fastmcp 4.23.11 → 4.23.12

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkX5ITW7FVcjs = require('./chunk-X5ITW7FV.cjs');
+var _chunk4P2GDM7Wcjs = require('./chunk-4P2GDM7W.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkX5ITW7FVcjs = require('./chunk-X5ITW7FV.cjs');
 
 
 
-var _chunk4OWHPJELcjs = require('./chunk-4OWHPJEL.cjs');
+var _chunkBV4PWTT6cjs = require('./chunk-BV4PWTT6.cjs');
 require('./chunk-6TDYSPLC.cjs');
 
 
@@ -50,5 +50,5 @@ require('./chunk-6TDYSPLC.cjs');
 
 
 
-exports.AuthProvider = _chunk4OWHPJELcjs.AuthProvider; exports.AzureProvider = _chunk4OWHPJELcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkX5ITW7FVcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkX5ITW7FVcjs.FastMCP; exports.FastMCPError = _chunkX5ITW7FVcjs.FastMCPError; exports.FastMCPSession = _chunkX5ITW7FVcjs.FastMCPSession; exports.GitHubProvider = _chunk4OWHPJELcjs.GitHubProvider; exports.GoogleProvider = _chunk4OWHPJELcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkX5ITW7FVcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk4OWHPJELcjs.OAuthProvider; exports.ServerState = _chunkX5ITW7FVcjs.ServerState; exports.SessionError = _chunkX5ITW7FVcjs.SessionError; exports.UnexpectedStateError = _chunkX5ITW7FVcjs.UnexpectedStateError; exports.UserError = _chunkX5ITW7FVcjs.UserError; exports.audioContent = _chunkX5ITW7FVcjs.audioContent; exports.getAuthSession = _chunk4OWHPJELcjs.getAuthSession; exports.imageContent = _chunkX5ITW7FVcjs.imageContent; exports.jsonSchemaAdapter = _chunkX5ITW7FVcjs.jsonSchemaAdapter; exports.requireAll = _chunk4OWHPJELcjs.requireAll; exports.requireAny = _chunk4OWHPJELcjs.requireAny; exports.requireAuth = _chunk4OWHPJELcjs.requireAuth; exports.requireRole = _chunk4OWHPJELcjs.requireRole; exports.requireScopes = _chunk4OWHPJELcjs.requireScopes;
+exports.AuthProvider = _chunkBV4PWTT6cjs.AuthProvider; exports.AzureProvider = _chunkBV4PWTT6cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunk4P2GDM7Wcjs.DiscoveryDocumentCache; exports.FastMCP = _chunk4P2GDM7Wcjs.FastMCP; exports.FastMCPError = _chunk4P2GDM7Wcjs.FastMCPError; exports.FastMCPSession = _chunk4P2GDM7Wcjs.FastMCPSession; exports.GitHubProvider = _chunkBV4PWTT6cjs.GitHubProvider; exports.GoogleProvider = _chunkBV4PWTT6cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunk4P2GDM7Wcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkBV4PWTT6cjs.OAuthProvider; exports.ServerState = _chunk4P2GDM7Wcjs.ServerState; exports.SessionError = _chunk4P2GDM7Wcjs.SessionError; exports.UnexpectedStateError = _chunk4P2GDM7Wcjs.UnexpectedStateError; exports.UserError = _chunk4P2GDM7Wcjs.UserError; exports.audioContent = _chunk4P2GDM7Wcjs.audioContent; exports.getAuthSession = _chunkBV4PWTT6cjs.getAuthSession; exports.imageContent = _chunk4P2GDM7Wcjs.imageContent; exports.jsonSchemaAdapter = _chunk4P2GDM7Wcjs.jsonSchemaAdapter; exports.requireAll = _chunkBV4PWTT6cjs.requireAll; exports.requireAny = _chunkBV4PWTT6cjs.requireAny; exports.requireAuth = _chunkBV4PWTT6cjs.requireAuth; exports.requireRole = _chunkBV4PWTT6cjs.requireRole; exports.requireScopes = _chunkBV4PWTT6cjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BcDb5bOz.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BcDb5bOz.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-84BWWDBF.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-84BWWDBF.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BcDb5bOz.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BcDb5bOz.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-84BWWDBF.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-84BWWDBF.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-XUUJOVC7.js";
+} from "./chunk-ULNQF5KG.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-G44SPVP7.js";
+} from "./chunk-CAQLTSJ5.js";
 import "./chunk-OKKFL2M4.js";
 export {
   AuthProvider,

