fastmcp 4.20.1 → 4.20.3

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkTMDXVX4Lcjs = require('./chunk-TMDXVX4L.cjs');
+var _chunkX4AKKWFDcjs = require('./chunk-X4AKKWFD.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkYO76IUZ6cjs = require('./chunk-YO76IUZ6.cjs');
 
 
 
-exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkTMDXVX4Lcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkTMDXVX4Lcjs.FastMCP; exports.FastMCPError = _chunkTMDXVX4Lcjs.FastMCPError; exports.FastMCPSession = _chunkTMDXVX4Lcjs.FastMCPSession; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkTMDXVX4Lcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.ServerState = _chunkTMDXVX4Lcjs.ServerState; exports.SessionError = _chunkTMDXVX4Lcjs.SessionError; exports.UnexpectedStateError = _chunkTMDXVX4Lcjs.UnexpectedStateError; exports.UserError = _chunkTMDXVX4Lcjs.UserError; exports.audioContent = _chunkTMDXVX4Lcjs.audioContent; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.imageContent = _chunkTMDXVX4Lcjs.imageContent; exports.jsonSchemaAdapter = _chunkTMDXVX4Lcjs.jsonSchemaAdapter; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
+exports.AuthProvider = _chunkYO76IUZ6cjs.AuthProvider; exports.AzureProvider = _chunkYO76IUZ6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkX4AKKWFDcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkX4AKKWFDcjs.FastMCP; exports.FastMCPError = _chunkX4AKKWFDcjs.FastMCPError; exports.FastMCPSession = _chunkX4AKKWFDcjs.FastMCPSession; exports.GitHubProvider = _chunkYO76IUZ6cjs.GitHubProvider; exports.GoogleProvider = _chunkYO76IUZ6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkX4AKKWFDcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYO76IUZ6cjs.OAuthProvider; exports.ServerState = _chunkX4AKKWFDcjs.ServerState; exports.SessionError = _chunkX4AKKWFDcjs.SessionError; exports.UnexpectedStateError = _chunkX4AKKWFDcjs.UnexpectedStateError; exports.UserError = _chunkX4AKKWFDcjs.UserError; exports.audioContent = _chunkX4AKKWFDcjs.audioContent; exports.getAuthSession = _chunkYO76IUZ6cjs.getAuthSession; exports.imageContent = _chunkX4AKKWFDcjs.imageContent; exports.jsonSchemaAdapter = _chunkX4AKKWFDcjs.jsonSchemaAdapter; exports.requireAll = _chunkYO76IUZ6cjs.requireAll; exports.requireAny = _chunkYO76IUZ6cjs.requireAny; exports.requireAuth = _chunkYO76IUZ6cjs.requireAuth; exports.requireRole = _chunkYO76IUZ6cjs.requireRole; exports.requireScopes = _chunkYO76IUZ6cjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-RGV6FTGL.js";
+} from "./chunk-KBWJEPOD.js";
 import {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-RGV6FTGL.js → chunk-KBWJEPOD.js}

@@ -2280,8 +2280,15 @@ var FastMCP = class extends FastMCPEventEmitter {
         if (!res.headersSent) {
           res.statusCode = honoResponse.status;
           honoResponse.headers.forEach((value, key) => {
+            if (key.toLowerCase() === "set-cookie") {
+              return;
+            }
             res.setHeader(key, value);
           });
+          const setCookies = honoResponse.headers.getSetCookie();
+          if (setCookies.length > 0) {
+            res.setHeader("Set-Cookie", setCookies);
+          }
           if (honoResponse.body) {
             const reader = honoResponse.body.getReader();
             let resolveClosed;
@@ -2679,26 +2686,24 @@ var FastMCP = class extends FastMCPEventEmitter {
     }
   };
   /**
-   * mcp-proxy only emits `WWW-Authenticate` on 401 when `oauth` is set.
-   * Custom `authenticate()` still needs that challenge with no OAuth metadata
-   * configured (RFC 7235). Pass an empty oauth object in that case so the
-   * header is present without advertising a resource_metadata URL that 404s.
+   * Only advertise `resource_metadata` when OAuth is enabled: the
+   * `/.well-known/oauth-protected-resource` endpoint is served only under
+   * `oauth.enabled`, so gating here avoids pointing clients at a URL that
+   * would 404. mcp-proxy emits the `WWW-Authenticate` challenge on every 401
+   * regardless (RFC 7235), so no config is needed just to get the header.
    */
   #httpStreamOAuthConfig() {
     const resource = this.#options.oauth?.enabled ? this.#options.oauth.protectedResource?.resource : void 0;
-    if (resource) {
-      return {
-        oauth: {
-          protectedResource: {
-            resource
-          }
-        }
-      };
-    }
-    if (this.#authenticate) {
-      return { oauth: {} };
+    if (!resource) {
+      return {};
     }
-    return {};
+    return {
+      oauth: {
+        protectedResource: {
+          resource
+        }
+      }
+    };
   }
   /**
    * On `httpStream`, `authenticate` is handed to both mcp-proxy (which calls it
@@ -2902,4 +2907,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-RGV6FTGL.js.map
+//# sourceMappingURL=chunk-KBWJEPOD.js.map