fastmcp 4.21.1 → 4.22.0

package/dist/{chunk-JNP6BG5L.js → chunk-43N2Q6ZI.js}

@@ -1,6 +1,9 @@
 import {
   cancelResponseBody
-} from "./chunk-AR3LVWUF.js";
+} from "./chunk-XPKMA7DH.js";
+import {
+  strictInputSchema
+} from "./chunk-UMDUIBFW.js";
 
 // src/FastMCP.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -376,21 +379,6 @@ function assertToolSchemas(tool) {
     assertStandardSchema(tool.name, "outputSchema", tool.outputSchema);
   }
 }
-function strictInputSchema(schema) {
-  const isDictionary = typeof schema.additionalProperties === "object" && Object.keys(schema.properties ?? {}).length === 0;
-  return {
-    ...schema,
-    additionalProperties: isDictionary ? schema.additionalProperties : false,
-    ...schema.properties && {
-      properties: Object.fromEntries(
-        Object.entries(schema.properties).map(([key, value]) => [
-          key,
-          typeof value === "object" && value.type === "object" ? strictInputSchema(value) : value
-        ])
-      )
-    }
-  };
-}
 var STREAM_KEEPALIVE_LOGGER = "fastmcp-keepalive";
 var STREAM_KEEPALIVE_DEFAULT_INTERVAL_MS = 2e4;
 var TextContentZodSchema = z.object({
@@ -476,6 +464,17 @@ var capCompletionValues = (completion) => {
     values: completion.values.slice(0, COMPLETION_VALUES_LIMIT)
   };
 };
+var DEFAULT_LOGGING_LEVEL = "info";
+var LOGGING_LEVEL_SEVERITY = {
+  alert: 6,
+  critical: 5,
+  debug: 0,
+  emergency: 7,
+  error: 4,
+  info: 1,
+  notice: 2,
+  warning: 3
+};
 var FastMCPSessionEventEmitterBase = EventEmitter;
 var ServerState = /* @__PURE__ */ ((ServerState2) => {
   ServerState2["Error"] = "error";
@@ -493,7 +492,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     return this.#connectionState === "ready";
   }
   get loggingLevel() {
-    return this.#loggingLevel;
+    return this.#loggingLevel ?? DEFAULT_LOGGING_LEVEL;
   }
   get roots() {
     return this.#roots;
@@ -537,11 +536,16 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #abortController = new AbortController();
   #auth;
+  #authRequired;
   #capabilities = {};
   #clientCapabilities;
   #connectionState = "connecting";
   #logger;
-  #loggingLevel = "info";
+  /**
+   * The minimum level the client asked for with `logging/setLevel`, or
+   * `undefined` while it has not asked. See {@link DEFAULT_LOGGING_LEVEL}.
+   */
+  #loggingLevel;
   #needsEventLoopFlush = false;
   #onToolCall;
   #pingConfig;
@@ -572,9 +576,16 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #subscriptions = /* @__PURE__ */ new Set();
   #transportType;
+  /**
+   * Capabilities this session has already warned about in `#canRefresh`, so a
+   * server that registers a hundred resources at runtime logs one line rather
+   * than a hundred.
+   */
+  #unnegotiatedWarnings = /* @__PURE__ */ new Set();
   #utils;
   constructor({
     auth,
+    authRequired = false,
     hasTools,
     icons,
     instructions,
@@ -598,6 +609,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   }) {
     super();
     this.#auth = auth;
+    this.#authRequired = authRequired;
     this.#logger = logger;
     this.#onToolCall = onToolCall;
     this.#pingConfig = ping;
@@ -609,7 +621,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#needsEventLoopFlush = transportType === "httpStream";
     const supportsTools = hasTools ?? tools.length > 0;
     if (supportsTools) {
-      this.#capabilities.tools = {};
+      this.#capabilities.tools = { listChanged: true };
     }
     if (resources.length || resourcesTemplates.length) {
       this.#capabilities.resources = { listChanged: true, subscribe: true };
@@ -753,6 +765,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     }
   }
   promptsListChanged(prompts) {
+    if (!this.#canRefresh("prompts")) {
+      return;
+    }
     this.#prompts.clear();
     for (const prompt of prompts) {
       this.addPrompt(prompt);
@@ -767,6 +782,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     return this.#server.createMessage(message, options);
   }
   resourcesListChanged(resources) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resources.clear();
     for (const resource of resources) {
       this.addResource(resource);
@@ -775,6 +793,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     this.triggerListChangedNotification("notifications/resources/list_changed");
   }
   resourceTemplatesListChanged(resourceTemplates) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resourceTemplates.clear();
     for (const resourceTemplate of resourceTemplates) {
       this.addResourceTemplate(resourceTemplate);
@@ -804,7 +825,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   toolsListChanged(tools) {
-    this.setupToolHandlers(toolsVisibleTo(tools, this.#auth));
+    if (!this.#canRefresh("tools")) {
+      return;
+    }
+    this.setupToolHandlers(
+      toolsVisibleTo(tools, this.#auth, this.#authRequired)
+    );
     this.triggerListChangedNotification("notifications/tools/list_changed");
   }
   async triggerListChangedNotification(method) {
@@ -864,6 +890,30 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
       this.#abortController.abort(new SessionError("Session closed"));
     }
   }
+  /**
+   * Whether this session can be told about a primitive added at runtime.
