fastmcp 4.21.2 → 4.22.1

package/dist/{chunk-QMRS4ZLD.js → chunk-XFUILY54.js}

@@ -1,6 +1,6 @@
 import {
   cancelResponseBody
-} from "./chunk-AR3LVWUF.js";
+} from "./chunk-XPKMA7DH.js";
 import {
   strictInputSchema
 } from "./chunk-UMDUIBFW.js";
@@ -464,6 +464,17 @@ var capCompletionValues = (completion) => {
     values: completion.values.slice(0, COMPLETION_VALUES_LIMIT)
   };
 };
+var DEFAULT_LOGGING_LEVEL = "info";
+var LOGGING_LEVEL_SEVERITY = {
+  alert: 6,
+  critical: 5,
+  debug: 0,
+  emergency: 7,
+  error: 4,
+  info: 1,
+  notice: 2,
+  warning: 3
+};
 var FastMCPSessionEventEmitterBase = EventEmitter;
 var ServerState = /* @__PURE__ */ ((ServerState2) => {
   ServerState2["Error"] = "error";
@@ -481,7 +492,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     return this.#connectionState === "ready";
   }
   get loggingLevel() {
-    return this.#loggingLevel;
+    return this.#loggingLevel ?? DEFAULT_LOGGING_LEVEL;
   }
   get roots() {
     return this.#roots;
@@ -530,7 +541,11 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   #clientCapabilities;
   #connectionState = "connecting";
   #logger;
-  #loggingLevel = "info";
+  /**
+   * The minimum level the client asked for with `logging/setLevel`, or
+   * `undefined` while it has not asked. See {@link DEFAULT_LOGGING_LEVEL}.
+   */
+  #loggingLevel;
   #needsEventLoopFlush = false;
   #onToolCall;
   #pingConfig;
@@ -561,6 +576,12 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #subscriptions = /* @__PURE__ */ new Set();
   #transportType;
+  /**
+   * Capabilities this session has already warned about in `#canRefresh`, so a
+   * server that registers a hundred resources at runtime logs one line rather
+   * than a hundred.
+   */
+  #unnegotiatedWarnings = /* @__PURE__ */ new Set();
   #utils;
   constructor({
     auth,
@@ -600,7 +621,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#needsEventLoopFlush = transportType === "httpStream";
     const supportsTools = hasTools ?? tools.length > 0;
     if (supportsTools) {
-      this.#capabilities.tools = {};
+      this.#capabilities.tools = { listChanged: true };
     }
     if (resources.length || resourcesTemplates.length) {
       this.#capabilities.resources = { listChanged: true, subscribe: true };
@@ -744,6 +765,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     }
   }
   promptsListChanged(prompts) {
+    if (!this.#canRefresh("prompts")) {
+      return;
+    }
     this.#prompts.clear();
     for (const prompt of prompts) {
       this.addPrompt(prompt);
@@ -758,6 +782,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     return this.#server.createMessage(message, options);
   }
   resourcesListChanged(resources) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resources.clear();
     for (const resource of resources) {
       this.addResource(resource);
@@ -766,6 +793,9 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     this.triggerListChangedNotification("notifications/resources/list_changed");
   }
   resourceTemplatesListChanged(resourceTemplates) {
+    if (!this.#canRefresh("resources")) {
+      return;
+    }
     this.#resourceTemplates.clear();
     for (const resourceTemplate of resourceTemplates) {
       this.addResourceTemplate(resourceTemplate);
@@ -795,6 +825,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   toolsListChanged(tools) {
+    if (!this.#canRefresh("tools")) {
+      return;
+    }
     this.setupToolHandlers(
       toolsVisibleTo(tools, this.#auth, this.#authRequired)
     );
@@ -857,6 +890,30 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
       this.#abortController.abort(new SessionError("Session closed"));
     }
   }
+  /**
+   * Whether this session can be told about a primitive added at runtime.
+   *
+   * A session that connected before the server had any tool, resource or prompt
+   * of its own never advertised that capability, and MCP fixes capabilities
+   * during `initialize` for the life of the session. Registering the handler
+   * anyway makes the SDK throw `Server does not support <capability>` — out of
+   * `addTool()`, `addResource()`, `addResourceTemplate()` or `addPrompt()`,
+   * which are the public builder methods, and out of the middle of the loop
+   * over sessions, so the sessions after this one never heard about the change
+   * either. Warn once instead and let the rest of the loop run.
+   */
+  #canRefresh(capability) {
+    if (this.#capabilities[capability]) {
+      return true;
+    }
+    if (!this.#unnegotiatedWarnings.has(capability)) {
+      this.#unnegotiatedWarnings.add(capability);
+      this.#logger.warn(
+        `[FastMCP warning] This session advertised no '${capability}' capability, because the server had none when the client connected, so it cannot be shown the ones registered since. Register one before start(), or reconnect the client; sessions that connect from now on do see them.`
+      );
+    }
+    return false;
+  }
   /**
    * Builds the context object passed as the third argument to
