fastmcp 4.21.2 → 4.22.0

package/README.md

@@ -1280,6 +1280,12 @@ The `log` object has the following methods:
 - `info(message: string, data?: SerializableValue)`
 - `warn(message: string, data?: SerializableValue)`
 
+A client can raise the minimum level it wants with the `logging/setLevel`
+request, and FastMCP then drops anything less severe instead of sending it — so
+after `logging/setLevel` with `error`, `log.debug` and `log.info` reach nobody.
+Until a client asks, every level is sent. The level in force is readable as
+[`session.loggingLevel`](#logginglevel).
+
 #### Errors
 
 The errors that are meant to be shown to the user should be thrown as `UserError` instances:
@@ -1617,7 +1623,9 @@ server.addResource({
 await server.sendResourceUpdated("file:///logs/app.log");
 ```
 
-`sendResourceUpdated` only notifies clients that have subscribed to the given URI, so it is safe to call whenever your data changes. FastMCP also advertises the `listChanged` capability for resources and prompts and emits `notifications/resources/list_changed` / `notifications/prompts/list_changed` automatically when you add or remove resources, resource templates, or prompts at runtime.
+`sendResourceUpdated` only notifies clients that have subscribed to the given URI, so it is safe to call whenever your data changes. FastMCP also advertises the `listChanged` capability for tools, resources and prompts and emits `notifications/tools/list_changed` / `notifications/resources/list_changed` / `notifications/prompts/list_changed` automatically when you add or remove tools, resources, resource templates, or prompts at runtime.
+
+One session cannot be shown a kind of primitive it never negotiated. MCP settles capabilities during `initialize` and they hold for the life of the session, so a client that connected while the server had no resources at all will not see resources added later — FastMCP logs a warning naming the capability and leaves that session alone. Register one of each kind you intend to add before `start()`, or have the client reconnect; sessions that connect afterwards see everything.
 
 ### Resource templates
 
@@ -2632,7 +2640,9 @@ session.clientCapabilities;
 
 ### `loggingLevel`
 
-The `loggingLevel` property describes the logging level as set by the client.
+The `loggingLevel` property describes the logging level as set by the client. It
+reads `info` until the client sends `logging/setLevel`; messages less severe than
+the level the client did set are dropped rather than sent.
 
 ```ts
 session.loggingLevel;

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkC5VOVQPCcjs = require('./chunk-C5VOVQPC.cjs');
+var _chunkV4JBWBT4cjs = require('./chunk-V4JBWBT4.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkC5VOVQPCcjs = require('./chunk-C5VOVQPC.cjs');
 
 
 
-var _chunkGTPK7A57cjs = require('./chunk-GTPK7A57.cjs');
+var _chunkYOBCXNFPcjs = require('./chunk-YOBCXNFP.cjs');
 require('./chunk-O22SYZMC.cjs');
 
 
@@ -50,5 +50,5 @@ require('./chunk-O22SYZMC.cjs');
 
 
 
