fastmcp 4.19.0 → 4.20.0

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkSYZRGVQXcjs = require('./chunk-SYZRGVQX.cjs');
+var _chunkKGXPEC7Jcjs = require('./chunk-KGXPEC7J.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkSYZRGVQXcjs = require('./chunk-SYZRGVQX.cjs');
 
 
 
-var _chunkE3HXGE2Ocjs = require('./chunk-E3HXGE2O.cjs');
+var _chunkYO76IUZ6cjs = require('./chunk-YO76IUZ6.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkE3HXGE2Ocjs = require('./chunk-E3HXGE2O.cjs');
 
 
 
-exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkSYZRGVQXcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkSYZRGVQXcjs.FastMCP; exports.FastMCPError = _chunkSYZRGVQXcjs.FastMCPError; exports.FastMCPSession = _chunkSYZRGVQXcjs.FastMCPSession; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkSYZRGVQXcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.ServerState = _chunkSYZRGVQXcjs.ServerState; exports.SessionError = _chunkSYZRGVQXcjs.SessionError; exports.UnexpectedStateError = _chunkSYZRGVQXcjs.UnexpectedStateError; exports.UserError = _chunkSYZRGVQXcjs.UserError; exports.audioContent = _chunkSYZRGVQXcjs.audioContent; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.imageContent = _chunkSYZRGVQXcjs.imageContent; exports.jsonSchemaAdapter = _chunkSYZRGVQXcjs.jsonSchemaAdapter; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
+exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkKGXPEC7Jcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkKGXPEC7Jcjs.FastMCP; exports.FastMCPError = _chunkKGXPEC7Jcjs.FastMCPError; exports.FastMCPSession = _chunkKGXPEC7Jcjs.FastMCPSession; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkKGXPEC7Jcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.ServerState = _chunkKGXPEC7Jcjs.ServerState; exports.SessionError = _chunkKGXPEC7Jcjs.SessionError; exports.UnexpectedStateError = _chunkKGXPEC7Jcjs.UnexpectedStateError; exports.UserError = _chunkKGXPEC7Jcjs.UserError; exports.audioContent = _chunkKGXPEC7Jcjs.audioContent; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.imageContent = _chunkKGXPEC7Jcjs.imageContent; exports.jsonSchemaAdapter = _chunkKGXPEC7Jcjs.jsonSchemaAdapter; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-UODI5E6U.js";
+} from "./chunk-XJWV6G5Q.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-KWRV7CHJ.js";
+} from "./chunk-LRXZYGFR.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkE3HXGE2Ocjs = require('../chunk-E3HXGE2O.cjs');
+var _chunkYO76IUZ6cjs = require('../chunk-YO76IUZ6.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkE3HXGE2Ocjs = require('../chunk-E3HXGE2O.cjs');
 
 
 
-exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.ConsentManager = _chunkE3HXGE2Ocjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkE3HXGE2Ocjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkE3HXGE2Ocjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkE3HXGE2Ocjs.DiskStore; exports.EncryptedTokenStorage = _chunkE3HXGE2Ocjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.JWKSVerifier = _chunkE3HXGE2Ocjs.JWKSVerifier; exports.JWTIssuer = _chunkE3HXGE2Ocjs.JWTIssuer; exports.MemoryTokenStorage = _chunkE3HXGE2Ocjs.MemoryTokenStorage; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.OAuthProxy = _chunkE3HXGE2Ocjs.OAuthProxy; exports.OAuthProxyError = _chunkE3HXGE2Ocjs.OAuthProxyError; exports.PKCEUtils = _chunkE3HXGE2Ocjs.PKCEUtils; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
+exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.ConsentManager = _chunkYO76IUZ6cjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkYO76IUZ6cjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkYO76IUZ6cjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkYO76IUZ6cjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkYO76IUZ6cjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkYO76IUZ6cjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkYO76IUZ6cjs.DiskStore; exports.EncryptedTokenStorage = _chunkYO76IUZ6cjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.JWKSVerifier = _chunkYO76IUZ6cjs.JWKSVerifier; exports.JWTIssuer = _chunkYO76IUZ6cjs.JWTIssuer; exports.MemoryTokenStorage = _chunkYO76IUZ6cjs.MemoryTokenStorage; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.OAuthProxy = _chunkYO76IUZ6cjs.OAuthProxy; exports.OAuthProxyError = _chunkYO76IUZ6cjs.OAuthProxyError; exports.PKCEUtils = _chunkYO76IUZ6cjs.PKCEUtils; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-KWRV7CHJ.js";
+} from "../chunk-LRXZYGFR.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-SYZRGVQX.cjs → chunk-KGXPEC7J.cjs}

@@ -1,4 +1,8 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/FastMCP.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkYO76IUZ6cjs = require('./chunk-YO76IUZ6.cjs');
+
+// src/FastMCP.ts
 var _indexjs = require('@modelcontextprotocol/sdk/server/index.js');
 var _stdiojs = require('@modelcontextprotocol/sdk/server/stdio.js');
 
@@ -27,17 +31,6 @@ var _uritemplates = require('uri-templates'); var _uritemplates2 = _interopRequi
 var _xsschema = require('xsschema');
 var _zod = require('zod');
 