package/dist/{OAuthProvider-BcDb5bOz.d.cts → OAuthProvider-84BWWDBF.d.cts}

@@ -10,6 +10,11 @@ import { IncomingMessage } from 'node:http';
 declare const DEFAULT_ACCESS_TOKEN_TTL = 3600;
 declare const DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536000;
 declare const DEFAULT_REFRESH_TOKEN_TTL = 2592000;
+/**
+ * The token endpoint authentication methods the proxy can verify, and so the
+ * only ones a client may register with.
+ */
+declare const TOKEN_ENDPOINT_AUTH_METHODS: readonly ["client_secret_basic", "client_secret_post", "none"];
 declare const DEFAULT_AUTHORIZATION_CODE_TTL = 300;
 declare const DEFAULT_TRANSACTION_TTL = 600;
 /**
@@ -368,6 +373,17 @@ interface ProxyDCRClient {
      * Absent for a Dynamic Client Registration.
      */
     source?: "cimd";
+    /**
+     * How the client authenticates at the token endpoint, as it registered.
+     * `"none"` is a public client: it is issued no secret and must use S256
+     * PKCE. Either secret method obliges it to authenticate on every token
+     * request.
+     *
+     * Absent on registrations written before this was recorded, when every
+     * client was issued a secret whatever it asked for. Those are treated as
+     * public clients that may still authenticate with that secret.
+     */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
 }
 /**
  * OAuth refresh token request
@@ -379,11 +395,23 @@ interface RefreshRequest {
     refresh_token: string;
     scope?: string;
 }
+/**
+ * Token endpoint authentication methods a Dynamic Client Registration may ask
+ * for (RFC 7591 §2).
+ */
+type TokenEndpointAuthMethod = (typeof TOKEN_ENDPOINT_AUTH_METHODS)[number];
 /**
  * Token mapping for JWT swap pattern
  * Maps JTI to upstream token reference
  */
 interface TokenMapping {
+    /**
+     * Whether the client authenticated with its secret when this token was
+     * issued. A refresh token issued that way is only redeemed by a client that
+     * authenticates again; otherwise omitting the secret would turn it back into
+     * a bearer token.
+     */
+    clientAuthenticated?: boolean;
     /** Client ID */
     clientId: string;
     /** Creation timestamp */
@@ -581,6 +609,20 @@ declare class OAuthProxy {
      * RFC 7591 Dynamic Client Registration
      */
     registerClient(request: DCRRequest): Promise<DCRResponse>;
+    /**
+     * RFC 6749 §2.3 / §3.2.1: identify the client behind a token request and,
+     * when it presents a secret, authenticate it.
+     *
+     * A client registered with a secret method must present its secret. A
+     * public client must not present one: it was issued none. A registration
+     * that predates recorded auth methods may do either — it was issued a
+     * secret whatever it asked for — and is treated as unauthenticated when it
+     * leaves it out, which the grants then hold it to.
+     *
+     * Throws `invalid_client` on any failure. Nothing here touches grant state,
+     * so a caller that fails cannot spend a code or refresh token.
+     */
+    private authenticateClient;
     /**
      * Calculate access token TTL from upstream tokens
      */
@@ -669,6 +711,12 @@ declare class OAuthProxy {
      * GitHub Apps return URL-encoded format, most providers return JSON
      */
     private parseTokenResponse;
+    /**
+     * Storage key for the client binding of a passthrough-mode upstream refresh
+     * token. Keyed by its hash: storage keys are not encrypted, and the token
+     * itself is a live upstream credential.
+     */
+    private passthroughRefreshKey;
     /**
      * Redirect to upstream OAuth provider
      */
@@ -698,6 +746,12 @@ declare class OAuthProxy {
      * `expiresAt`.
      */
     private restoreMapping;
+    /**
+     * Record which client a passthrough-mode upstream refresh token was handed
+     * to. It lives as long as the upstream says the token does, or as the
+     * configured refresh-token lifetime when it does not say.
+     */
+    private savePassthroughRefreshBinding;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
@@ -990,4 +1044,4 @@ declare class OAuthProvider<TSession extends OAuthSession = OAuthSession> extend
     protected getTokenEndpoint(): string;
 }
 
