fastmcp 4.23.4 → 4.23.6

package/dist/{chunk-TBJSX5UF.cjs → chunk-2PXF6JQB.cjs}

@@ -23,6 +23,11 @@ var _stdiojs = require('@modelcontextprotocol/sdk/server/stdio.js');
 
 
 
+
+
+
+
+
 var _typesjs = require('@modelcontextprotocol/sdk/types.js');
 var _events = require('events');
 var _promises = require('fs/promises');
@@ -220,6 +225,16 @@ function unwrapDefault(value) {
 
 // src/FastMCP.ts
 var MEDIA_FETCH_TIMEOUT_MS = 3e4;
+var isSvg = (buffer) => {
+  let text = buffer.toString("utf8").trimStart();
+  const preamble = /^(?:<\?[\s\S]*?\?>|<!--[\s\S]*?-->|<!DOCTYPE\s[^[>]*(?:\[[\s\S]*?\]\s*)?>)/;
+  let match = preamble.exec(text);
+  while (match) {
+    text = text.slice(match[0].length).trimStart();
+    match = preamble.exec(text);
+  }
+  return /^<svg(?:\s|\/?>)/.test(text);
+};
 var imageContent = async (input) => {
   let rawData;
   try {
@@ -262,16 +277,17 @@ var imageContent = async (input) => {
       );
     }
     const { fileTypeFromBuffer } = await Promise.resolve().then(() => _interopRequireWildcard(require("file-type")));
-    const mimeType = await fileTypeFromBuffer(rawData);
-    if (!mimeType || !mimeType.mime.startsWith("image/")) {
+    const fileType = await fileTypeFromBuffer(rawData);
+    const mimeType = (!fileType || fileType.mime === "application/xml") && isSvg(rawData) ? "image/svg+xml" : _optionalChain([fileType, 'optionalAccess', _4 => _4.mime]);
+    if (!mimeType || !mimeType.startsWith("image/")) {
       console.warn(
-        `Warning: Content may not be a valid image. Detected MIME: ${_optionalChain([mimeType, 'optionalAccess', _4 => _4.mime]) || "unknown"}`
+        `Warning: Content may not be a valid image. Detected MIME: ${mimeType || "unknown"}`
       );
     }
     const base64Data = rawData.toString("base64");
     return {
       data: base64Data,
-      mimeType: _nullishCoalesce(_optionalChain([mimeType, 'optionalAccess', _5 => _5.mime]), () => ( "image/png")),
+      mimeType: _nullishCoalesce(mimeType, () => ( "image/png")),
       type: "image"
     };
   } catch (error) {
@@ -282,8 +298,27 @@ var imageContent = async (input) => {
     }
   }
 };
+var AUDIO_CONTAINER_TYPES = /* @__PURE__ */ new Map([
+  ["video/3gpp", "audio/3gpp"],
+  ["video/3gpp2", "audio/3gpp2"],
+  ["video/matroska", "audio/matroska"],
+  ["video/mp4", "audio/mp4"],
+  ["video/ogg", "audio/ogg"],
+  ["video/webm", "audio/webm"]
+]);
+var resolveAudioMimeType = (detected, declared) => {
+  if (_optionalChain([detected, 'optionalAccess', _5 => _5.startsWith, 'call', _6 => _6("audio/")])) {
+    return detected;
+  }
+  const declaredMime = _optionalChain([declared, 'optionalAccess', _7 => _7.split, 'call', _8 => _8(";", 1), 'access', _9 => _9[0], 'access', _10 => _10.trim, 'call', _11 => _11(), 'access', _12 => _12.toLowerCase, 'call', _13 => _13()]);
+  if (_optionalChain([declaredMime, 'optionalAccess', _14 => _14.startsWith, 'call', _15 => _15("audio/")])) {
+    return declaredMime;
+  }