+   *
+   * A session that connected before the server had any tool, resource or prompt
+   * of its own never advertised that capability, and MCP fixes capabilities
+   * during `initialize` for the life of the session. Registering the handler
+   * anyway makes the SDK throw `Server does not support <capability>` — out of
+   * `addTool()`, `addResource()`, `addResourceTemplate()` or `addPrompt()`,
+   * which are the public builder methods, and out of the middle of the loop
+   * over sessions, so the sessions after this one never heard about the change
+   * either. Warn once instead and let the rest of the loop run.
+   */
+  #canRefresh(capability) {
+    if (this.#capabilities[capability]) {
+      return true;
+    }
+    if (!this.#unnegotiatedWarnings.has(capability)) {
+      this.#unnegotiatedWarnings.add(capability);
+      this.#logger.warn(
+        `[FastMCP warning] This session advertised no '${capability}' capability, because the server had none when the client connected, so it cannot be shown the ones registered since. Register one before start(), or reconnect the client; sessions that connect from now on do see them.`
+      );
+    }
+    return false;
+  }
   /**
    * Builds the context object passed as the third argument to
    * `resource.load` / `resourceTemplate.load` / `prompt.load`.
@@ -924,6 +974,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * disconnects mid-tool takes the server process down with it.
    */
   #sendLog(level, message, context) {
+    if (this.#loggingLevel && LOGGING_LEVEL_SEVERITY[level] < LOGGING_LEVEL_SEVERITY[this.#loggingLevel]) {
+      return;
+    }
     this.#server.sendLoggingMessage({
       data: {
         context,
@@ -947,6 +1000,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * request's own stream, which is the only server-to-client route that exists
    * when running stateless.
    *
+   * It is deliberately not filtered against the level the client set with
+   * `logging/setLevel`, unlike the `log` object a tool is handed: its job is to
+   * put bytes on the stream, and a client that asked for `error` only would
+   * otherwise switch off a feature the server opted into. Raise
+   * `streamKeepalive.logLevel` if the level it uses matters to you.
+   *
    * @returns a function that stops the keepalive.
    */
   #startStreamKeepalive(extra, toolName) {
@@ -1067,9 +1126,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         const ref = request.params.ref;
         const prompt = "name" in ref && this.#prompts.get(ref.name);
         if (!prompt) {
-          throw new UnexpectedStateError("Unknown prompt", {
-            request
-          });
+          throw new McpError(
+            ErrorCode.InvalidParams,
+            `Unknown prompt: ${ref.name}`
+          );
         }
         if (!prompt.complete) {
           throw new UnexpectedStateError("Prompt does not support completion", {
@@ -1095,9 +1155,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           (resource2) => resource2.uriTemplate === ref.uri
         );
         if (!resource) {
-          throw new UnexpectedStateError("Unknown resource", {
-            request
-          });
+          throw new McpError(
+            ErrorCode.InvalidParams,
+            `Unknown resource template: ${ref.uri}`
+          );
         }
         if (!("uriTemplate" in resource)) {
           throw new UnexpectedStateError("Unexpected resource");
@@ -1627,6 +1688,17 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+function protectedResourceMetadataUrl(resource) {
+  let url;
+  try {
+    url = new URL(resource);
+  } catch {
+    return `${resource}/.well-known/oauth-protected-resource`;
+  }
+  const path = url.pathname === "/" ? "" : url.pathname;
+  url.pathname = `/.well-known/oauth-protected-resource${path}`;
+  return url.toString();
+}
 var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Cache-Control": "no-store",
@@ -1645,8 +1717,13 @@ function stripBasePath(path, basePath) {
   }
   return null;
 }
-function toolsVisibleTo(tools, auth) {
-  return auth ? tools.filter((tool) => tool.canAccess ? tool.canAccess(auth) : true) : tools;
+function toolsVisibleTo(tools, auth, authRequired) {
+  if (auth) {
+    return tools.filter(
+      (tool) => tool.canAccess ? tool.canAccess(auth) : true
+    );
+  }
+  return authRequired ? tools.filter((tool) => !tool.canAccess) : tools;
 }
 var FastMCPEventEmitterBase = EventEmitter;
 var FastMCPEventEmitter = class extends FastMCPEventEmitterBase {
@@ -1664,10 +1741,9 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#authenticate = options.authenticate;
       }
