fastmcp 4.23.14 → 4.24.0

package/dist/{chunk-7USB5QLH.cjs → chunk-JMH7WDO2.cjs}

@@ -490,6 +490,8 @@ var LOGGING_LEVEL_SEVERITY = {
   notice: 2,
   warning: 3
 };
+var INSUFFICIENT_SCOPE_ERROR_CODE = -32001;
+var SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
 var FastMCPSessionEventEmitterBase = _events.EventEmitter;
 var ServerState = /* @__PURE__ */ ((ServerState2) => {
   ServerState2["Error"] = "error";
@@ -792,6 +794,24 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.setupResourceTemplateHandlers();
     this.triggerListChangedNotification("notifications/resources/list_changed");
   }
+  /**
+   * The scope challenge one message a client sent would get, or `undefined` to
+   * let it through. FastMCP's HTTP transports ask before mcp-proxy dispatches
+   * each message, the last point at which the answer can still be a 403; the
+   * `tools/call` handler applies the same check on every transport.
+   */
+  scopeChallengeFor(message) {
+    if (typeof message !== "object" || message === null) {
+      return void 0;
+    }
+    const { method, params } = message;
+    if (method !== "tools/call" || typeof params !== "object" || !params) {
+      return void 0;
+    }
+    const { name } = params;
+    const tool = this.#visibleTools.find((visible) => visible.name === name);
+    return tool ? this.#scopeChallenge(tool) : void 0;
+  }
   /**
    * Notifies the connected client that the contents of a resource have changed.
    *
@@ -1030,6 +1050,27 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
       }
     }
   }
+  /**
+   * The challenge a call to `tool` gets while the session's token lacks the
+   * tool's `scopes`, or `undefined` when it may run. Applied on the same terms
+   * as `canAccess` (see `toolsVisibleTo`): never without auth on a server that
+   * does not authenticate, and with nothing granted when a server that does
+   * has no auth for this session.
+   */
+  #scopeChallenge(tool) {
+    if (!_optionalChain([tool, 'access', _41 => _41.scopes, 'optionalAccess', _42 => _42.length]) || !this.#auth && !this.#authRequired) {
+      return void 0;
+    }
+    const granted = grantedScopes(this.#auth);
+    const missing = tool.scopes.filter((scope) => !granted.includes(scope));
+    if (missing.length === 0) {
+      return void 0;
+    }
+    return {
+      description: `Insufficient scope for tool '${tool.name}': requires ${missing.join(" ")}`,
+      scopes: [.../* @__PURE__ */ new Set([...granted, ...tool.scopes])]
+    };
+  }
   /**
    * Sending rejects once the client has hung up, and these four
    * callers are synchronous, so the rejection has nowhere to go. Swallow it the
@@ -1141,7 +1182,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    */
   #startStreamKeepalive(extra, toolName) {
     const config = this.#streamKeepaliveConfig;
-    if (!_optionalChain([config, 'optionalAccess', _41 => _41.enabled]) || _optionalChain([extra, 'access', _42 => _42.signal, 'optionalAccess', _43 => _43.aborted])) {
+    if (!_optionalChain([config, 'optionalAccess', _43 => _43.enabled]) || _optionalChain([extra, 'access', _44 => _44.signal, 'optionalAccess', _45 => _45.aborted])) {
       return () => {
       };
     }
@@ -1161,12 +1202,12 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         );
       });
     }, intervalMs);
-    _optionalChain([timer, 'access', _44 => _44.unref, 'optionalCall', _45 => _45()]);
+    _optionalChain([timer, 'access', _46 => _46.unref, 'optionalCall', _47 => _47()]);
     const stop = () => {
       clearInterval(timer);
-      _optionalChain([extra, 'access', _46 => _46.signal, 'optionalAccess', _47 => _47.removeEventListener, 'call', _48 => _48("abort", stop)]);
+      _optionalChain([extra, 'access', _48 => _48.signal, 'optionalAccess', _49 => _49.removeEventListener, 'call', _50 => _50("abort", stop)]);
     };
-    _optionalChain([extra, 'access', _49 => _49.signal, 'optionalAccess', _50 => _50.addEventListener, 'call', _51 => _51("abort", stop, { once: true })]);
+    _optionalChain([extra, 'access', _51 => _51.signal, 'optionalAccess', _52 => _52.addEventListener, 'call', _53 => _53("abort", stop, { once: true })]);
     return stop;
   }
   async #validateStructuredContent(tool, value, toolName) {
@@ -1386,7 +1427,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
             _nullishCoalesce(args, () => ( {})),
             this.#auth,
             this.#createLoadContext(
-              _optionalChain([request, 'access', _52 => _52.params, 'optionalAccess', _53 => _53._meta]),
+              _optionalChain([request, 'access', _54 => _54.params, 'optionalAccess', _55 => _55._meta]),
               extra.sendNotification,
               extra.requestId
             )
@@ -1455,7 +1496,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
                 match,
                 this.#auth,
                 this.#createLoadContext(
-                  _optionalChain([request, 'access', _54 => _54.params, 'optionalAccess', _55 => _55._meta]),