-exports.AuthProvider = _chunkGTPK7A57cjs.AuthProvider; exports.AzureProvider = _chunkGTPK7A57cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkC5VOVQPCcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkC5VOVQPCcjs.FastMCP; exports.FastMCPError = _chunkC5VOVQPCcjs.FastMCPError; exports.FastMCPSession = _chunkC5VOVQPCcjs.FastMCPSession; exports.GitHubProvider = _chunkGTPK7A57cjs.GitHubProvider; exports.GoogleProvider = _chunkGTPK7A57cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkC5VOVQPCcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkGTPK7A57cjs.OAuthProvider; exports.ServerState = _chunkC5VOVQPCcjs.ServerState; exports.SessionError = _chunkC5VOVQPCcjs.SessionError; exports.UnexpectedStateError = _chunkC5VOVQPCcjs.UnexpectedStateError; exports.UserError = _chunkC5VOVQPCcjs.UserError; exports.audioContent = _chunkC5VOVQPCcjs.audioContent; exports.getAuthSession = _chunkGTPK7A57cjs.getAuthSession; exports.imageContent = _chunkC5VOVQPCcjs.imageContent; exports.jsonSchemaAdapter = _chunkC5VOVQPCcjs.jsonSchemaAdapter; exports.requireAll = _chunkGTPK7A57cjs.requireAll; exports.requireAny = _chunkGTPK7A57cjs.requireAny; exports.requireAuth = _chunkGTPK7A57cjs.requireAuth; exports.requireRole = _chunkGTPK7A57cjs.requireRole; exports.requireScopes = _chunkGTPK7A57cjs.requireScopes;
+exports.AuthProvider = _chunkYOBCXNFPcjs.AuthProvider; exports.AzureProvider = _chunkYOBCXNFPcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkV4JBWBT4cjs.DiscoveryDocumentCache; exports.FastMCP = _chunkV4JBWBT4cjs.FastMCP; exports.FastMCPError = _chunkV4JBWBT4cjs.FastMCPError; exports.FastMCPSession = _chunkV4JBWBT4cjs.FastMCPSession; exports.GitHubProvider = _chunkYOBCXNFPcjs.GitHubProvider; exports.GoogleProvider = _chunkYOBCXNFPcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkV4JBWBT4cjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYOBCXNFPcjs.OAuthProvider; exports.ServerState = _chunkV4JBWBT4cjs.ServerState; exports.SessionError = _chunkV4JBWBT4cjs.SessionError; exports.UnexpectedStateError = _chunkV4JBWBT4cjs.UnexpectedStateError; exports.UserError = _chunkV4JBWBT4cjs.UserError; exports.audioContent = _chunkV4JBWBT4cjs.audioContent; exports.getAuthSession = _chunkYOBCXNFPcjs.getAuthSession; exports.imageContent = _chunkV4JBWBT4cjs.imageContent; exports.jsonSchemaAdapter = _chunkV4JBWBT4cjs.jsonSchemaAdapter; exports.requireAll = _chunkYOBCXNFPcjs.requireAll; exports.requireAny = _chunkYOBCXNFPcjs.requireAny; exports.requireAuth = _chunkYOBCXNFPcjs.requireAuth; exports.requireRole = _chunkYOBCXNFPcjs.requireRole; exports.requireScopes = _chunkYOBCXNFPcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-C4idKF29.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-C4idKF29.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BcDb5bOz.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BcDb5bOz.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-C4idKF29.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-C4idKF29.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BcDb5bOz.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BcDb5bOz.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-QMRS4ZLD.js";
+} from "./chunk-43N2Q6ZI.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-AR3LVWUF.js";
+} from "./chunk-XPKMA7DH.js";
 import "./chunk-UMDUIBFW.js";
 export {
   AuthProvider,

package/dist/{OAuthProvider-C4idKF29.d.cts → OAuthProvider-BcDb5bOz.d.cts}

@@ -746,7 +746,7 @@ declare class OAuthProxyError extends Error {
 /**
  * Configuration common to all OAuth providers.
  */
-interface AuthProviderConfig {
+interface AuthProviderConfig extends ForwardedProxyOptions {
     /**
      * Allow-list of redirect URI patterns accepted by Dynamic Client
      * Registration. Required for any deployment that exposes /oauth/register
@@ -805,6 +805,8 @@ interface OAuthSession {
     /** Scopes granted by the OAuth provider */
     scopes?: string[];
 }
+/** OAuthProxy options that providers pass through unchanged. */
+type ForwardedProxyOptions = Pick<OAuthProxyConfig, "allowPlainPkce" | "authorizationResponseIss" | "enableCimd">;
 /**
  * Abstract base class for OAuth providers.
  * Encapsulates OAuthProxy creation, authenticate function, and oauth config.
@@ -813,6 +815,11 @@ interface OAuthSession {
  */
 declare abstract class AuthProvider<TSession extends OAuthSession = OAuthSession> {
     protected config: AuthProviderConfig;
+    /**
+     * The forwarded proxy options that are set. Unset ones are left out so the
+     * proxy's own defaults apply.
+     */
+    protected get forwardedProxyOptions(): ForwardedProxyOptions;
     /**
      * Get the proxy, creating it lazily if needed.
      */

