Ocjs.OAuthProxyError; exports.PKCEUtils = _chunkE3HXGE2Ocjs.PKCEUtils; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BWezdrAA.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BWezdrAA.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Dy1PbWAT.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Dy1PbWAT.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BWezdrAA.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BWezdrAA.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Dy1PbWAT.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Dy1PbWAT.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-UKKIJDLP.js";
+} from "../chunk-KWRV7CHJ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-BL2SWQWP.cjs → chunk-E3HXGE2O.cjs}

@@ -75,7 +75,8 @@ var proxyDcrClientStorageSchema = _zod.z.object({
   expiresAt: storedDateSchema.optional(),
   metadata: dcrClientMetadataSchema.optional(),
   redirectUris: _zod.z.array(_zod.z.string()),
-  registeredAt: storedDateSchema
+  registeredAt: storedDateSchema,
+  source: _zod.z.literal("cimd").optional()
 });
 var upstreamTokenSetStorageSchema = _zod.z.object({
   accessToken: _zod.z.string(),
@@ -356,7 +357,8 @@ async function resolveCimdClient(clientId, requestedRedirectUri, validateRedirec
     expiresAt: new Date(Date.now() + CIMD_CLIENT_TTL_MS),
     metadata,
     redirectUris,
-    registeredAt: /* @__PURE__ */ new Date()
+    registeredAt: /* @__PURE__ */ new Date(),
+    source: "cimd"
   };
 }
 function expandIPv6(host) {
@@ -1427,6 +1429,20 @@ var OAuthProxy = (_class4 = class {
         "code_challenge_method 'plain' is not supported; use S256"
       );
     }
+    if (registeredClient.source === "cimd") {
+      if (!params.code_challenge) {
+        throw new OAuthProxyError(
+          "invalid_request",
+          "code_challenge is required for Client ID Metadata Document clients"
+        );
+      }
+      if (params.code_challenge_method !== "S256") {
+        throw new OAuthProxyError(
+          "invalid_request",
+          "code_challenge_method must be S256 for Client ID Metadata Document clients"
+        );
+      }
+    }
     const transaction = await this.createTransaction(params);
     if (this.config.consentRequired && !transaction.consentGiven) {
       return this.consentManager.createConsentResponse(
@@ -1479,6 +1495,12 @@ var OAuthProxy = (_class4 = class {
     if (clientCode.clientId !== request.client_id) {
       throw new OAuthProxyError("invalid_client", "Client ID mismatch");
     }
+    if (registeredClient.source === "cimd" && !clientCode.codeChallenge) {
+      throw new OAuthProxyError(
+        "invalid_grant",
+        "PKCE is required for Client ID Metadata Document clients"
+      );
+    }
     if (clientCode.codeChallenge) {
       if (!request.code_verifier) {
         throw new OAuthProxyError(
@@ -3054,4 +3076,4 @@ Original error: ${error.message}`
 
 
 exports.getAuthSession = getAuthSession; exports.requireAll = requireAll; exports.requireAny = requireAny; exports.requireAuth = requireAuth; exports.requireRole = requireRole; exports.requireScopes = requireScopes; exports.DEFAULT_ACCESS_TOKEN_TTL = DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_REFRESH_TOKEN_TTL = DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_AUTHORIZATION_CODE_TTL = DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_TRANSACTION_TTL = DEFAULT_TRANSACTION_TTL; exports.ConsentManager = ConsentManager; exports.JWTIssuer = JWTIssuer; exports.PKCEUtils = PKCEUtils; exports.EncryptedTokenStorage = EncryptedTokenStorage; exports.MemoryTokenStorage = MemoryTokenStorage; exports.OAuthProxy = OAuthProxy; exports.OAuthProxyError = OAuthProxyError; exports.AuthProvider = AuthProvider; exports.AzureProvider = AzureProvider; exports.GitHubProvider = GitHubProvider; exports.GoogleProvider = GoogleProvider; exports.OAuthProvider = OAuthProvider; exports.DiskStore = DiskStore; exports.JWKSVerifier = JWKSVerifier;
-//# sourceMappingURL=chunk-BL2SWQWP.cjs.map
+//# sourceMappingURL=chunk-E3HXGE2O.cjs.map