-export { AuthProvider as A, type DCRClientMetadata as B, type ConsentData as C, DEFAULT_ACCESS_TOKEN_TTL as D, type DCRRequest as E, type DCRResponse as F, GitHubProvider as G, type OAuthError as H, type OAuthProviderConfig as I, type OAuthProxyConfig as J, type ProxyDCRClient as K, type TokenMapping as L, type TokenRequest as M, type TokenResponse as N, type OAuthSession as O, type PKCEPair as P, type RefreshRequest as R, type TokenStorage as T, type UpstreamTokenSet as U, OAuthProxy as a, AzureProvider as b, GoogleProvider as c, OAuthProvider as d, requireAny as e, requireAuth as f, getAuthSession as g, requireRole as h, requireScopes as i, type AuthProviderConfig as j, type AzureProviderConfig as k, type AzureSession as l, type GenericOAuthProviderConfig as m, type GitHubSession as n, type GoogleSession as o, type OAuthTransaction as p, type TokenVerifier as q, requireAll as r, type TokenVerificationResult as s, OAuthProxyError as t, DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH as u, DEFAULT_AUTHORIZATION_CODE_TTL as v, DEFAULT_REFRESH_TOKEN_TTL as w, DEFAULT_TRANSACTION_TTL as x, type AuthorizationParams as y, type ClientCode as z };
+export { AuthProvider as A, type ClientCode as B, type ConsentData as C, DEFAULT_ACCESS_TOKEN_TTL as D, type DCRClientMetadata as E, type DCRRequest as F, GitHubProvider as G, type DCRResponse as H, type OAuthError as I, type OAuthProviderConfig as J, type OAuthProxyConfig as K, type ProxyDCRClient as L, type TokenEndpointAuthMethod as M, type TokenMapping as N, type OAuthSession as O, type PKCEPair as P, type TokenRequest as Q, type RefreshRequest as R, type TokenResponse as S, type TokenStorage as T, type UpstreamTokenSet as U, OAuthProxy as a, AzureProvider as b, GoogleProvider as c, OAuthProvider as d, requireAny as e, requireAuth as f, getAuthSession as g, requireRole as h, requireScopes as i, type AuthProviderConfig as j, type AzureProviderConfig as k, type AzureSession as l, type GenericOAuthProviderConfig as m, type GitHubSession as n, type GoogleSession as o, type OAuthTransaction as p, type TokenVerifier as q, requireAll as r, type TokenVerificationResult as s, OAuthProxyError as t, DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH as u, DEFAULT_AUTHORIZATION_CODE_TTL as v, DEFAULT_REFRESH_TOKEN_TTL as w, DEFAULT_TRANSACTION_TTL as x, TOKEN_ENDPOINT_AUTH_METHODS as y, type AuthorizationParams as z };