+  return _nullishCoalesce((detected && AUDIO_CONTAINER_TYPES.get(detected)), () => ( detected));
+};
 var audioContent = async (input) => {
   let rawData;
+  let declaredMimeType = null;
   try {
     if ("url" in input) {
       const timeoutMs = _nullishCoalesce(input.timeoutMs, () => ( MEDIA_FETCH_TIMEOUT_MS));
@@ -297,6 +332,7 @@ var audioContent = async (input) => {
             `Server responded with status: ${response.status} - ${response.statusText}`
           );
         }
+        declaredMimeType = response.headers.get("content-type");
         rawData = Buffer.from(await response.arrayBuffer());
       } catch (error) {
         if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
@@ -324,16 +360,17 @@ var audioContent = async (input) => {
       );
     }
     const { fileTypeFromBuffer } = await Promise.resolve().then(() => _interopRequireWildcard(require("file-type")));
-    const mimeType = await fileTypeFromBuffer(rawData);
-    if (!mimeType || !mimeType.mime.startsWith("audio/")) {
+    const detected = await fileTypeFromBuffer(rawData);
+    const mimeType = resolveAudioMimeType(_optionalChain([detected, 'optionalAccess', _16 => _16.mime]), declaredMimeType);
+    if (!mimeType || !mimeType.startsWith("audio/")) {
       console.warn(
-        `Warning: Content may not be a valid audio file. Detected MIME: ${_optionalChain([mimeType, 'optionalAccess', _6 => _6.mime]) || "unknown"}`
+        `Warning: Content may not be a valid audio file. Detected MIME: ${mimeType || "unknown"}`
       );
     }
     const base64Data = rawData.toString("base64");
     return {
       data: base64Data,
-      mimeType: _nullishCoalesce(_optionalChain([mimeType, 'optionalAccess', _7 => _7.mime]), () => ( "audio/mpeg")),
+      mimeType: _nullishCoalesce(mimeType, () => ( "audio/mpeg")),
       type: "audio"
     };
   } catch (error) {
@@ -364,7 +401,7 @@ var UserError = class extends UnexpectedStateError {
 };
 function assertStandardSchema(toolName, schemaName, schema) {
   const standard = schema["~standard"];
-  if (typeof _optionalChain([standard, 'optionalAccess', _8 => _8.validate]) === "function") {
+  if (typeof _optionalChain([standard, 'optionalAccess', _17 => _17.validate]) === "function") {
     return;
   }
   throw new UserError(
@@ -381,55 +418,20 @@ function assertToolSchemas(tool) {
 }
 var STREAM_KEEPALIVE_LOGGER = "fastmcp-keepalive";
 var STREAM_KEEPALIVE_DEFAULT_INTERVAL_MS = 2e4;
-var TextContentZodSchema = _zod.z.object({
-  /**
-   * The text content of the message.
-   */
-  text: _zod.z.string(),
-  type: _zod.z.literal("text")
-}).strict();
-var ImageContentZodSchema = _zod.z.object({
-  /**
-   * The base64-encoded image data.
-   */
-  data: _zod.z.string().base64(),
-  /**
-   * The MIME type of the image. Different providers may support different image types.
-   */
-  mimeType: _zod.z.string(),
-  type: _zod.z.literal("image")
-}).strict();
-var AudioContentZodSchema = _zod.z.object({
-  /**
-   * The base64-encoded audio data.