+                  _optionalChain([request, 'access', _56 => _56.params, 'optionalAccess', _57 => _57._meta]),
                   extra.sendNotification,
                   extra.requestId
                 )
@@ -1487,7 +1528,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
             maybeArrayResult = await resource.load(
               this.#auth,
               this.#createLoadContext(
-                _optionalChain([request, 'access', _56 => _56.params, 'optionalAccess', _57 => _57._meta]),
+                _optionalChain([request, 'access', _58 => _58.params, 'optionalAccess', _59 => _59._meta]),
                 extra.sendNotification,
                 extra.requestId
               )
@@ -1553,7 +1594,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     );
   }
   setupRootsHandlers() {
-    if (_optionalChain([this, 'access', _58 => _58.#rootsConfig, 'optionalAccess', _59 => _59.enabled]) === false) {
+    if (_optionalChain([this, 'access', _60 => _60.#rootsConfig, 'optionalAccess', _61 => _61.enabled]) === false) {
       this.#logger.debug(
         "[FastMCP debug] roots capability explicitly disabled via config"
       );
@@ -1636,6 +1677,14 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
             `Unknown tool: ${request.params.name}`
           );
         }
+        const challenge = this.#scopeChallenge(tool);
+        if (challenge) {
+          throw new (0, _typesjs.McpError)(
+            INSUFFICIENT_SCOPE_ERROR_CODE,
+            challenge.description,
+            { error: "insufficient_scope", required_scopes: challenge.scopes }
+          );
+        }
         let args = void 0;
         if (tool.parameters) {
           const parsed = await tool.parameters["~standard"].validate(
@@ -1650,7 +1699,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           }
           args = parsed.value;
         }
-        const progressToken = _optionalChain([request, 'access', _60 => _60.params, 'optionalAccess', _61 => _61._meta, 'optionalAccess', _62 => _62.progressToken]);
+        const progressToken = _optionalChain([request, 'access', _62 => _62.params, 'optionalAccess', _63 => _63._meta, 'optionalAccess', _64 => _64.progressToken]);
         let result;
         const timeoutAbort = new AbortController();
         const signal = AbortSignal.any([
@@ -1730,7 +1779,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               elicit: this.#createElicit(extra.requestId),
               log,
               reportProgress,
-              requestId: typeof _optionalChain([request, 'access', _63 => _63.params, 'optionalAccess', _64 => _64._meta, 'optionalAccess', _65 => _65.requestId]) === "string" ? request.params._meta.requestId : void 0,
+              requestId: typeof _optionalChain([request, 'access', _65 => _65.params, 'optionalAccess', _66 => _66._meta, 'optionalAccess', _67 => _67.requestId]) === "string" ? request.params._meta.requestId : void 0,
               session: this.#auth,
               sessionId: this.sessionId,
               signal,
@@ -1914,7 +1963,7 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _66 => _66.match, 'call', _67 => _67(/^Basic\s+(.*)$/i)]);
+  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _68 => _68.match, 'call', _69 => _69(/^Basic\s+(.*)$/i)]);
   if (!basicMatch) return null;
   const credentials = Buffer.from(basicMatch[1].trim(), "base64").toString(
     "utf-8"
@@ -1980,6 +2029,11 @@ var OAUTH_INVALID_CLIENT_RESPONSE_HEADERS = {
   ...OAUTH_CREDENTIAL_RESPONSE_HEADERS,
   "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"'
 };
+function grantedScopes(auth) {
+  const scopes = _optionalChain([auth, 'optionalAccess', _70 => _70.scopes]);
+  const values = Array.isArray(scopes) ? scopes : scopes instanceof Set ? [...scopes] : [];
+  return values.filter((scope) => typeof scope === "string");
+}
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -2464,6 +2518,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await _mcpproxy.startHTTPServer.call(void 0, {
           ...authenticate ? { authenticate } : {},
+          beforeDispatch: ({ message, server }) => this.#answerScopeChallenge(message, server),
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
@@ -2511,6 +2566,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await _mcpproxy.startHTTPServer.call(void 0, {
           ...authenticate ? { authenticate } : {},
+          beforeDispatch: ({ message, server }) => this.#answerScopeChallenge(message, server),
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
@@ -2583,6 +2639,23 @@ var FastMCP = class extends FastMCPEventEmitter {
     }
     this.#serverState = "stopped" /* Stopped */;
   }
+  /**
+   * mcp-proxy's `beforeDispatch`: answers a `tools/call` the session's token
+   * lacks scopes for with MCP's 403 scope challenge. It runs for every message
+   * POSTed over HTTP, after `authenticate` and `updateAuth`, because once a
+   * message is dispatched the SDK answers it on a 200.