package/dist/{OAuthProvider-BcDb5bOz.d.ts → OAuthProvider-84BWWDBF.d.ts}

@@ -10,6 +10,11 @@ import { IncomingMessage } from 'node:http';
 declare const DEFAULT_ACCESS_TOKEN_TTL = 3600;
 declare const DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536000;
 declare const DEFAULT_REFRESH_TOKEN_TTL = 2592000;
+/**
+ * The token endpoint authentication methods the proxy can verify, and so the
+ * only ones a client may register with.
+ */
+declare const TOKEN_ENDPOINT_AUTH_METHODS: readonly ["client_secret_basic", "client_secret_post", "none"];
 declare const DEFAULT_AUTHORIZATION_CODE_TTL = 300;
 declare const DEFAULT_TRANSACTION_TTL = 600;
 /**
@@ -368,6 +373,17 @@ interface ProxyDCRClient {
      * Absent for a Dynamic Client Registration.
      */
     source?: "cimd";
+    /**
+     * How the client authenticates at the token endpoint, as it registered.
+     * `"none"` is a public client: it is issued no secret and must use S256
+     * PKCE. Either secret method obliges it to authenticate on every token
+     * request.
+     *
+     * Absent on registrations written before this was recorded, when every
+     * client was issued a secret whatever it asked for. Those are treated as
+     * public clients that may still authenticate with that secret.
+     */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
 }
 /**
  * OAuth refresh token request
@@ -379,11 +395,23 @@ interface RefreshRequest {
     refresh_token: string;
     scope?: string;
 }
+/**
+ * Token endpoint authentication methods a Dynamic Client Registration may ask
+ * for (RFC 7591 §2).
+ */
+type TokenEndpointAuthMethod = (typeof TOKEN_ENDPOINT_AUTH_METHODS)[number];
 /**
  * Token mapping for JWT swap pattern
  * Maps JTI to upstream token reference
  */
 interface TokenMapping {
+    /**
+     * Whether the client authenticated with its secret when this token was
+     * issued. A refresh token issued that way is only redeemed by a client that
+     * authenticates again; otherwise omitting the secret would turn it back into
+     * a bearer token.
+     */
+    clientAuthenticated?: boolean;
     /** Client ID */
     clientId: string;
     /** Creation timestamp */
@@ -581,6 +609,20 @@ declare class OAuthProxy {
      * RFC 7591 Dynamic Client Registration
      */
     registerClient(request: DCRRequest): Promise<DCRResponse>;
+    /**
+     * RFC 6749 §2.3 / §3.2.1: identify the client behind a token request and,
+     * when it presents a secret, authenticate it.
+     *
+     * A client registered with a secret method must present its secret. A
+     * public client must not present one: it was issued none. A registration
+     * that predates recorded auth methods may do either — it was issued a
+     * secret whatever it asked for — and is treated as unauthenticated when it
+     * leaves it out, which the grants then hold it to.
+     *
+     * Throws `invalid_client` on any failure. Nothing here touches grant state,
+     * so a caller that fails cannot spend a code or refresh token.
+     */
+    private authenticateClient;
     /**
      * Calculate access token TTL from upstream tokens
      */
@@ -669,6 +711,12 @@ declare class OAuthProxy {
      * GitHub Apps return URL-encoded format, most providers return JSON
      */
     private parseTokenResponse;
+    /**
+     * Storage key for the client binding of a passthrough-mode upstream refresh
+     * token. Keyed by its hash: storage keys are not encrypted, and the token
+     * itself is a live upstream credential.
+     */
+    private passthroughRefreshKey;
     /**
      * Redirect to upstream OAuth provider
      */
@@ -698,6 +746,12 @@ declare class OAuthProxy {
      * `expiresAt`.
      */
     private restoreMapping;
+    /**
+     * Record which client a passthrough-mode upstream refresh token was handed
+     * to. It lives as long as the upstream says the token does, or as the
+     * configured refresh-token lifetime when it does not say.
+     */
+    private savePassthroughRefreshBinding;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
@@ -990,4 +1044,4 @@ declare class OAuthProvider<TSession extends OAuthSession = OAuthSession> extend
     protected getTokenEndpoint(): string;
 }
 
-export { AuthProvider as A, type DCRClientMetadata as B, type ConsentData as C, DEFAULT_ACCESS_TOKEN_TTL as D, type DCRRequest as E, type DCRResponse as F, GitHubProvider as G, type OAuthError as H, type OAuthProviderConfig as I, type OAuthProxyConfig as J, type ProxyDCRClient as K, type TokenMapping as L, type TokenRequest as M, type TokenResponse as N, type OAuthSession as O, type PKCEPair as P, type RefreshRequest as R, type TokenStorage as T, type UpstreamTokenSet as U, OAuthProxy as a, AzureProvider as b, GoogleProvider as c, OAuthProvider as d, requireAny as e, requireAuth as f, getAuthSession as g, requireRole as h, requireScopes as i, type AuthProviderConfig as j, type AzureProviderConfig as k, type AzureSession as l, type GenericOAuthProviderConfig as m, type GitHubSession as n, type GoogleSession as o, type OAuthTransaction as p, type TokenVerifier as q, requireAll as r, type TokenVerificationResult as s, OAuthProxyError as t, DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH as u, DEFAULT_AUTHORIZATION_CODE_TTL as v, DEFAULT_REFRESH_TOKEN_TTL as w, DEFAULT_TRANSACTION_TTL as x, type AuthorizationParams as y, type ClientCode as z };
+export { AuthProvider as A, type ClientCode as B, type ConsentData as C, DEFAULT_ACCESS_TOKEN_TTL as D, type DCRClientMetadata as E, type DCRRequest as F, GitHubProvider as G, type DCRResponse as H, type OAuthError as I, type OAuthProviderConfig as J, type OAuthProxyConfig as K, type ProxyDCRClient as L, type TokenEndpointAuthMethod as M, type TokenMapping as N, type OAuthSession as O, type PKCEPair as P, type TokenRequest as Q, type RefreshRequest as R, type TokenResponse as S, type TokenStorage as T, type UpstreamTokenSet as U, OAuthProxy as a, AzureProvider as b, GoogleProvider as c, OAuthProvider as d, requireAny as e, requireAuth as f, getAuthSession as g, requireRole as h, requireScopes as i, type AuthProviderConfig as j, type AzureProviderConfig as k, type AzureSession as l, type GenericOAuthProviderConfig as m, type GitHubSession as n, type GoogleSession as o, type OAuthTransaction as p, type TokenVerifier as q, requireAll as r, type TokenVerificationResult as s, OAuthProxyError as t, DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH as u, DEFAULT_AUTHORIZATION_CODE_TTL as v, DEFAULT_REFRESH_TOKEN_TTL as w, DEFAULT_TRANSACTION_TTL as x, TOKEN_ENDPOINT_AUTH_METHODS as y, type AuthorizationParams as z };

package/dist/auth/index.cjs

@@ -24,8 +24,8 @@
 
 
 
