fastmcp 4.20.0 → 4.20.1

package/dist/{chunk-KGXPEC7J.cjs → chunk-TMDXVX4L.cjs}

@@ -2097,13 +2097,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ..._optionalChain([this, 'access', _46 => _46.#options, 'access', _47 => _47.oauth, 'optionalAccess', _48 => _48.enabled]) && _optionalChain([this, 'access', _49 => _49.#options, 'access', _50 => _50.oauth, 'access', _51 => _51.protectedResource, 'optionalAccess', _52 => _52.resource]) ? {
-            oauth: {
-              protectedResource: {
-                resource: this.#options.oauth.protectedResource.resource
-              }
-            }
-          } : {},
+          ...this.#httpStreamOAuthConfig(),
           // In stateless mode, we don't track sessions
           onClose: async () => {
           },
@@ -2145,13 +2139,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           enableJsonResponse: httpConfig.enableJsonResponse,
           eventStore: httpConfig.eventStore,
           host: httpConfig.host,
-          ..._optionalChain([this, 'access', _53 => _53.#options, 'access', _54 => _54.oauth, 'optionalAccess', _55 => _55.enabled]) && _optionalChain([this, 'access', _56 => _56.#options, 'access', _57 => _57.oauth, 'access', _58 => _58.protectedResource, 'optionalAccess', _59 => _59.resource]) ? {
-            oauth: {
-              protectedResource: {
-                resource: this.#options.oauth.protectedResource.resource
-              }
-            }
-          } : {},
+          ...this.#httpStreamOAuthConfig(),
           onClose: async (session) => {
             const sessionIndex = this.#sessions.indexOf(session);
             if (sessionIndex !== -1) this.#sessions.splice(sessionIndex, 1);
@@ -2251,7 +2239,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #createUnauthorizedResponse(message) {
     const oauth = this.#options.oauth;
-    const resource = _optionalChain([oauth, 'optionalAccess', _60 => _60.enabled]) ? _optionalChain([oauth, 'access', _61 => _61.protectedResource, 'optionalAccess', _62 => _62.resource]) : void 0;
+    const resource = _optionalChain([oauth, 'optionalAccess', _46 => _46.enabled]) ? _optionalChain([oauth, 'access', _47 => _47.protectedResource, 'optionalAccess', _48 => _48.resource]) : void 0;
     const wwwAuthenticateParts = [
       'error="invalid_token"',
       `error_description="${message.replace(/"/g, '\\"')}"`
@@ -2377,7 +2365,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
     const oauthConfig = this.#options.oauth;
-    if (_optionalChain([oauthConfig, 'optionalAccess', _63 => _63.enabled]) && req.method === "GET") {
+    if (_optionalChain([oauthConfig, 'optionalAccess', _49 => _49.enabled]) && req.method === "GET") {
       const url2 = new URL(req.url || "", `http://${host}`);
       const authorizationServerMetadataPath = joinPaths(
         "",
@@ -2411,8 +2399,8 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
       }
     }
-    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _64 => _64.proxy]);
-    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _65 => _65.enabled])) {
+    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _50 => _50.proxy]);
+    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _51 => _51.enabled])) {
       const url2 = new URL(req.url || "", `http://${host}`);
       const oauthPath = basePathRelativePath;
       try {
@@ -2465,7 +2453,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _66 => _66.toJSON, 'optionalCall', _67 => _67()]) || {
+                    _optionalChain([error, 'access', _52 => _52.toJSON, 'optionalCall', _53 => _53()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2492,7 +2480,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _68 => _68.toJSON, 'optionalCall', _69 => _69()]) || {
+                _optionalChain([error, 'access', _54 => _54.toJSON, 'optionalCall', _55 => _55()]) || {
                   error: "invalid_request"
                 }
               )
@@ -2514,7 +2502,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _70 => _70.toJSON, 'optionalCall', _71 => _71()]) || {
+                _optionalChain([error, 'access', _56 => _56.toJSON, 'optionalCall', _57 => _57()]) || {
                   error: "server_error"
                 }
               )
@@ -2583,7 +2571,7 @@ var FastMCP = class extends FastMCPEventEmitter {
               } catch (error) {
                 res.writeHead(400, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _72 => _72.toJSON, 'optionalCall', _73 => _73()]) || {
+                    _optionalChain([error, 'access', _58 => _58.toJSON, 'optionalCall', _59 => _59()]) || {
                       error: "server_error"
                     }
                   )
@@ -2641,8 +2629,8 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = _optionalChain([basicAuth, 'optionalAccess', _74 => _74.clientId]) || params.get("client_id") || "";
-                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _75 => _75.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
+                const clientId = _optionalChain([basicAuth, 'optionalAccess', _60 => _60.clientId]) || params.get("client_id") || "";
+                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _61 => _61.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -2672,7 +2660,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _76 => _76.toJSON, 'optionalCall', _77 => _77()]) || {
+                    _optionalChain([error, 'access', _62 => _62.toJSON, 'optionalCall', _63 => _63()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2690,6 +2678,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
   };
+  /**
+   * mcp-proxy only emits `WWW-Authenticate` on 401 when `oauth` is set.
+   * Custom `authenticate()` still needs that challenge with no OAuth metadata
+   * configured (RFC 7235). Pass an empty oauth object in that case so the
+   * header is present without advertising a resource_metadata URL that 404s.