-   */
-  data: _zod.z.string().base64(),
-  mimeType: _zod.z.string(),
-  type: _zod.z.literal("audio")
+var TextContentZodSchema = _typesjs.TextContentSchema.strict();
+var ImageContentZodSchema = _typesjs.ImageContentSchema.extend({
+  data: _zod.z.string().base64()
 }).strict();
-var ResourceContentZodSchema = _zod.z.object({
-  resource: _zod.z.object({
-    blob: _zod.z.string().optional(),
-    mimeType: _zod.z.string().optional(),
-    text: _zod.z.string().optional(),
-    uri: _zod.z.string()
-  }),
-  type: _zod.z.literal("resource")
+var AudioContentZodSchema = _typesjs.AudioContentSchema.extend({
+  data: _zod.z.string().base64()
 }).strict();
-var ResourceLinkZodSchema = _zod.z.object({
-  description: _zod.z.string().optional(),
-  mimeType: _zod.z.string().optional(),
-  name: _zod.z.string(),
-  title: _zod.z.string().optional(),
-  type: _zod.z.literal("resource_link"),
-  uri: _zod.z.string()
-});
+var ResourceContentZodSchema = _typesjs.EmbeddedResourceSchema.strict();
 var ContentZodSchema = _zod.z.discriminatedUnion("type", [
   TextContentZodSchema,
   ImageContentZodSchema,
   AudioContentZodSchema,
   ResourceContentZodSchema,
-  ResourceLinkZodSchema
+  _typesjs.ResourceLinkSchema
 ]);
 var ContentResultZodSchema = _zod.z.object({
   _meta: _zod.z.record(_zod.z.string(), _zod.z.unknown()).optional(),
@@ -516,7 +518,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   get sessionId() {
     if (this.#sessionId === void 0) {
-      const transportSessionId = _optionalChain([this, 'access', _9 => _9.#server, 'access', _10 => _10.transport, 'optionalAccess', _11 => _11.sessionId]);
+      const transportSessionId = _optionalChain([this, 'access', _18 => _18.#server, 'access', _19 => _19.transport, 'optionalAccess', _20 => _20.sessionId]);
       if (typeof transportSessionId === "string") {
         this.#sessionId = transportSessionId;
       }
@@ -575,6 +577,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    * to interested clients only.
    */
   #subscriptions = /* @__PURE__ */ new Set();
+  #tools;
   #transportType;
   /**
    * Capabilities this session has already warned about in `#canRefresh`, so a
@@ -583,6 +586,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #unnegotiatedWarnings = /* @__PURE__ */ new Set();
   #utils;
+  #visibleTools = [];
   constructor({
     auth,
     authRequired = false,
@@ -617,6 +621,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.#sessionId = sessionId;
     this.#stateless = stateless;
     this.#streamKeepaliveConfig = streamKeepalive;
+    this.#tools = tools;
     this.#transportType = transportType;
     this.#needsEventLoopFlush = transportType === "httpStream";
     const supportsTools = _nullishCoalesce(hasTools, () => ( tools.length > 0));
@@ -650,7 +655,9 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
     this.setupRootsHandlers();
     this.setupCompleteHandlers();
     if (supportsTools) {
-      this.setupToolHandlers(tools);
+      this.setupToolHandlers(
+        toolsVisibleTo(tools, this.#auth, this.#authRequired)
+      );
     }
     if (resources.length || resourcesTemplates.length) {
       for (const resource of resources) {
@@ -771,6 +778,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     if (!this.#canRefresh("tools")) {
       return;
     }
+    this.#tools = tools;
     this.setupToolHandlers(
       toolsVisibleTo(tools, this.#auth, this.#authRequired)
     );
@@ -795,6 +803,11 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    */
   updateAuth(auth) {
     this.#auth = auth;
+    const tools = toolsVisibleTo(this.#tools, auth, this.#authRequired);
+    if (tools.length !== this.#visibleTools.length || tools.some((tool, index) => tool !== this.#visibleTools[index])) {
+      this.setupToolHandlers(tools);
+      this.triggerListChangedNotification("notifications/tools/list_changed");
+    }
   }
   waitForReady() {
     if (this.isReady) {
@@ -872,37 +885,37 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * are tied to a tool call's progress token / streaming notification,
    * which resource and prompt reads do not have.