-var _chunk4OWHPJELcjs = require('../chunk-4OWHPJEL.cjs');
 
+var _chunkBV4PWTT6cjs = require('../chunk-BV4PWTT6.cjs');
 
 
 
@@ -51,5 +51,7 @@ var _chunk4OWHPJELcjs = require('../chunk-4OWHPJEL.cjs');
 
 
 
-exports.AuthProvider = _chunk4OWHPJELcjs.AuthProvider; exports.AzureProvider = _chunk4OWHPJELcjs.AzureProvider; exports.ConsentManager = _chunk4OWHPJELcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk4OWHPJELcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk4OWHPJELcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk4OWHPJELcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk4OWHPJELcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk4OWHPJELcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk4OWHPJELcjs.DiskStore; exports.EncryptedTokenStorage = _chunk4OWHPJELcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk4OWHPJELcjs.GitHubProvider; exports.GoogleProvider = _chunk4OWHPJELcjs.GoogleProvider; exports.JWKSVerifier = _chunk4OWHPJELcjs.JWKSVerifier; exports.JWTIssuer = _chunk4OWHPJELcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk4OWHPJELcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk4OWHPJELcjs.OAuthProvider; exports.OAuthProxy = _chunk4OWHPJELcjs.OAuthProxy; exports.OAuthProxyError = _chunk4OWHPJELcjs.OAuthProxyError; exports.PKCEUtils = _chunk4OWHPJELcjs.PKCEUtils; exports.getAuthSession = _chunk4OWHPJELcjs.getAuthSession; exports.requireAll = _chunk4OWHPJELcjs.requireAll; exports.requireAny = _chunk4OWHPJELcjs.requireAny; exports.requireAuth = _chunk4OWHPJELcjs.requireAuth; exports.requireRole = _chunk4OWHPJELcjs.requireRole; exports.requireScopes = _chunk4OWHPJELcjs.requireScopes;
+
+
+exports.AuthProvider = _chunkBV4PWTT6cjs.AuthProvider; exports.AzureProvider = _chunkBV4PWTT6cjs.AzureProvider; exports.ConsentManager = _chunkBV4PWTT6cjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkBV4PWTT6cjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkBV4PWTT6cjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkBV4PWTT6cjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkBV4PWTT6cjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkBV4PWTT6cjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkBV4PWTT6cjs.DiskStore; exports.EncryptedTokenStorage = _chunkBV4PWTT6cjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkBV4PWTT6cjs.GitHubProvider; exports.GoogleProvider = _chunkBV4PWTT6cjs.GoogleProvider; exports.JWKSVerifier = _chunkBV4PWTT6cjs.JWKSVerifier; exports.JWTIssuer = _chunkBV4PWTT6cjs.JWTIssuer; exports.MemoryTokenStorage = _chunkBV4PWTT6cjs.MemoryTokenStorage; exports.OAuthProvider = _chunkBV4PWTT6cjs.OAuthProvider; exports.OAuthProxy = _chunkBV4PWTT6cjs.OAuthProxy; exports.OAuthProxyError = _chunkBV4PWTT6cjs.OAuthProxyError; exports.PKCEUtils = _chunkBV4PWTT6cjs.PKCEUtils; exports.TOKEN_ENDPOINT_AUTH_METHODS = _chunkBV4PWTT6cjs.TOKEN_ENDPOINT_AUTH_METHODS; exports.getAuthSession = _chunkBV4PWTT6cjs.getAuthSession; exports.requireAll = _chunkBV4PWTT6cjs.requireAll; exports.requireAny = _chunkBV4PWTT6cjs.requireAny; exports.requireAuth = _chunkBV4PWTT6cjs.requireAuth; exports.requireRole = _chunkBV4PWTT6cjs.requireRole; exports.requireScopes = _chunkBV4PWTT6cjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/auth/index.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,yDAA8B;AAC9B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,ghDAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/auth/index.cjs"}
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/auth/index.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,yDAA8B;AAC9B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,qmDAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/auth/index.cjs"}