+   */
+  #httpStreamOAuthConfig() {
+    const resource = _optionalChain([this, 'access', _64 => _64.#options, 'access', _65 => _65.oauth, 'optionalAccess', _66 => _66.enabled]) ? _optionalChain([this, 'access', _67 => _67.#options, 'access', _68 => _68.oauth, 'access', _69 => _69.protectedResource, 'optionalAccess', _70 => _70.resource]) : void 0;
+    if (resource) {
+      return {
+        oauth: {
+          protectedResource: {
+            resource
+          }
+        }
+      };
+    }
+    if (this.#authenticate) {
+      return { oauth: {} };
+    }
+    return {};
+  }
   /**
    * On `httpStream`, `authenticate` is handed to both mcp-proxy (which calls it
    * once per request to gate the 401) and this server's own `createServer`
@@ -2777,23 +2787,23 @@ var FastMCP = class extends FastMCPEventEmitter {
     const envBasePath = process.env.FASTMCP_BASE_PATH;
     const envStateless = process.env.FASTMCP_STATELESS;
     const envHost = process.env.FASTMCP_HOST;
-    const transportType = _optionalChain([overrides, 'optionalAccess', _78 => _78.transportType]) || (transportArg === "http-stream" ? "httpStream" : transportArg) || envTransport || "stdio";
+    const transportType = _optionalChain([overrides, 'optionalAccess', _71 => _71.transportType]) || (transportArg === "http-stream" ? "httpStream" : transportArg) || envTransport || "stdio";
     if (transportType === "httpStream") {
       const port = parseInt(
-        _optionalChain([overrides, 'optionalAccess', _79 => _79.httpStream, 'optionalAccess', _80 => _80.port, 'optionalAccess', _81 => _81.toString, 'call', _82 => _82()]) || portArg || envPort || "8080"
+        _optionalChain([overrides, 'optionalAccess', _72 => _72.httpStream, 'optionalAccess', _73 => _73.port, 'optionalAccess', _74 => _74.toString, 'call', _75 => _75()]) || portArg || envPort || "8080"
       );
-      const host = _optionalChain([overrides, 'optionalAccess', _83 => _83.httpStream, 'optionalAccess', _84 => _84.host]) || hostArg || envHost || "localhost";
-      const endpoint = _optionalChain([overrides, 'optionalAccess', _85 => _85.httpStream, 'optionalAccess', _86 => _86.endpoint]) || endpointArg || envEndpoint || "/mcp";
+      const host = _optionalChain([overrides, 'optionalAccess', _76 => _76.httpStream, 'optionalAccess', _77 => _77.host]) || hostArg || envHost || "localhost";
+      const endpoint = _optionalChain([overrides, 'optionalAccess', _78 => _78.httpStream, 'optionalAccess', _79 => _79.endpoint]) || endpointArg || envEndpoint || "/mcp";
       const basePath = normalizeBasePath(
-        _optionalChain([overrides, 'optionalAccess', _87 => _87.httpStream, 'optionalAccess', _88 => _88.basePath]) || basePathArg || envBasePath
+        _optionalChain([overrides, 'optionalAccess', _80 => _80.httpStream, 'optionalAccess', _81 => _81.basePath]) || basePathArg || envBasePath
       );
-      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _89 => _89.httpStream, 'optionalAccess', _90 => _90.enableJsonResponse]) || false;
-      const stateless = _optionalChain([overrides, 'optionalAccess', _91 => _91.httpStream, 'optionalAccess', _92 => _92.stateless]) || statelessArg === "true" || envStateless === "true" || false;
-      const cors = _optionalChain([overrides, 'optionalAccess', _93 => _93.httpStream, 'optionalAccess', _94 => _94.cors]);
-      const eventStore = _optionalChain([overrides, 'optionalAccess', _95 => _95.httpStream, 'optionalAccess', _96 => _96.eventStore]);
-      const sslCa = _optionalChain([overrides, 'optionalAccess', _97 => _97.httpStream, 'optionalAccess', _98 => _98.sslCa]);
-      const sslCert = _optionalChain([overrides, 'optionalAccess', _99 => _99.httpStream, 'optionalAccess', _100 => _100.sslCert]);
-      const sslKey = _optionalChain([overrides, 'optionalAccess', _101 => _101.httpStream, 'optionalAccess', _102 => _102.sslKey]);
+      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _82 => _82.httpStream, 'optionalAccess', _83 => _83.enableJsonResponse]) || false;
+      const stateless = _optionalChain([overrides, 'optionalAccess', _84 => _84.httpStream, 'optionalAccess', _85 => _85.stateless]) || statelessArg === "true" || envStateless === "true" || false;
+      const cors = _optionalChain([overrides, 'optionalAccess', _86 => _86.httpStream, 'optionalAccess', _87 => _87.cors]);
+      const eventStore = _optionalChain([overrides, 'optionalAccess', _88 => _88.httpStream, 'optionalAccess', _89 => _89.eventStore]);
+      const sslCa = _optionalChain([overrides, 'optionalAccess', _90 => _90.httpStream, 'optionalAccess', _91 => _91.sslCa]);
+      const sslCert = _optionalChain([overrides, 'optionalAccess', _92 => _92.httpStream, 'optionalAccess', _93 => _93.sslCert]);
+      const sslKey = _optionalChain([overrides, 'optionalAccess', _94 => _94.httpStream, 'optionalAccess', _95 => _95.sslKey]);
       return {
         httpStream: {
           basePath,
@@ -2892,4 +2902,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-KGXPEC7J.cjs.map
+//# sourceMappingURL=chunk-TMDXVX4L.cjs.map