+   */
+  #answerScopeChallenge(message, session) {
+    const challenge = session.scopeChallengeFor(message);
+    if (!challenge) {
+      return void 0;
+    }
+    const { id } = message;
+    return this.#createInsufficientScopeResponse(
+      challenge,
+      typeof id === "number" || typeof id === "string" ? id : null
+    );
+  }
   /**
    * Connects `session` to `transport` and lists it in `sessions` until the
    * transport closes. The close is watched from before the session connects,
@@ -2593,9 +2666,9 @@ var FastMCP = class extends FastMCPEventEmitter {
     const originalOnClose = transport.onclose;
     transport.onclose = () => {
       closed = true;
-      _optionalChain([onClose, 'optionalCall', _68 => _68()]);
+      _optionalChain([onClose, 'optionalCall', _71 => _71()]);
       this.#removeSession(session);
-      _optionalChain([originalOnClose, 'optionalCall', _69 => _69()]);
+      _optionalChain([originalOnClose, 'optionalCall', _72 => _72()]);
     };
     await session.connect(transport);
     if (closed) {
@@ -2609,6 +2682,54 @@ var FastMCP = class extends FastMCPEventEmitter {
       session
     });
   }
+  /**
+   * Builds MCP's 403 `insufficient_scope` challenge (2025-11-25, Scope
+   * Challenge Handling). `scope` lists what the client should re-authorize
+   * for, and `resource_metadata` is added on the same terms as on the 401 (see
+   * `#createUnauthorizedResponse`).
+   *
+   * Clients such as the MCP SDK pick each parameter out with a simple pattern:
+   * the first match wins and a quoted value ends at the first quote. So the
+   * parameters come first, the description comes last, and it keeps only the
+   * characters RFC 6750 allows in it.
+   */
+  #createInsufficientScopeResponse(challenge, id) {
+    const oauth = this.#options.oauth;
+    const resource = _optionalChain([oauth, 'optionalAccess', _73 => _73.enabled]) ? _optionalChain([oauth, 'access', _74 => _74.protectedResource, 'optionalAccess', _75 => _75.resource]) : void 0;
+    const wwwAuthenticateParts = [
+      'error="insufficient_scope"',
+      `scope="${challenge.scopes.filter((scope) => SCOPE_TOKEN.test(scope)).join(" ")}"`
+    ];
+    if (resource) {
+      wwwAuthenticateParts.push(
+        `resource_metadata="${protectedResourceMetadataUrl(resource)}"`
+      );
+    }
+    wwwAuthenticateParts.push(
+      `error_description="${challenge.description.replace(/[^\x20\x21\x23-\x5B\x5D-\x7E]/g, "")}"`
+    );
+    return new Response(
+      JSON.stringify({
+        error: {
+          code: INSUFFICIENT_SCOPE_ERROR_CODE,
+          data: {
+            error: "insufficient_scope",
+            required_scopes: challenge.scopes
+          },
+          message: challenge.description
+        },
+        id,
+        jsonrpc: "2.0"
+      }),
+      {
+        headers: {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer ${wwwAuthenticateParts.join(", ")}`
+        },
+        status: 403
+      }
+    );
+  }
   /**
    * Creates a new FastMCPSession instance with the current configuration.
    * Used both for regular sessions and stateless requests.