    */
-  #createLoadContext(meta) {
+  #createLoadContext(meta, sendNotification) {
     return {
       client: {
         version: this.#server.getClientVersion()
       },
       elicit: (params, options) => this.#server.elicitInput(params, options),
-      log: this.#createLog(),
-      requestId: typeof _optionalChain([meta, 'optionalAccess', _12 => _12.requestId]) === "string" ? meta.requestId : void 0,
+      log: this.#createLog(sendNotification),
+      requestId: typeof _optionalChain([meta, 'optionalAccess', _21 => _21.requestId]) === "string" ? meta.requestId : void 0,
       session: this.#auth,
       sessionId: this.sessionId
     };
   }
-  #createLog() {
+  #createLog(sendNotification) {
     return {
       debug: (message, context) => {
-        this.#sendLog("debug", message, context);
+        this.#sendLog(sendNotification, "debug", message, context);
       },
       error: (message, context) => {
-        this.#sendLog("error", message, context);
+        this.#sendLog(sendNotification, "error", message, context);
       },
       info: (message, context) => {
-        this.#sendLog("info", message, context);
+        this.#sendLog(sendNotification, "info", message, context);
       },
       warn: (message, context) => {
-        this.#sendLog("warning", message, context);
+        this.#sendLog(sendNotification, "warning", message, context);
       }
     };
   }
   #formatSchemaIssues(issues) {
-    return _optionalChain([this, 'access', _13 => _13.#utils, 'optionalAccess', _14 => _14.formatInvalidParamsErrorMessage]) ? this.#utils.formatInvalidParamsErrorMessage(issues) : issues.map((issue) => {
-      const path = _optionalChain([issue, 'access', _15 => _15.path, 'optionalAccess', _16 => _16.join, 'call', _17 => _17(".")]) || "root";
+    return _optionalChain([this, 'access', _22 => _22.#utils, 'optionalAccess', _23 => _23.formatInvalidParamsErrorMessage]) ? this.#utils.formatInvalidParamsErrorMessage(issues) : issues.map((issue) => {
+      const path = _optionalChain([issue, 'access', _24 => _24.path, 'optionalAccess', _25 => _25.join, 'call', _26 => _26(".")]) || "root";
       return `${path}: ${issue.message}`;
     }).join(", ");
   }
@@ -924,7 +937,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    * is bounded and retried, and the result is announced with `rootsChanged`.
    */
   async #loadRoots(streamableHttp) {
-    if (_optionalChain([this, 'access', _18 => _18.#rootsConfig, 'optionalAccess', _19 => _19.enabled]) === false || !_optionalChain([this, 'access', _20 => _20.#clientCapabilities, 'optionalAccess', _21 => _21.roots, 'optionalAccess', _22 => _22.listChanged]) || typeof this.#server.listRoots !== "function") {
+    if (_optionalChain([this, 'access', _27 => _27.#rootsConfig, 'optionalAccess', _28 => _28.enabled]) === false || !_optionalChain([this, 'access', _29 => _29.#clientCapabilities, 'optionalAccess', _30 => _30.roots, 'optionalAccess', _31 => _31.listChanged]) || typeof this.#server.listRoots !== "function") {
       return;
     }
     const maxAttempts = streamableHttp ? 5 : 1;
@@ -934,7 +947,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           void 0,
           streamableHttp ? { timeout: 1e3 } : void 0
         );
-        this.#roots = _optionalChain([roots, 'optionalAccess', _23 => _23.roots]) || [];
+        this.#roots = _optionalChain([roots, 'optionalAccess', _32 => _32.roots]) || [];
         if (streamableHttp) {
           this.emit("rootsChanged", { roots: this.#roots });
         }
@@ -962,22 +975,23 @@ ${e instanceof Error ? e.stack : JSON.stringify(e)}`
     }
   }
   /**
-   * `sendLoggingMessage` rejects once the client has hung up, and these four
+   * Sending rejects once the client has hung up, and these four
    * callers are synchronous, so the rejection has nowhere to go. Swallow it the
    * way every other notification sender in this class does, or a client that
    * disconnects mid-tool takes the server process down with it.
    */
-  #sendLog(level, message, context) {
+  #sendLog(sendNotification, level, message, context) {
     if (this.#loggingLevel && LOGGING_LEVEL_SEVERITY[level] < LOGGING_LEVEL_SEVERITY[this.#loggingLevel]) {
       return;
     }
-    this.#server.sendLoggingMessage({
+    const params = {
       data: {
         context,
         message
       },
       level
-    }).catch((error) => {
+    };
+    sendNotification({ method: "notifications/message", params }).catch(() => this.#server.sendLoggingMessage(params)).catch((error) => {
       this.#logger.error(
         `[FastMCP error] failed to send ${level} log notification.