package/dist/{OAuthProvider-C4idKF29.d.ts → OAuthProvider-BcDb5bOz.d.ts}

@@ -746,7 +746,7 @@ declare class OAuthProxyError extends Error {
 /**
  * Configuration common to all OAuth providers.
  */
-interface AuthProviderConfig {
+interface AuthProviderConfig extends ForwardedProxyOptions {
     /**
      * Allow-list of redirect URI patterns accepted by Dynamic Client
      * Registration. Required for any deployment that exposes /oauth/register
@@ -805,6 +805,8 @@ interface OAuthSession {
     /** Scopes granted by the OAuth provider */
     scopes?: string[];
 }
+/** OAuthProxy options that providers pass through unchanged. */
+type ForwardedProxyOptions = Pick<OAuthProxyConfig, "allowPlainPkce" | "authorizationResponseIss" | "enableCimd">;
 /**
  * Abstract base class for OAuth providers.
  * Encapsulates OAuthProxy creation, authenticate function, and oauth config.
@@ -813,6 +815,11 @@ interface OAuthSession {
  */
 declare abstract class AuthProvider<TSession extends OAuthSession = OAuthSession> {
     protected config: AuthProviderConfig;
+    /**
+     * The forwarded proxy options that are set. Unset ones are left out so the
+     * proxy's own defaults apply.
+     */
+    protected get forwardedProxyOptions(): ForwardedProxyOptions;
     /**
      * Get the proxy, creating it lazily if needed.
      */

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkGTPK7A57cjs = require('../chunk-GTPK7A57.cjs');
+var _chunkYOBCXNFPcjs = require('../chunk-YOBCXNFP.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkGTPK7A57cjs = require('../chunk-GTPK7A57.cjs');
 
 
 
-exports.AuthProvider = _chunkGTPK7A57cjs.AuthProvider; exports.AzureProvider = _chunkGTPK7A57cjs.AzureProvider; exports.ConsentManager = _chunkGTPK7A57cjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkGTPK7A57cjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkGTPK7A57cjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkGTPK7A57cjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkGTPK7A57cjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkGTPK7A57cjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkGTPK7A57cjs.DiskStore; exports.EncryptedTokenStorage = _chunkGTPK7A57cjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkGTPK7A57cjs.GitHubProvider; exports.GoogleProvider = _chunkGTPK7A57cjs.GoogleProvider; exports.JWKSVerifier = _chunkGTPK7A57cjs.JWKSVerifier; exports.JWTIssuer = _chunkGTPK7A57cjs.JWTIssuer; exports.MemoryTokenStorage = _chunkGTPK7A57cjs.MemoryTokenStorage; exports.OAuthProvider = _chunkGTPK7A57cjs.OAuthProvider; exports.OAuthProxy = _chunkGTPK7A57cjs.OAuthProxy; exports.OAuthProxyError = _chunkGTPK7A57cjs.OAuthProxyError; exports.PKCEUtils = _chunkGTPK7A57cjs.PKCEUtils; exports.getAuthSession = _chunkGTPK7A57cjs.getAuthSession; exports.requireAll = _chunkGTPK7A57cjs.requireAll; exports.requireAny = _chunkGTPK7A57cjs.requireAny; exports.requireAuth = _chunkGTPK7A57cjs.requireAuth; exports.requireRole = _chunkGTPK7A57cjs.requireRole; exports.requireScopes = _chunkGTPK7A57cjs.requireScopes;
+exports.AuthProvider = _chunkYOBCXNFPcjs.AuthProvider; exports.AzureProvider = _chunkYOBCXNFPcjs.AzureProvider; exports.ConsentManager = _chunkYOBCXNFPcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkYOBCXNFPcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkYOBCXNFPcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkYOBCXNFPcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkYOBCXNFPcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkYOBCXNFPcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkYOBCXNFPcjs.DiskStore; exports.EncryptedTokenStorage = _chunkYOBCXNFPcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkYOBCXNFPcjs.GitHubProvider; exports.GoogleProvider = _chunkYOBCXNFPcjs.GoogleProvider; exports.JWKSVerifier = _chunkYOBCXNFPcjs.JWKSVerifier; exports.JWTIssuer = _chunkYOBCXNFPcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkYOBCXNFPcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkYOBCXNFPcjs.OAuthProvider; exports.OAuthProxy = _chunkYOBCXNFPcjs.OAuthProxy; exports.OAuthProxyError = _chunkYOBCXNFPcjs.OAuthProxyError; exports.PKCEUtils = _chunkYOBCXNFPcjs.PKCEUtils; exports.getAuthSession = _chunkYOBCXNFPcjs.getAuthSession; exports.requireAll = _chunkYOBCXNFPcjs.requireAll; exports.requireAny = _chunkYOBCXNFPcjs.requireAny; exports.requireAuth = _chunkYOBCXNFPcjs.requireAuth; exports.requireRole = _chunkYOBCXNFPcjs.requireRole; exports.requireScopes = _chunkYOBCXNFPcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-C4idKF29.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-C4idKF29.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BcDb5bOz.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BcDb5bOz.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-C4idKF29.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-C4idKF29.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BcDb5bOz.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BcDb5bOz.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-AR3LVWUF.js";
+} from "../chunk-XPKMA7DH.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-QMRS4ZLD.js → chunk-43N2Q6ZI.js}