-// src/cancelResponseBody.ts
-var cancelResponseBody = async (response) => {
-  if (!response.body) {
-    return;
-  }
-  try {
-    await response.body.cancel();
-  } catch (e2) {
-  }
-};
-
 // src/DiscoveryDocumentCache.ts
 var DiscoveryDocumentCache = class {
   get size() {
@@ -138,7 +131,7 @@ var DiscoveryDocumentCache = class {
       throw error;
     }
     if (!res.ok) {
-      await cancelResponseBody(res);
+      await _chunkYO76IUZ6cjs.cancelResponseBody.call(void 0, res);
       throw new Error(
         `Failed to fetch discovery document from ${url}: ${res.status} ${res.statusText}`
       );
@@ -187,7 +180,7 @@ async function compileSchema(schema) {
   let ajvModule;
   try {
     ajvModule = await Promise.resolve().then(() => _interopRequireWildcard(require("ajv")));
-  } catch (e3) {
+  } catch (e2) {
     throw new Error(
       'The "ajv" package is required to validate JSON Schema tool parameters. Install it with: npm install ajv'
     );
@@ -200,7 +193,7 @@ async function compileSchema(schema) {
       unwrapDefault(formatsModule)
     );
     addFormats(ajv);
-  } catch (e4) {
+  } catch (e3) {
   }
   return ajv.compile(schema);
 }
@@ -234,7 +227,7 @@ var imageContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await cancelResponseBody(response);
+          await _chunkYO76IUZ6cjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -296,7 +289,7 @@ var audioContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await cancelResponseBody(response);
+          await _chunkYO76IUZ6cjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -708,7 +701,7 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
             this.#pingInFlight = true;
             try {
               await this.#server.ping();
-            } catch (e5) {
+            } catch (e4) {
               const logLevel = pingConfig.logLevel;
               if (logLevel === "debug") {
                 this.#logger.debug("[FastMCP debug] server ping failed");
@@ -1622,7 +1615,7 @@ function parseBasicAuthHeader(authHeader) {
     const credMatch = credentials.match(/^([^:]+):(.*)$/);
     if (!credMatch) return null;
     return { clientId: credMatch[1], clientSecret: credMatch[2] };
-  } catch (e6) {
+  } catch (e5) {
     return null;
   }
 }
@@ -2089,15 +2082,14 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
         );
+        const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await _mcpproxy.startHTTPServer.call(void 0, {
-          ...this.#authenticate ? { authenticate: this.#authenticate } : {},
+          ...authenticate ? { authenticate } : {},
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
-            if (this.#authenticate) {
-              auth = this.#requireAuthenticated(
-                await this.#authenticate(request)
-              );
+            if (authenticate) {
+              auth = this.#requireAuthenticated(await authenticate(request));
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId, true);
@@ -2138,15 +2130,14 @@ var FastMCP = class extends FastMCPEventEmitter {
           streamEndpoint
         });
       } else {
+        const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await _mcpproxy.startHTTPServer.call(void 0, {
-          ...this.#authenticate ? { authenticate: this.#authenticate } : {},
+          ...authenticate ? { authenticate } : {},
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
-            if (this.#authenticate) {
-              auth = this.#requireAuthenticated(
-                await this.#authenticate(request)
-              );
+            if (authenticate) {
+              auth = this.#requireAuthenticated(await authenticate(request));
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId);
@@ -2699,6 +2690,40 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
   };
+  /**
+   * On `httpStream`, `authenticate` is handed to both mcp-proxy (which calls it
+   * once per request to gate the 401) and this server's own `createServer`
+   * callback (which calls it again to obtain the session auth). Both receive
+   * the identical `IncomingMessage`, so a single request would otherwise be
+   * authenticated twice — halving the effective budget of any non-idempotent
+   * `authenticate` (see #352).
+   *
+   * This wraps `#authenticate` in a per-request memo keyed on the request
+   * object, collapsing the two calls into one real invocation. The *promise* is
+   * cached (not the resolved value) so a second call that arrives before the
+   * first settles joins it rather than starting a competing attempt. Keys are
+   * the request objects themselves, so each request is authenticated exactly
+   * once, a distinct request is authenticated afresh, and entries are collected
+   * with their requests — nothing leaks across requests. A rejected or nullish
+   * result is cached as-is, so a failed authentication is never seen as a
+   * success by the second caller.
+   */
+  #memoizedAuthenticate() {
+    const authenticate = this.#authenticate;
+    const cache = /* @__PURE__ */ new WeakMap();
+    return (request) => {
+      if (!request) {
+        return authenticate(request);
+      }
+      const cached = cache.get(request);
+      if (cached) {
+        return cached;
+      }
+      const result = Promise.resolve(authenticate(request));
+      cache.set(request, result);
+      return result;
+    };
+  }
   /**
    * Converts Node.js IncomingMessage to Web Request for Hono
    */
@@ -2867,4 +2892,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-SYZRGVQX.cjs.map
+//# sourceMappingURL=chunk-KGXPEC7J.cjs.map