 
@@ -1071,7 +1085,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
    */
   #startStreamKeepalive(extra, toolName) {
     const config = this.#streamKeepaliveConfig;
-    if (!_optionalChain([config, 'optionalAccess', _24 => _24.enabled])) {
+    if (!_optionalChain([config, 'optionalAccess', _33 => _33.enabled])) {
       return () => {
       };
     }
@@ -1091,9 +1105,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         );
       });
     }, intervalMs);
-    _optionalChain([timer, 'access', _25 => _25.unref, 'optionalCall', _26 => _26()]);
+    _optionalChain([timer, 'access', _34 => _34.unref, 'optionalCall', _35 => _35()]);
     const stop = () => clearInterval(timer);
-    _optionalChain([extra, 'access', _27 => _27.signal, 'optionalAccess', _28 => _28.addEventListener, 'call', _29 => _29("abort", stop, { once: true })]);
+    _optionalChain([extra, 'access', _36 => _36.signal, 'optionalAccess', _37 => _37.addEventListener, 'call', _38 => _38("abort", stop, { once: true })]);
     return stop;
   }
   async #validateStructuredContent(tool, value, toolName) {
@@ -1288,54 +1302,60 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         prompts: cachedPromptsList
       };
     });
-    this.#server.setRequestHandler(_typesjs.GetPromptRequestSchema, async (request) => {
-      const prompt = this.#prompts.get(request.params.name);
-      if (!prompt) {
-        throw new (0, _typesjs.McpError)(
-          _typesjs.ErrorCode.InvalidParams,
-          `Unknown prompt: ${request.params.name}`
-        );
-      }
-      const args = request.params.arguments;
-      for (const arg of _nullishCoalesce(prompt.arguments, () => ( []))) {
-        if (arg.required && !(args && Object.hasOwn(args, arg.name))) {
+    this.#server.setRequestHandler(
+      _typesjs.GetPromptRequestSchema,
+      async (request, extra) => {
+        const prompt = this.#prompts.get(request.params.name);
+        if (!prompt) {
           throw new (0, _typesjs.McpError)(
             _typesjs.ErrorCode.InvalidParams,
-            `Prompt '${request.params.name}' requires argument '${arg.name}': ${arg.description || "No description provided"}`
+            `Unknown prompt: ${request.params.name}`
           );
         }
+        const args = request.params.arguments;
+        for (const arg of _nullishCoalesce(prompt.arguments, () => ( []))) {
+          if (arg.required && !(args && Object.hasOwn(args, arg.name))) {
+            throw new (0, _typesjs.McpError)(
+              _typesjs.ErrorCode.InvalidParams,
+              `Prompt '${request.params.name}' requires argument '${arg.name}': ${arg.description || "No description provided"}`
+            );
+          }
+        }
+        let result;
+        try {
+          result = await prompt.load(
+            _nullishCoalesce(args, () => ( {})),
+            this.#auth,
+            this.#createLoadContext(
+              _optionalChain([request, 'access', _39 => _39.params, 'optionalAccess', _40 => _40._meta]),
+              extra.sendNotification
+            )
+          );
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          throw new (0, _typesjs.McpError)(
+            _typesjs.ErrorCode.InternalError,
+            `Failed to load prompt '${request.params.name}': ${errorMessage}`
+          );
+        }
+        if (typeof result === "string") {
+          return {
+            description: prompt.description,
+            messages: [
+              {
+                content: { text: result, type: "text" },
+                role: "user"
+              }
+            ]
+          };
+        } else {
+          return {
+            description: prompt.description,
+            messages: result.messages
+          };
+        }
       }
-      let result;
-      try {
-        result = await prompt.load(
-          _nullishCoalesce(args, () => ( {})),
-          this.#auth,
-          this.#createLoadContext(_optionalChain([request, 'access', _30 => _30.params, 'optionalAccess', _31 => _31._meta]))
-        );
-      } catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        throw new (0, _typesjs.McpError)(
-          _typesjs.ErrorCode.InternalError,
-          `Failed to load prompt '${request.params.name}': ${errorMessage}`
-        );
-      }