@@ -1,6 +1,6 @@
 import {
   cancelResponseBody
-} from "./chunk-AR3LVWUF.js";
+} from "./chunk-XPKMA7DH.js";
 import {
   strictInputSchema
 } from "./chunk-UMDUIBFW.js";
@@ -464,6 +464,17 @@ var capCompletionValues = (completion) => {
     values: completion.values.slice(0, COMPLETION_VALUES_LIMIT)
   };
 };
+var DEFAULT_LOGGING_LEVEL = "info";
+var LOGGING_LEVEL_SEVERITY = {
+  alert: 6,
+  critical: 5,
+  debug: 0,
+  emergency: 7,
+  error: 4,
+  info: 1,
+  notice: 2,
+  warning: 3
+};
 var FastMCPSessionEventEmitterBase = EventEmitter;
 var ServerState = /* @__PURE__ */ ((ServerState2) => {
   ServerState2["Error"] = "error";
@@ -481,7 +492,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     return this.#connectionState === "ready";
   }
   get loggingLevel() {
-    return this.#loggingLevel;
+    return this.#loggingLevel ?? DEFAULT_LOGGING_LEVEL;
   }
   get roots() {
     return this.#roots;
@@ -530,7 +541,11 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   #clientCapabilities;
   #connectionState = "connecting";
   #logger;
-  #loggingLevel = "info";
+  /**
+   * The minimum level the client asked for with `logging/setLevel`, or
+   * `undefined` while it has not asked. See {@link DEFAULT_LOGGING_LEVEL}.
+   */
+  #loggingLevel;
   #needsEventLoopFlush = false;
   #onToolCall;
   #pingConfig;
@@ -561,6 +576,12 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #subscriptions = /* @__PURE__ */ new Set();
   #transportType;
+  /**
+   * Capabilities this session has already warned about in `#canRefresh`, so a
+   * server that registers a hundred resources at runtime logs one line rather
+   * than a hundred.
+   */
+  #unnegotiatedWarnings = /* @__PURE__ */ new Set();
   #utils;
   constructor({
     auth,
@@ -600,7 +621,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#needsEventLoopFlush = transportType === "httpStream";
     const supportsTools = hasTools ?? tools.length > 0;
     if (supportsTools) {
-      this.#capabilities.tools = {};
+      this.#capabilities.tools = { listChanged: true };
     }
     if (resources.length || resourcesTemplates.length) {
       this.#capabilities.resources = { listChanged: true, subscribe: true };
@@ -744,6 +765,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     }
   }
   promptsListChanged(prompts) {
+    if (!this.#canRefresh("prompts")) {
+      return;
+    }
     this.#prompts.clear();
     for (const prompt of prompts) {
       this.addPrompt(prompt);
@@ -758,6 +782,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     return this.#server.createMessage(message, options);
   }
   resourcesListChanged(resources) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resources.clear();
     for (const resource of resources) {
       this.addResource(resource);
@@ -766,6 +793,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     this.triggerListChangedNotification("notifications/resources/list_changed");
   }
   resourceTemplatesListChanged(resourceTemplates) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resourceTemplates.clear();
     for (const resourceTemplate of resourceTemplates) {
       this.addResourceTemplate(resourceTemplate);
@@ -795,6 +825,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   toolsListChanged(tools) {
+    if (!this.#canRefresh("tools")) {
+      return;
+    }
     this.setupToolHandlers(
       toolsVisibleTo(tools, this.#auth, this.#authRequired)
     );
@@ -857,6 +890,30 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
       this.#abortController.abort(new SessionError("Session closed"));
     }
   }
+  /**
+   * Whether this session can be told about a primitive added at runtime.
+   *
+   * A session that connected before the server had any tool, resource or prompt
+   * of its own never advertised that capability, and MCP fixes capabilities
+   * during `initialize` for the life of the session. Registering the handler
+   * anyway makes the SDK throw `Server does not support <capability>` — out of
+   * `addTool()`, `addResource()`, `addResourceTemplate()` or `addPrompt()`,
+   * which are the public builder methods, and out of the middle of the loop
+   * over sessions, so the sessions after this one never heard about the change
+   * either. Warn once instead and let the rest of the loop run.
+   */
+  #canRefresh(capability) {
+    if (this.#capabilities[capability]) {
+      return true;
+    }
+    if (!this.#unnegotiatedWarnings.has(capability)) {
+      this.#unnegotiatedWarnings.add(capability);