@@ -2660,7 +2781,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #createUnauthorizedResponse(message) {
     const oauth = this.#options.oauth;
-    const resource = _optionalChain([oauth, 'optionalAccess', _70 => _70.enabled]) ? _optionalChain([oauth, 'access', _71 => _71.protectedResource, 'optionalAccess', _72 => _72.resource]) : void 0;
+    const resource = _optionalChain([oauth, 'optionalAccess', _76 => _76.enabled]) ? _optionalChain([oauth, 'access', _77 => _77.protectedResource, 'optionalAccess', _78 => _78.resource]) : void 0;
     const wwwAuthenticateParts = [
       'error="invalid_token"',
       `error_description="${message.replace(/"/g, '\\"')}"`
@@ -2799,7 +2920,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
     const oauthConfig = this.#options.oauth;
-    if (_optionalChain([oauthConfig, 'optionalAccess', _73 => _73.enabled]) && req.method === "GET") {
+    if (_optionalChain([oauthConfig, 'optionalAccess', _79 => _79.enabled]) && req.method === "GET") {
       const url2 = new URL(req.url || "", `http://${host}`);
       const authorizationServerMetadataPath = joinPaths(
         "",
@@ -2833,8 +2954,8 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
       }
     }
-    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _74 => _74.proxy]);
-    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _75 => _75.enabled])) {
+    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _80 => _80.proxy]);
+    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _81 => _81.enabled])) {
       const url2 = new URL(req.url || "", `http://${host}`);
       const oauthPath = basePathRelativePath;
       try {
@@ -2887,7 +3008,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _76 => _76.toJSON, 'optionalCall', _77 => _77()]) || {
+                    _optionalChain([error, 'access', _82 => _82.toJSON, 'optionalCall', _83 => _83()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2914,7 +3035,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _78 => _78.toJSON, 'optionalCall', _79 => _79()]) || {
+                _optionalChain([error, 'access', _84 => _84.toJSON, 'optionalCall', _85 => _85()]) || {
                   error: "invalid_request"
                 }
               )
@@ -2936,7 +3057,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _80 => _80.toJSON, 'optionalCall', _81 => _81()]) || {
+                _optionalChain([error, 'access', _86 => _86.toJSON, 'optionalCall', _87 => _87()]) || {
                   error: "server_error"
                 }
               )
@@ -3005,7 +3126,7 @@ var FastMCP = class extends FastMCPEventEmitter {
               } catch (error) {
                 res.writeHead(400, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _82 => _82.toJSON, 'optionalCall', _83 => _83()]) || {
+                    _optionalChain([error, 'access', _88 => _88.toJSON, 'optionalCall', _89 => _89()]) || {
                       error: "server_error"
                     }
                   )
@@ -3120,7 +3241,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 }
                 res.writeHead(200, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(response));
               } catch (error) {
-                const body = _optionalChain([error, 'access', _84 => _84.toJSON, 'optionalCall', _85 => _85()]) || {
+                const body = _optionalChain([error, 'access', _90 => _90.toJSON, 'optionalCall', _91 => _91()]) || {
                   error: "invalid_request"
                 };
                 if (body.error === "invalid_client") {
@@ -3150,7 +3271,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    * regardless (RFC 7235), so no config is needed just to get the header.