-      if (typeof result === "string") {
-        return {
-          description: prompt.description,
-          messages: [
-            {
-              content: { text: result, type: "text" },
-              role: "user"
-            }
-          ]
-        };
-      } else {
-        return {
-          description: prompt.description,
-          messages: result.messages
-        };
-      }
-    });
+    );
   }
   setupResourceHandlers() {
     let cachedResourcesList = null;
@@ -1359,7 +1379,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     });
     this.#server.setRequestHandler(
       _typesjs.ReadResourceRequestSchema,
-      async (request) => {
+      async (request, extra) => {
         if ("uri" in request.params) {
           const resource = this.#resources.get(request.params.uri);
           if (!resource) {
@@ -1375,7 +1395,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               const result = await resourceTemplate.load(
                 match,
                 this.#auth,
-                this.#createLoadContext(_optionalChain([request, 'access', _32 => _32.params, 'optionalAccess', _33 => _33._meta]))
+                this.#createLoadContext(
+                  _optionalChain([request, 'access', _41 => _41.params, 'optionalAccess', _42 => _42._meta]),
+                  extra.sendNotification
+                )
               );
               const resources = Array.isArray(result) ? result : [result];
               return {
@@ -1401,7 +1424,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           try {
             maybeArrayResult = await resource.load(
               this.#auth,
-              this.#createLoadContext(_optionalChain([request, 'access', _34 => _34.params, 'optionalAccess', _35 => _35._meta]))
+              this.#createLoadContext(
+                _optionalChain([request, 'access', _43 => _43.params, 'optionalAccess', _44 => _44._meta]),
+                extra.sendNotification
+              )
             );
           } catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
@@ -1464,7 +1490,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     );
   }
   setupRootsHandlers() {
-    if (_optionalChain([this, 'access', _36 => _36.#rootsConfig, 'optionalAccess', _37 => _37.enabled]) === false) {
+    if (_optionalChain([this, 'access', _45 => _45.#rootsConfig, 'optionalAccess', _46 => _46.enabled]) === false) {
       this.#logger.debug(
         "[FastMCP debug] roots capability explicitly disabled via config"
       );
@@ -1501,6 +1527,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   setupToolHandlers(tools) {
+    this.#visibleTools = tools;
     const toolsMap = new Map(tools.map((tool) => [tool.name, tool]));
     let cachedToolsList = null;
     this.#server.setRequestHandler(_typesjs.ListToolsRequestSchema, async () => {
@@ -1558,7 +1585,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           }
           args = parsed.value;
         }
-        const progressToken = _optionalChain([request, 'access', _38 => _38.params, 'optionalAccess', _39 => _39._meta, 'optionalAccess', _40 => _40.progressToken]);
+        const progressToken = _optionalChain([request, 'access', _47 => _47.params, 'optionalAccess', _48 => _48._meta, 'optionalAccess', _49 => _49.progressToken]);
         let result;
         try {
           const reportProgress = async (progress) => {
@@ -1583,7 +1610,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               );
             }
           };
-          const log = this.#createLog();
+          const log = this.#createLog(extra.sendNotification);
           const streamContent = async (content) => {
             const contentArray = Array.isArray(content) ? content : [content];
             try {
@@ -1626,7 +1653,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               elicit: (params, options) => this.#server.elicitInput(params, options),
               log,
               reportProgress,
-              requestId: typeof _optionalChain([request, 'access', _41 => _41.params, 'optionalAccess', _42 => _42._meta, 'optionalAccess', _43 => _43.requestId]) === "string" ? request.params._meta.requestId : void 0,
