fastmcp 4.21.2 → 4.22.0

package/dist/{chunk-C5VOVQPC.cjs → chunk-V4JBWBT4.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkGTPK7A57cjs = require('./chunk-GTPK7A57.cjs');
+var _chunkYOBCXNFPcjs = require('./chunk-YOBCXNFP.cjs');
 
 
 var _chunkO22SYZMCcjs = require('./chunk-O22SYZMC.cjs');
@@ -134,7 +134,7 @@ var DiscoveryDocumentCache = class {
       throw error;
     }
     if (!res.ok) {
-      await _chunkGTPK7A57cjs.cancelResponseBody.call(void 0, res);
+      await _chunkYOBCXNFPcjs.cancelResponseBody.call(void 0, res);
       throw new Error(
         `Failed to fetch discovery document from ${url}: ${res.status} ${res.statusText}`
       );
@@ -230,7 +230,7 @@ var imageContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await _chunkGTPK7A57cjs.cancelResponseBody.call(void 0, response);
+          await _chunkYOBCXNFPcjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -292,7 +292,7 @@ var audioContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await _chunkGTPK7A57cjs.cancelResponseBody.call(void 0, response);
+          await _chunkYOBCXNFPcjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -464,6 +464,17 @@ var capCompletionValues = (completion) => {
     values: completion.values.slice(0, COMPLETION_VALUES_LIMIT)
   };
 };
+var DEFAULT_LOGGING_LEVEL = "info";
+var LOGGING_LEVEL_SEVERITY = {
+  alert: 6,
+  critical: 5,
+  debug: 0,
+  emergency: 7,
+  error: 4,
+  info: 1,
+  notice: 2,
+  warning: 3
+};
 var FastMCPSessionEventEmitterBase = _events.EventEmitter;
 var ServerState = /* @__PURE__ */ ((ServerState2) => {
   ServerState2["Error"] = "error";
@@ -481,7 +492,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     return this.#connectionState === "ready";
   }
   get loggingLevel() {
-    return this.#loggingLevel;
+    return _nullishCoalesce(this.#loggingLevel, () => ( DEFAULT_LOGGING_LEVEL));
   }
   get roots() {
     return this.#roots;
@@ -530,7 +541,11 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   #clientCapabilities;
   #connectionState = "connecting";
   #logger;
-  #loggingLevel = "info";
+  /**
+   * The minimum level the client asked for with `logging/setLevel`, or
+   * `undefined` while it has not asked. See {@link DEFAULT_LOGGING_LEVEL}.
+   */
+  #loggingLevel;
   #needsEventLoopFlush = false;
   #onToolCall;
   #pingConfig;
@@ -561,6 +576,12 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #subscriptions = /* @__PURE__ */ new Set();
   #transportType;
+  /**
+   * Capabilities this session has already warned about in `#canRefresh`, so a
+   * server that registers a hundred resources at runtime logs one line rather
+   * than a hundred.
+   */
+  #unnegotiatedWarnings = /* @__PURE__ */ new Set();
   #utils;
   constructor({
     auth,
@@ -600,7 +621,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#needsEventLoopFlush = transportType === "httpStream";
     const supportsTools = _nullishCoalesce(hasTools, () => ( tools.length > 0));
     if (supportsTools) {
-      this.#capabilities.tools = {};
+      this.#capabilities.tools = { listChanged: true };
     }
     if (resources.length || resourcesTemplates.length) {
       this.#capabilities.resources = { listChanged: true, subscribe: true };
@@ -744,6 +765,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     }
   }
   promptsListChanged(prompts) {
+    if (!this.#canRefresh("prompts")) {
+      return;
+    }
     this.#prompts.clear();
     for (const prompt of prompts) {
       this.addPrompt(prompt);
@@ -758,6 +782,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     return this.#server.createMessage(message, options);
   }
   resourcesListChanged(resources) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resources.clear();
     for (const resource of resources) {
       this.addResource(resource);
@@ -766,6 +793,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     this.triggerListChangedNotification("notifications/resources/list_changed");
   }
   resourceTemplatesListChanged(resourceTemplates) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resourceTemplates.clear();
     for (const resourceTemplate of resourceTemplates) {
       this.addResourceTemplate(resourceTemplate);
@@ -795,6 +825,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   toolsListChanged(tools) {
+    if (!this.#canRefresh("tools")) {
+      return;
+    }
     this.setupToolHandlers(
       toolsVisibleTo(tools, this.#auth, this.#authRequired)
     );
@@ -857,6 +890,30 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
       this.#abortController.abort(new SessionError("Session closed"));
     }
   }
+  /**
+   * Whether this session can be told about a primitive added at runtime.
+   *
+   * A session that connected before the server had any tool, resource or prompt
+   * of its own never advertised that capability, and MCP fixes capabilities
+   * during `initialize` for the life of the session. Registering the handler
+   * anyway makes the SDK throw `Server does not support <capability>` — out of