    */
   #httpStreamOAuthConfig() {
-    const resource = _optionalChain([this, 'access', _86 => _86.#options, 'access', _87 => _87.oauth, 'optionalAccess', _88 => _88.enabled]) ? _optionalChain([this, 'access', _89 => _89.#options, 'access', _90 => _90.oauth, 'access', _91 => _91.protectedResource, 'optionalAccess', _92 => _92.resource]) : void 0;
+    const resource = _optionalChain([this, 'access', _92 => _92.#options, 'access', _93 => _93.oauth, 'optionalAccess', _94 => _94.enabled]) ? _optionalChain([this, 'access', _95 => _95.#options, 'access', _96 => _96.oauth, 'access', _97 => _97.protectedResource, 'optionalAccess', _98 => _98.resource]) : void 0;
     if (!resource) {
       return {};
     }
@@ -3256,24 +3377,24 @@ var FastMCP = class extends FastMCPEventEmitter {
     const envBasePath = process.env.FASTMCP_BASE_PATH;
     const envStateless = process.env.FASTMCP_STATELESS;
     const envHost = process.env.FASTMCP_HOST;
-    const transportType = _optionalChain([overrides, 'optionalAccess', _93 => _93.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
+    const transportType = _optionalChain([overrides, 'optionalAccess', _99 => _99.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
     if (transportType === "httpStream") {
       const port = parseInt(
-        _optionalChain([overrides, 'optionalAccess', _94 => _94.httpStream, 'optionalAccess', _95 => _95.port, 'optionalAccess', _96 => _96.toString, 'call', _97 => _97()]) || portArg || envPort || "8080"
+        _optionalChain([overrides, 'optionalAccess', _100 => _100.httpStream, 'optionalAccess', _101 => _101.port, 'optionalAccess', _102 => _102.toString, 'call', _103 => _103()]) || portArg || envPort || "8080"
       );
-      const host = _optionalChain([overrides, 'optionalAccess', _98 => _98.httpStream, 'optionalAccess', _99 => _99.host]) || hostArg || envHost || "localhost";
-      const endpoint = _optionalChain([overrides, 'optionalAccess', _100 => _100.httpStream, 'optionalAccess', _101 => _101.endpoint]) || endpointArg || envEndpoint || "/mcp";
+      const host = _optionalChain([overrides, 'optionalAccess', _104 => _104.httpStream, 'optionalAccess', _105 => _105.host]) || hostArg || envHost || "localhost";
+      const endpoint = _optionalChain([overrides, 'optionalAccess', _106 => _106.httpStream, 'optionalAccess', _107 => _107.endpoint]) || endpointArg || envEndpoint || "/mcp";
       const basePath = normalizeBasePath(
-        _optionalChain([overrides, 'optionalAccess', _102 => _102.httpStream, 'optionalAccess', _103 => _103.basePath]) || basePathArg || envBasePath
+        _optionalChain([overrides, 'optionalAccess', _108 => _108.httpStream, 'optionalAccess', _109 => _109.basePath]) || basePathArg || envBasePath
       );
-      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _104 => _104.httpStream, 'optionalAccess', _105 => _105.enableJsonResponse]) || false;
-      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _106 => _106.httpStream, 'optionalAccess', _107 => _107.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
+      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _110 => _110.httpStream, 'optionalAccess', _111 => _111.enableJsonResponse]) || false;
+      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _112 => _112.httpStream, 'optionalAccess', _113 => _113.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
       (statelessArg === "" ? true : parseBooleanSetting(statelessArg, "--stateless")))), () => ( parseBooleanSetting(envStateless, "FASTMCP_STATELESS"))), () => ( false));
-      const cors = _optionalChain([overrides, 'optionalAccess', _108 => _108.httpStream, 'optionalAccess', _109 => _109.cors]);
-      const eventStore = _optionalChain([overrides, 'optionalAccess', _110 => _110.httpStream, 'optionalAccess', _111 => _111.eventStore]);
-      const sslCa = _optionalChain([overrides, 'optionalAccess', _112 => _112.httpStream, 'optionalAccess', _113 => _113.sslCa]);
-      const sslCert = _optionalChain([overrides, 'optionalAccess', _114 => _114.httpStream, 'optionalAccess', _115 => _115.sslCert]);
-      const sslKey = _optionalChain([overrides, 'optionalAccess', _116 => _116.httpStream, 'optionalAccess', _117 => _117.sslKey]);
+      const cors = _optionalChain([overrides, 'optionalAccess', _114 => _114.httpStream, 'optionalAccess', _115 => _115.cors]);
+      const eventStore = _optionalChain([overrides, 'optionalAccess', _116 => _116.httpStream, 'optionalAccess', _117 => _117.eventStore]);
+      const sslCa = _optionalChain([overrides, 'optionalAccess', _118 => _118.httpStream, 'optionalAccess', _119 => _119.sslCa]);
+      const sslCert = _optionalChain([overrides, 'optionalAccess', _120 => _120.httpStream, 'optionalAccess', _121 => _121.sslCert]);
+      const sslKey = _optionalChain([overrides, 'optionalAccess', _122 => _122.httpStream, 'optionalAccess', _123 => _123.sslKey]);
       return {
         httpStream: {
           basePath,
@@ -3364,7 +3485,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #useEndpointAsResource(endpoint) {
     const oauth = this.#options.oauth;
-    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _118 => _118.protectedResource]))
+    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _124 => _124.protectedResource]))
       return;
     this.#options = {
       ...this.#options,
@@ -3393,4 +3514,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-7USB5QLH.cjs.map
+//# sourceMappingURL=chunk-JMH7WDO2.cjs.map