+              requestId: typeof _optionalChain([request, 'access', _50 => _50.params, 'optionalAccess', _51 => _51._meta, 'optionalAccess', _52 => _52.requestId]) === "string" ? request.params._meta.requestId : void 0,
               session: this.#auth,
               sessionId: this.sessionId,
               signal,
@@ -1768,7 +1795,7 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _44 => _44.match, 'call', _45 => _45(/^Basic\s+(.+)$/)]);
+  const basicMatch = _optionalChain([authHeader, 'optionalAccess', _53 => _53.match, 'call', _54 => _54(/^Basic\s+(.+)$/)]);
   if (!basicMatch) return null;
   try {
     const credentials = Buffer.from(basicMatch[1], "base64").toString("utf-8");
@@ -2247,7 +2274,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         roots: this.#options.roots,
         streamKeepalive: this.#options.streamKeepalive,
         title: this.#options.title,
-        tools: toolsVisibleTo(this.#tools, auth, authRequired),
+        tools: this.#tools,
         transportType: "stdio",
         utils: this.#options.utils,
         version: this.#options.version,
@@ -2414,9 +2441,9 @@ var FastMCP = class extends FastMCPEventEmitter {
     const originalOnClose = transport.onclose;
     transport.onclose = () => {
       closed = true;
-      _optionalChain([onClose, 'optionalCall', _46 => _46()]);
+      _optionalChain([onClose, 'optionalCall', _55 => _55()]);
       this.#removeSession(session);
-      _optionalChain([originalOnClose, 'optionalCall', _47 => _47()]);
+      _optionalChain([originalOnClose, 'optionalCall', _56 => _56()]);
     };
     await session.connect(transport);
     if (closed) {
@@ -2458,7 +2485,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       stateless,
       streamKeepalive: this.#options.streamKeepalive,
       title: this.#options.title,
-      tools: toolsVisibleTo(this.#tools, auth, authRequired),
+      tools: this.#tools,
       transportType: "httpStream",
       utils: this.#options.utils,
       version: this.#options.version,
@@ -2480,7 +2507,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #createUnauthorizedResponse(message) {
     const oauth = this.#options.oauth;
-    const resource = _optionalChain([oauth, 'optionalAccess', _48 => _48.enabled]) ? _optionalChain([oauth, 'access', _49 => _49.protectedResource, 'optionalAccess', _50 => _50.resource]) : void 0;
+    const resource = _optionalChain([oauth, 'optionalAccess', _57 => _57.enabled]) ? _optionalChain([oauth, 'access', _58 => _58.protectedResource, 'optionalAccess', _59 => _59.resource]) : void 0;
     const wwwAuthenticateParts = [
       'error="invalid_token"',
       `error_description="${message.replace(/"/g, '\\"')}"`
@@ -2619,7 +2646,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
     const oauthConfig = this.#options.oauth;
-    if (_optionalChain([oauthConfig, 'optionalAccess', _51 => _51.enabled]) && req.method === "GET") {
+    if (_optionalChain([oauthConfig, 'optionalAccess', _60 => _60.enabled]) && req.method === "GET") {
       const url2 = new URL(req.url || "", `http://${host}`);
       const authorizationServerMetadataPath = joinPaths(
         "",
@@ -2653,8 +2680,8 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
       }
     }
-    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _52 => _52.proxy]);
-    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _53 => _53.enabled])) {
+    const oauthProxy = _optionalChain([oauthConfig, 'optionalAccess', _61 => _61.proxy]);
+    if (oauthProxy && _optionalChain([oauthConfig, 'optionalAccess', _62 => _62.enabled])) {
       const url2 = new URL(req.url || "", `http://${host}`);
       const oauthPath = basePathRelativePath;
       try {
@@ -2707,7 +2734,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _54 => _54.toJSON, 'optionalCall', _55 => _55()]) || {
+                    _optionalChain([error, 'access', _63 => _63.toJSON, 'optionalCall', _64 => _64()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2734,7 +2761,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _56 => _56.toJSON, 'optionalCall', _57 => _57()]) || {
+                _optionalChain([error, 'access', _65 => _65.toJSON, 'optionalCall', _66 => _66()]) || {
                   error: "invalid_request"
                 }
               )
@@ -2756,7 +2783,7 @@ var FastMCP = class extends FastMCPEventEmitter {
           } catch (error) {