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BcDb5bOz.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BcDb5bOz.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-84BWWDBF.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, z as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, B as ClientCode, E as DCRClientMetadata, F as DCRRequest, H as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, I as OAuthError, d as OAuthProvider, J as OAuthProviderConfig, a as OAuthProxy, K as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, L as ProxyDCRClient, R as RefreshRequest, y as TOKEN_ENDPOINT_AUTH_METHODS, M as TokenEndpointAuthMethod, N as TokenMapping, Q as TokenRequest, S as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-84BWWDBF.cjs';
 import 'node:http';
 
 /**
@@ -150,6 +150,14 @@ interface JWTClaims {
     jti: string;
     /** Scopes */
     scope: string[];
+    /**
+     * Which kind of token this is. Access and refresh tokens share a signing
+     * key, audience and claim set, so without this either one verifies as the
+     * other: an access token — sent on every request — could be redeemed for a
+     * refresh token, and a refresh token presented as a bearer credential.
+     * Absent from tokens issued before it existed; those are refused as both.
+     */
+    token_use?: "access" | "refresh";
 }
 /**
  * JWT Issuer configuration

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BcDb5bOz.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BcDb5bOz.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-84BWWDBF.js';
+export { A as AuthProvider, j as AuthProviderConfig, z as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, B as ClientCode, E as DCRClientMetadata, F as DCRRequest, H as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, I as OAuthError, d as OAuthProvider, J as OAuthProviderConfig, a as OAuthProxy, K as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, L as ProxyDCRClient, R as RefreshRequest, y as TOKEN_ENDPOINT_AUTH_METHODS, M as TokenEndpointAuthMethod, N as TokenMapping, Q as TokenRequest, S as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-84BWWDBF.js';
 import 'node:http';
 
 /**
@@ -150,6 +150,14 @@ interface JWTClaims {
     jti: string;
     /** Scopes */
     scope: string[];
+    /**
+     * Which kind of token this is. Access and refresh tokens share a signing
+     * key, audience and claim set, so without this either one verifies as the
+     * other: an access token — sent on every request — could be redeemed for a
+     * refresh token, and a refresh token presented as a bearer credential.
+     * Absent from tokens issued before it existed; those are refused as both.
+     */
+    token_use?: "access" | "refresh";
 }
 /**
  * JWT Issuer configuration

package/dist/auth/index.js

@@ -18,13 +18,14 @@ import {
   OAuthProxy,
   OAuthProxyError,
   PKCEUtils,
+  TOKEN_ENDPOINT_AUTH_METHODS,
   getAuthSession,
   requireAll,
   requireAny,
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-G44SPVP7.js";
+} from "../chunk-CAQLTSJ5.js";
 export {
   AuthProvider,
   AzureProvider,
@@ -45,6 +46,7 @@ export {
   OAuthProxy,
   OAuthProxyError,
   PKCEUtils,
+  TOKEN_ENDPOINT_AUTH_METHODS,
   getAuthSession,
   requireAll,
   requireAny,

package/dist/{chunk-X5ITW7FV.cjs → chunk-4P2GDM7W.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunk4OWHPJELcjs = require('./chunk-4OWHPJEL.cjs');
+var _chunkBV4PWTT6cjs = require('./chunk-BV4PWTT6.cjs');
 
 
 
