fastmcp 4.19.1 → 4.20.1

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkKGXPEC7Jcjs = require('./chunk-KGXPEC7J.cjs');
+var _chunkTMDXVX4Lcjs = require('./chunk-TMDXVX4L.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkYO76IUZ6cjs = require('./chunk-YO76IUZ6.cjs');
 
 
 
-exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkKGXPEC7Jcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkKGXPEC7Jcjs.FastMCP; exports.FastMCPError = _chunkKGXPEC7Jcjs.FastMCPError; exports.FastMCPSession = _chunkKGXPEC7Jcjs.FastMCPSession; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkKGXPEC7Jcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.ServerState = _chunkKGXPEC7Jcjs.ServerState; exports.SessionError = _chunkKGXPEC7Jcjs.SessionError; exports.UnexpectedStateError = _chunkKGXPEC7Jcjs.UnexpectedStateError; exports.UserError = _chunkKGXPEC7Jcjs.UserError; exports.audioContent = _chunkKGXPEC7Jcjs.audioContent; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.imageContent = _chunkKGXPEC7Jcjs.imageContent; exports.jsonSchemaAdapter = _chunkKGXPEC7Jcjs.jsonSchemaAdapter; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
+exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkTMDXVX4Lcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkTMDXVX4Lcjs.FastMCP; exports.FastMCPError = _chunkTMDXVX4Lcjs.FastMCPError; exports.FastMCPSession = _chunkTMDXVX4Lcjs.FastMCPSession; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkTMDXVX4Lcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.ServerState = _chunkTMDXVX4Lcjs.ServerState; exports.SessionError = _chunkTMDXVX4Lcjs.SessionError; exports.UnexpectedStateError = _chunkTMDXVX4Lcjs.UnexpectedStateError; exports.UserError = _chunkTMDXVX4Lcjs.UserError; exports.audioContent = _chunkTMDXVX4Lcjs.audioContent; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.imageContent = _chunkTMDXVX4Lcjs.imageContent; exports.jsonSchemaAdapter = _chunkTMDXVX4Lcjs.jsonSchemaAdapter; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-XJWV6G5Q.js";
+} from "./chunk-RGV6FTGL.js";
 import {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-XJWV6G5Q.js → chunk-RGV6FTGL.js}

@@ -2097,13 +2097,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ...this.#options.oauth?.enabled && this.#options.oauth.protectedResource?.resource ? {
-            oauth: {
-              protectedResource: {
-                resource: this.#options.oauth.protectedResource.resource
-              }
-            }
-          } : {},
+          ...this.#httpStreamOAuthConfig(),
           // In stateless mode, we don't track sessions
           onClose: async () => {
           },
@@ -2145,13 +2139,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ...this.#options.oauth?.enabled && this.#options.oauth.protectedResource?.resource ? {
-            oauth: {
-              protectedResource: {
-                resource: this.#options.oauth.protectedResource.resource
-              }
-            }
-          } : {},
+          ...this.#httpStreamOAuthConfig(),
           onClose: async (session) => {
             const sessionIndex = this.#sessions.indexOf(session);
             if (sessionIndex !== -1) this.#sessions.splice(sessionIndex, 1);
@@ -2690,6 +2678,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
   };
+  /**
+   * mcp-proxy only emits `WWW-Authenticate` on 401 when `oauth` is set.
+   * Custom `authenticate()` still needs that challenge with no OAuth metadata
+   * configured (RFC 7235). Pass an empty oauth object in that case so the
+   * header is present without advertising a resource_metadata URL that 404s.
+   */
+  #httpStreamOAuthConfig() {
+    const resource = this.#options.oauth?.enabled ? this.#options.oauth.protectedResource?.resource : void 0;
+    if (resource) {
+      return {
+        oauth: {
+          protectedResource: {
+            resource
+          }
+        }
+      };
+    }
+    if (this.#authenticate) {
+      return { oauth: {} };
+    }
+    return {};
+  }
   /**
    * On `httpStream`, `authenticate` is handed to both mcp-proxy (which calls it
    * once per request to gate the 401) and this server's own `createServer`
@@ -2892,4 +2902,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-XJWV6G5Q.js.map
+//# sourceMappingURL=chunk-RGV6FTGL.js.map