+   * `addTool()`, `addResource()`, `addResourceTemplate()` or `addPrompt()`,
+   * which are the public builder methods, and out of the middle of the loop
+   * over sessions, so the sessions after this one never heard about the change
+   * either. Warn once instead and let the rest of the loop run.
+   */
+  #canRefresh(capability) {
+    if (this.#capabilities[capability]) {
+      return true;
+    }
+    if (!this.#unnegotiatedWarnings.has(capability)) {
+      this.#unnegotiatedWarnings.add(capability);
+      this.#logger.warn(
+        `[FastMCP warning] This session advertised no '${capability}' capability, because the server had none when the client connected, so it cannot be shown the ones registered since. Register one before start(), or reconnect the client; sessions that connect from now on do see them.`
+      );
+    }
+    return false;
+  }
   /**
    * Builds the context object passed as the third argument to
    * `resource.load` / `resourceTemplate.load` / `prompt.load`.
@@ -917,6 +974,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * disconnects mid-tool takes the server process down with it.
    */
   #sendLog(level, message, context) {
+    if (this.#loggingLevel && LOGGING_LEVEL_SEVERITY[level] < LOGGING_LEVEL_SEVERITY[this.#loggingLevel]) {
+      return;
+    }
     this.#server.sendLoggingMessage({
       data: {
         context,
@@ -940,6 +1000,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * request's own stream, which is the only server-to-client route that exists
    * when running stateless.
    *
+   * It is deliberately not filtered against the level the client set with
+   * `logging/setLevel`, unlike the `log` object a tool is handed: its job is to
+   * put bytes on the stream, and a client that asked for `error` only would
+   * otherwise switch off a feature the server opted into. Raise
+   * `streamKeepalive.logLevel` if the level it uses matters to you.
+   *
    * @returns a function that stops the keepalive.
    */
   #startStreamKeepalive(extra, toolName) {
@@ -1622,6 +1688,17 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+function protectedResourceMetadataUrl(resource) {
+  let url;
+  try {
+    url = new URL(resource);
+  } catch (e6) {
+    return `${resource}/.well-known/oauth-protected-resource`;
+  }
+  const path = url.pathname === "/" ? "" : url.pathname;
+  url.pathname = `/.well-known/oauth-protected-resource${path}`;
+  return url.toString();
+}
 var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Cache-Control": "no-store",
@@ -1664,10 +1741,9 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#authenticate = options.authenticate;
       }
       if (!options.oauth) {
-        this.#options = {
-          ...options,
-          oauth: options.auth.getOAuthConfig()
-        };
+        const oauth = options.auth.getOAuthConfig();
+        this.#providerResourceBase = oauth.protectedResource.resource;
+        this.#options = { ...options, oauth };
       }
     } else {
       this.#authenticate = options.authenticate;
@@ -1685,6 +1761,8 @@ var FastMCP = class extends FastMCPEventEmitter {
   #logger;
   #options;
   #prompts = [];
+  /** The auth provider's base URL, when it supplied the OAuth config. */
+  #providerResourceBase;
   #resources = [];
   #resourcesTemplates = [];
   #serverState = "stopped" /* Stopped */;
@@ -2111,6 +2189,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         httpConfig.basePath,
         httpConfig.endpoint
       );
+      this.#useEndpointAsResource(httpConfig.endpoint);
       if (httpConfig.stateless) {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
@@ -2279,7 +2358,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     ];
     if (resource) {
       wwwAuthenticateParts.push(
-        `resource_metadata="${resource}/.well-known/oauth-protected-resource"`
+        `resource_metadata="${protectedResourceMetadataUrl(resource)}"`
       );
     }
     return new Response(
@@ -2930,6 +3009,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       session.toolsListChanged(tools);
     }
   }
+  /**
+   * RFC 9728: the protected resource is the MCP endpoint clients connect to,
+   * and the metadata served at `/.well-known/oauth-protected-resource<endpoint>`
+   * must name it. An auth provider only knows its base URL, so the endpoint is
+   * appended once the server knows it. An explicit `oauth` config is left as
+   * it is.
+   */
+  #useEndpointAsResource(endpoint) {
+    const oauth = this.#options.oauth;
+    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _96 => _96.protectedResource]))
+      return;
+    this.#options = {
+      ...this.#options,
+      oauth: {
+        ...oauth,
+        protectedResource: {
+          ...oauth.protectedResource,
+          resource: `${this.#providerResourceBase.replace(/\/+$/, "")}${normalizePath(endpoint)}`
+        }
+      }
+    };
+  }
 };
 
 
@@ -2946,4 +3047,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-C5VOVQPC.cjs.map
+//# sourceMappingURL=chunk-V4JBWBT4.cjs.map