@@ -141,7 +141,7 @@ var DiscoveryDocumentCache = class {
       throw error;
     }
     if (!res.ok) {
-      await _chunk4OWHPJELcjs.cancelResponseBody.call(void 0, res);
+      await _chunkBV4PWTT6cjs.cancelResponseBody.call(void 0, res);
       throw new Error(
         `Failed to fetch discovery document from ${url}: ${res.status} ${res.statusText}`
       );
@@ -258,7 +258,7 @@ var imageContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await _chunk4OWHPJELcjs.cancelResponseBody.call(void 0, response);
+          await _chunkBV4PWTT6cjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -340,7 +340,7 @@ var audioContent = async (input) => {
           signal: AbortSignal.timeout(timeoutMs)
         });
         if (!response.ok) {
-          await _chunk4OWHPJELcjs.cancelResponseBody.call(void 0, response);
+          await _chunkBV4PWTT6cjs.cancelResponseBody.call(void 0, response);
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
@@ -1914,15 +1914,20 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _66 => _66.match, 'call', _67 => _67(/^Basic\s+(.+)$/)]);
+  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _66 => _66.match, 'call', _67 => _67(/^Basic\s+(.*)$/i)]);
   if (!basicMatch) return null;
+  const credentials = Buffer.from(basicMatch[1].trim(), "base64").toString(
+    "utf-8"
+  );
+  const separator = credentials.indexOf(":");
+  if (separator <= 0) return "malformed";
   try {
-    const credentials = Buffer.from(basicMatch[1], "base64").toString("utf-8");
-    const credMatch = credentials.match(/^([^:]+):(.*)$/);
-    if (!credMatch) return null;
-    return { clientId: credMatch[1], clientSecret: credMatch[2] };
+    return {
+      clientId: decodeURIComponent(credentials.slice(0, separator)),
+      clientSecret: decodeURIComponent(credentials.slice(separator + 1))
+    };
   } catch (e6) {
-    return null;
+    return "malformed";
   }
 }
 function parseBooleanSetting(value, source) {
@@ -1971,6 +1976,10 @@ var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Content-Type": "application/json",
   Pragma: "no-cache"
 };
+var OAUTH_INVALID_CLIENT_RESPONSE_HEADERS = {
+  ...OAUTH_CREDENTIAL_RESPONSE_HEADERS,
+  "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"'
+};
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -3054,8 +3063,37 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = _optionalChain([basicAuth, 'optionalAccess', _84 => _84.clientId]) || params.get("client_id") || "";
-                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _85 => _85.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
+                if (basicAuth === "malformed") {
+                  throw {
+                    toJSON: () => ({
+                      error: "invalid_client",
+                      error_description: "Malformed Basic Authorization header"
+                    })
+                  };
+                }
+                if (basicAuth) {
+                  if (params.has("client_secret")) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "Send client credentials in the Authorization header or the request body, not both"
+                      })
+                    };
+                  }
+                  const bodyClientId = params.get("client_id");
+                  if (bodyClientId !== null && bodyClientId !== basicAuth.clientId) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "client_id in the request body does not match the Authorization header"
+                      })
+                    };
+                  }
+                }
+                const clientId = basicAuth ? basicAuth.clientId : params.get("client_id") || "";
+                const clientSecret = basicAuth ? basicAuth.clientSecret : _nullishCoalesce(params.get("client_secret"), () => ( void 0));
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -3082,14 +3120,15 @@ var FastMCP = class extends FastMCPEventEmitter {
                 }
                 res.writeHead(200, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(response));
               } catch (error) {
-                const statusCode = error.statusCode || 400;
-                res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
-                  JSON.stringify(
-                    _optionalChain([error, 'access', _86 => _86.toJSON, 'optionalCall', _87 => _87()]) || {
-                      error: "invalid_request"
-                    }
-                  )
-                );
+                const body = _optionalChain([error, 'access', _84 => _84.toJSON, 'optionalCall', _85 => _85()]) || {
+                  error: "invalid_request"
+                };
+                if (body.error === "invalid_client") {
+                  res.writeHead(401, OAUTH_INVALID_CLIENT_RESPONSE_HEADERS).end(JSON.stringify(body));
+                } else {
+                  const statusCode = error.statusCode || 400;
+                  res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(body));
+                }
               }
               resolve();
             });
@@ -3111,7 +3150,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    * regardless (RFC 7235), so no config is needed just to get the header.
    */
   #httpStreamOAuthConfig() {