    * `resource.load` / `resourceTemplate.load` / `prompt.load`.
@@ -917,6 +974,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * disconnects mid-tool takes the server process down with it.
    */
   #sendLog(level, message, context) {
+    if (this.#loggingLevel && LOGGING_LEVEL_SEVERITY[level] < LOGGING_LEVEL_SEVERITY[this.#loggingLevel]) {
+      return;
+    }
     this.#server.sendLoggingMessage({
       data: {
         context,
@@ -940,6 +1000,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * request's own stream, which is the only server-to-client route that exists
    * when running stateless.
    *
+   * It is deliberately not filtered against the level the client set with
+   * `logging/setLevel`, unlike the `log` object a tool is handed: its job is to
+   * put bytes on the stream, and a client that asked for `error` only would
+   * otherwise switch off a feature the server opted into. Raise
+   * `streamKeepalive.logLevel` if the level it uses matters to you.
+   *
    * @returns a function that stops the keepalive.
    */
   #startStreamKeepalive(extra, toolName) {
@@ -1258,8 +1324,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               };
             }
             throw new McpError(
-              ErrorCode.MethodNotFound,
-              `Resource not found: '${request.params.uri}'. Available resources: ${Array.from(this.#resources.values()).map((r) => r.uri).join(", ") || "none"}`
+              ErrorCode.InvalidParams,
+              `Resource not found: '${request.params.uri}'. Available resources: ${Array.from(this.#resources.values()).map((r) => r.uri).join(", ") || "none"}`,
+              { uri: request.params.uri }
             );
           }
           if (!("uri" in resource)) {
@@ -1408,7 +1475,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         const tool = toolsMap.get(request.params.name);
         if (!tool) {
           throw new McpError(
-            ErrorCode.MethodNotFound,
+            ErrorCode.InvalidParams,
             `Unknown tool: ${request.params.name}`
           );
         }
@@ -1622,6 +1689,17 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+function protectedResourceMetadataUrl(resource) {
+  let url;
+  try {
+    url = new URL(resource);
+  } catch {
+    return `${resource}/.well-known/oauth-protected-resource`;
+  }
+  const path = url.pathname === "/" ? "" : url.pathname;
+  url.pathname = `/.well-known/oauth-protected-resource${path}`;
+  return url.toString();
+}
 var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Cache-Control": "no-store",
@@ -1664,10 +1742,9 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#authenticate = options.authenticate;
       }
       if (!options.oauth) {
-        this.#options = {
-          ...options,
-          oauth: options.auth.getOAuthConfig()
-        };
+        const oauth = options.auth.getOAuthConfig();
+        this.#providerResourceBase = oauth.protectedResource.resource;
+        this.#options = { ...options, oauth };
       }
     } else {
       this.#authenticate = options.authenticate;
@@ -1685,6 +1762,8 @@ var FastMCP = class extends FastMCPEventEmitter {
   #logger;
   #options;
   #prompts = [];
+  /** The auth provider's base URL, when it supplied the OAuth config. */
+  #providerResourceBase;
   #resources = [];
   #resourcesTemplates = [];
   #serverState = "stopped" /* Stopped */;
@@ -2111,6 +2190,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         httpConfig.basePath,
         httpConfig.endpoint
       );
+      this.#useEndpointAsResource(httpConfig.endpoint);
       if (httpConfig.stateless) {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
@@ -2279,7 +2359,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     ];
     if (resource) {
       wwwAuthenticateParts.push(
-        `resource_metadata="${resource}/.well-known/oauth-protected-resource"`
+        `resource_metadata="${protectedResourceMetadataUrl(resource)}"`
       );
     }
     return new Response(
@@ -2930,6 +3010,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       session.toolsListChanged(tools);
     }
   }
+  /**
+   * RFC 9728: the protected resource is the MCP endpoint clients connect to,
+   * and the metadata served at `/.well-known/oauth-protected-resource<endpoint>`
+   * must name it. An auth provider only knows its base URL, so the endpoint is
+   * appended once the server knows it. An explicit `oauth` config is left as
+   * it is.
+   */
+  #useEndpointAsResource(endpoint) {
+    const oauth = this.#options.oauth;
+    if (this.#providerResourceBase === void 0 || !oauth?.protectedResource)
+      return;
+    this.#options = {
+      ...this.#options,
+      oauth: {
+        ...oauth,
+        protectedResource: {
+          ...oauth.protectedResource,
+          resource: `${this.#providerResourceBase.replace(/\/+$/, "")}${normalizePath(endpoint)}`
+        }
+      }
+    };
+  }
 };
 
 export {
@@ -2946,4 +3048,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-QMRS4ZLD.js.map
+//# sourceMappingURL=chunk-XFUILY54.js.map