+      this.#logger.warn(
+        `[FastMCP warning] This session advertised no '${capability}' capability, because the server had none when the client connected, so it cannot be shown the ones registered since. Register one before start(), or reconnect the client; sessions that connect from now on do see them.`
+      );
+    }
+    return false;
+  }
   /**
    * Builds the context object passed as the third argument to
    * `resource.load` / `resourceTemplate.load` / `prompt.load`.
@@ -917,6 +974,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * disconnects mid-tool takes the server process down with it.
    */
   #sendLog(level, message, context) {
+    if (this.#loggingLevel && LOGGING_LEVEL_SEVERITY[level] < LOGGING_LEVEL_SEVERITY[this.#loggingLevel]) {
+      return;
+    }
     this.#server.sendLoggingMessage({
       data: {
         context,
@@ -940,6 +1000,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * request's own stream, which is the only server-to-client route that exists
    * when running stateless.
    *
+   * It is deliberately not filtered against the level the client set with
+   * `logging/setLevel`, unlike the `log` object a tool is handed: its job is to
+   * put bytes on the stream, and a client that asked for `error` only would
+   * otherwise switch off a feature the server opted into. Raise
+   * `streamKeepalive.logLevel` if the level it uses matters to you.
+   *
    * @returns a function that stops the keepalive.
    */
   #startStreamKeepalive(extra, toolName) {
@@ -1622,6 +1688,17 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+function protectedResourceMetadataUrl(resource) {
+  let url;
+  try {
+    url = new URL(resource);
+  } catch {
+    return `${resource}/.well-known/oauth-protected-resource`;
+  }
+  const path = url.pathname === "/" ? "" : url.pathname;
+  url.pathname = `/.well-known/oauth-protected-resource${path}`;
+  return url.toString();
+}
 var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Cache-Control": "no-store",
@@ -1664,10 +1741,9 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#authenticate = options.authenticate;
       }
       if (!options.oauth) {
-        this.#options = {
-          ...options,
-          oauth: options.auth.getOAuthConfig()
-        };
+        const oauth = options.auth.getOAuthConfig();
+        this.#providerResourceBase = oauth.protectedResource.resource;
+        this.#options = { ...options, oauth };
       }
     } else {
       this.#authenticate = options.authenticate;
@@ -1685,6 +1761,8 @@ var FastMCP = class extends FastMCPEventEmitter {
   #logger;
   #options;
   #prompts = [];
+  /** The auth provider's base URL, when it supplied the OAuth config. */
+  #providerResourceBase;
   #resources = [];
   #resourcesTemplates = [];
   #serverState = "stopped" /* Stopped */;
@@ -2111,6 +2189,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         httpConfig.basePath,
         httpConfig.endpoint
       );
+      this.#useEndpointAsResource(httpConfig.endpoint);
       if (httpConfig.stateless) {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
@@ -2279,7 +2358,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     ];
     if (resource) {
       wwwAuthenticateParts.push(
-        `resource_metadata="${resource}/.well-known/oauth-protected-resource"`
+        `resource_metadata="${protectedResourceMetadataUrl(resource)}"`
       );
     }
     return new Response(
@@ -2930,6 +3009,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       session.toolsListChanged(tools);
     }
   }
+  /**
+   * RFC 9728: the protected resource is the MCP endpoint clients connect to,
+   * and the metadata served at `/.well-known/oauth-protected-resource<endpoint>`
+   * must name it. An auth provider only knows its base URL, so the endpoint is
+   * appended once the server knows it. An explicit `oauth` config is left as
+   * it is.
+   */
+  #useEndpointAsResource(endpoint) {
+    const oauth = this.#options.oauth;
+    if (this.#providerResourceBase === void 0 || !oauth?.protectedResource)
+      return;
+    this.#options = {
+      ...this.#options,
+      oauth: {
+        ...oauth,
+        protectedResource: {
+          ...oauth.protectedResource,
+          resource: `${this.#providerResourceBase.replace(/\/+$/, "")}${normalizePath(endpoint)}`
+        }
+      }
+    };
+  }
 };
 
 export {
@@ -2946,4 +3047,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-QMRS4ZLD.js.map
+//# sourceMappingURL=chunk-43N2Q6ZI.js.map