-    const resource = _optionalChain([this, 'access', _88 => _88.#options, 'access', _89 => _89.oauth, 'optionalAccess', _90 => _90.enabled]) ? _optionalChain([this, 'access', _91 => _91.#options, 'access', _92 => _92.oauth, 'access', _93 => _93.protectedResource, 'optionalAccess', _94 => _94.resource]) : void 0;
+    const resource = _optionalChain([this, 'access', _86 => _86.#options, 'access', _87 => _87.oauth, 'optionalAccess', _88 => _88.enabled]) ? _optionalChain([this, 'access', _89 => _89.#options, 'access', _90 => _90.oauth, 'access', _91 => _91.protectedResource, 'optionalAccess', _92 => _92.resource]) : void 0;
     if (!resource) {
       return {};
     }
@@ -3217,24 +3256,24 @@ var FastMCP = class extends FastMCPEventEmitter {
     const envBasePath = process.env.FASTMCP_BASE_PATH;
     const envStateless = process.env.FASTMCP_STATELESS;
     const envHost = process.env.FASTMCP_HOST;
-    const transportType = _optionalChain([overrides, 'optionalAccess', _95 => _95.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
+    const transportType = _optionalChain([overrides, 'optionalAccess', _93 => _93.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
     if (transportType === "httpStream") {
       const port = parseInt(
-        _optionalChain([overrides, 'optionalAccess', _96 => _96.httpStream, 'optionalAccess', _97 => _97.port, 'optionalAccess', _98 => _98.toString, 'call', _99 => _99()]) || portArg || envPort || "8080"
+        _optionalChain([overrides, 'optionalAccess', _94 => _94.httpStream, 'optionalAccess', _95 => _95.port, 'optionalAccess', _96 => _96.toString, 'call', _97 => _97()]) || portArg || envPort || "8080"
       );
-      const host = _optionalChain([overrides, 'optionalAccess', _100 => _100.httpStream, 'optionalAccess', _101 => _101.host]) || hostArg || envHost || "localhost";
-      const endpoint = _optionalChain([overrides, 'optionalAccess', _102 => _102.httpStream, 'optionalAccess', _103 => _103.endpoint]) || endpointArg || envEndpoint || "/mcp";
+      const host = _optionalChain([overrides, 'optionalAccess', _98 => _98.httpStream, 'optionalAccess', _99 => _99.host]) || hostArg || envHost || "localhost";
+      const endpoint = _optionalChain([overrides, 'optionalAccess', _100 => _100.httpStream, 'optionalAccess', _101 => _101.endpoint]) || endpointArg || envEndpoint || "/mcp";
       const basePath = normalizeBasePath(
-        _optionalChain([overrides, 'optionalAccess', _104 => _104.httpStream, 'optionalAccess', _105 => _105.basePath]) || basePathArg || envBasePath
+        _optionalChain([overrides, 'optionalAccess', _102 => _102.httpStream, 'optionalAccess', _103 => _103.basePath]) || basePathArg || envBasePath
       );
-      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _106 => _106.httpStream, 'optionalAccess', _107 => _107.enableJsonResponse]) || false;
-      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _108 => _108.httpStream, 'optionalAccess', _109 => _109.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
+      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _104 => _104.httpStream, 'optionalAccess', _105 => _105.enableJsonResponse]) || false;
+      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _106 => _106.httpStream, 'optionalAccess', _107 => _107.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
       (statelessArg === "" ? true : parseBooleanSetting(statelessArg, "--stateless")))), () => ( parseBooleanSetting(envStateless, "FASTMCP_STATELESS"))), () => ( false));
-      const cors = _optionalChain([overrides, 'optionalAccess', _110 => _110.httpStream, 'optionalAccess', _111 => _111.cors]);
-      const eventStore = _optionalChain([overrides, 'optionalAccess', _112 => _112.httpStream, 'optionalAccess', _113 => _113.eventStore]);
-      const sslCa = _optionalChain([overrides, 'optionalAccess', _114 => _114.httpStream, 'optionalAccess', _115 => _115.sslCa]);
-      const sslCert = _optionalChain([overrides, 'optionalAccess', _116 => _116.httpStream, 'optionalAccess', _117 => _117.sslCert]);
-      const sslKey = _optionalChain([overrides, 'optionalAccess', _118 => _118.httpStream, 'optionalAccess', _119 => _119.sslKey]);
+      const cors = _optionalChain([overrides, 'optionalAccess', _108 => _108.httpStream, 'optionalAccess', _109 => _109.cors]);
+      const eventStore = _optionalChain([overrides, 'optionalAccess', _110 => _110.httpStream, 'optionalAccess', _111 => _111.eventStore]);
+      const sslCa = _optionalChain([overrides, 'optionalAccess', _112 => _112.httpStream, 'optionalAccess', _113 => _113.sslCa]);
+      const sslCert = _optionalChain([overrides, 'optionalAccess', _114 => _114.httpStream, 'optionalAccess', _115 => _115.sslCert]);
+      const sslKey = _optionalChain([overrides, 'optionalAccess', _116 => _116.httpStream, 'optionalAccess', _117 => _117.sslKey]);
       return {
         httpStream: {
           basePath,
@@ -3326,7 +3365,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #useEndpointAsResource(endpoint) {
     const oauth = this.#options.oauth;
-    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _120 => _120.protectedResource]))
+    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _118 => _118.protectedResource]))
       return;
     this.#options = {
       ...this.#options,
@@ -3355,4 +3394,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-X5ITW7FV.cjs.map
+//# sourceMappingURL=chunk-4P2GDM7W.cjs.map