       if (!options.oauth) {
-        this.#options = {
-          ...options,
-          oauth: options.auth.getOAuthConfig()
-        };
+        const oauth = options.auth.getOAuthConfig();
+        this.#providerResourceBase = oauth.protectedResource.resource;
+        this.#options = { ...options, oauth };
       }
     } else {
       this.#authenticate = options.authenticate;
@@ -1685,6 +1761,8 @@ var FastMCP = class extends FastMCPEventEmitter {
   #logger;
   #options;
   #prompts = [];
+  /** The auth provider's base URL, when it supplied the OAuth config. */
+  #providerResourceBase;
   #resources = [];
   #resourcesTemplates = [];
   #serverState = "stopped" /* Stopped */;
@@ -2027,6 +2105,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     if (config.transportType === "stdio") {
       const transport = new StdioServerTransport();
       let auth;
+      const authRequired = this.#authenticate !== void 0;
       if (this.#authenticate) {
         try {
           auth = await this.#authenticate(
@@ -2038,9 +2117,15 @@ var FastMCP = class extends FastMCPEventEmitter {
             error instanceof Error ? error.message : String(error)
           );
         }
+        if (!auth && this.#tools.some((tool) => tool.canAccess)) {
+          this.#logger.warn(
+            "[FastMCP warning] The stdio session has no auth, so tools gated by canAccess are hidden from it."
+          );
+        }
       }
       const session = new FastMCPSession({
         auth,
+        authRequired,
         hasTools: this.#tools.length > 0,
         icons: this.#options.icons,
         instructions: this.#options.instructions,
@@ -2054,7 +2139,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         roots: this.#options.roots,
         streamKeepalive: this.#options.streamKeepalive,
         title: this.#options.title,
-        tools: toolsVisibleTo(this.#tools, auth),
+        tools: toolsVisibleTo(this.#tools, auth, authRequired),
         transportType: "stdio",
         utils: this.#options.utils,
         version: this.#options.version,
@@ -2104,6 +2189,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         httpConfig.basePath,
         httpConfig.endpoint
       );
+      this.#useEndpointAsResource(httpConfig.endpoint);
       if (httpConfig.stateless) {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
@@ -2224,8 +2310,10 @@ var FastMCP = class extends FastMCPEventEmitter {
       const errorMessage = "error" in auth && typeof auth.error === "string" ? auth.error : "Authentication failed";
       throw this.#createUnauthorizedResponse(errorMessage);
     }
+    const authRequired = this.#authenticate !== void 0;
     return new FastMCPSession({
       auth,
+      authRequired,
       hasTools: this.#tools.length > 0,
       icons: this.#options.icons,
       instructions: this.#options.instructions,
@@ -2241,7 +2329,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       stateless,
       streamKeepalive: this.#options.streamKeepalive,
       title: this.#options.title,
-      tools: toolsVisibleTo(this.#tools, auth),
+      tools: toolsVisibleTo(this.#tools, auth, authRequired),
       transportType: "httpStream",
       utils: this.#options.utils,
       version: this.#options.version,
@@ -2270,7 +2358,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     ];
     if (resource) {
       wwwAuthenticateParts.push(
-        `resource_metadata="${resource}/.well-known/oauth-protected-resource"`
+        `resource_metadata="${protectedResourceMetadataUrl(resource)}"`
       );
     }
     return new Response(
@@ -2921,6 +3009,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       session.toolsListChanged(tools);
     }
   }
+  /**
+   * RFC 9728: the protected resource is the MCP endpoint clients connect to,
+   * and the metadata served at `/.well-known/oauth-protected-resource<endpoint>`
+   * must name it. An auth provider only knows its base URL, so the endpoint is
+   * appended once the server knows it. An explicit `oauth` config is left as
+   * it is.
+   */
+  #useEndpointAsResource(endpoint) {
+    const oauth = this.#options.oauth;
+    if (this.#providerResourceBase === void 0 || !oauth?.protectedResource)
+      return;
+    this.#options = {
+      ...this.#options,
+      oauth: {
+        ...oauth,
+        protectedResource: {
+          ...oauth.protectedResource,
+          resource: `${this.#providerResourceBase.replace(/\/+$/, "")}${normalizePath(endpoint)}`
+        }
+      }
+    };
+  }
 };
 
 export {
@@ -2937,4 +3047,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-JNP6BG5L.js.map
+//# sourceMappingURL=chunk-43N2Q6ZI.js.map