             res.writeHead(400, { "Content-Type": "application/json" }).end(
               JSON.stringify(
-                _optionalChain([error, 'access', _58 => _58.toJSON, 'optionalCall', _59 => _59()]) || {
+                _optionalChain([error, 'access', _67 => _67.toJSON, 'optionalCall', _68 => _68()]) || {
                   error: "server_error"
                 }
               )
@@ -2825,7 +2852,7 @@ var FastMCP = class extends FastMCPEventEmitter {
               } catch (error) {
                 res.writeHead(400, { "Content-Type": "application/json" }).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _60 => _60.toJSON, 'optionalCall', _61 => _61()]) || {
+                    _optionalChain([error, 'access', _69 => _69.toJSON, 'optionalCall', _70 => _70()]) || {
                       error: "server_error"
                     }
                   )
@@ -2883,8 +2910,8 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = _optionalChain([basicAuth, 'optionalAccess', _62 => _62.clientId]) || params.get("client_id") || "";
-                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _63 => _63.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
+                const clientId = _optionalChain([basicAuth, 'optionalAccess', _71 => _71.clientId]) || params.get("client_id") || "";
+                const clientSecret = _nullishCoalesce(_nullishCoalesce(_optionalChain([basicAuth, 'optionalAccess', _72 => _72.clientSecret]), () => ( params.get("client_secret"))), () => ( void 0));
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -2914,7 +2941,7 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const statusCode = error.statusCode || 400;
                 res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
                   JSON.stringify(
-                    _optionalChain([error, 'access', _64 => _64.toJSON, 'optionalCall', _65 => _65()]) || {
+                    _optionalChain([error, 'access', _73 => _73.toJSON, 'optionalCall', _74 => _74()]) || {
                       error: "invalid_request"
                     }
                   )
@@ -2940,7 +2967,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    * regardless (RFC 7235), so no config is needed just to get the header.
    */
   #httpStreamOAuthConfig() {
-    const resource = _optionalChain([this, 'access', _66 => _66.#options, 'access', _67 => _67.oauth, 'optionalAccess', _68 => _68.enabled]) ? _optionalChain([this, 'access', _69 => _69.#options, 'access', _70 => _70.oauth, 'access', _71 => _71.protectedResource, 'optionalAccess', _72 => _72.resource]) : void 0;
+    const resource = _optionalChain([this, 'access', _75 => _75.#options, 'access', _76 => _76.oauth, 'optionalAccess', _77 => _77.enabled]) ? _optionalChain([this, 'access', _78 => _78.#options, 'access', _79 => _79.oauth, 'access', _80 => _80.protectedResource, 'optionalAccess', _81 => _81.resource]) : void 0;
     if (!resource) {
       return {};
     }
@@ -3048,24 +3075,24 @@ var FastMCP = class extends FastMCPEventEmitter {
     const envBasePath = process.env.FASTMCP_BASE_PATH;
     const envStateless = process.env.FASTMCP_STATELESS;
     const envHost = process.env.FASTMCP_HOST;
-    const transportType = _optionalChain([overrides, 'optionalAccess', _73 => _73.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
+    const transportType = _optionalChain([overrides, 'optionalAccess', _82 => _82.transportType]) || parseTransportSetting(transportArg, "--transport") || parseTransportSetting(envTransport, "FASTMCP_TRANSPORT") || "stdio";
     if (transportType === "httpStream") {
       const port = parseInt(
-        _optionalChain([overrides, 'optionalAccess', _74 => _74.httpStream, 'optionalAccess', _75 => _75.port, 'optionalAccess', _76 => _76.toString, 'call', _77 => _77()]) || portArg || envPort || "8080"
+        _optionalChain([overrides, 'optionalAccess', _83 => _83.httpStream, 'optionalAccess', _84 => _84.port, 'optionalAccess', _85 => _85.toString, 'call', _86 => _86()]) || portArg || envPort || "8080"
       );
-      const host = _optionalChain([overrides, 'optionalAccess', _78 => _78.httpStream, 'optionalAccess', _79 => _79.host]) || hostArg || envHost || "localhost";
-      const endpoint = _optionalChain([overrides, 'optionalAccess', _80 => _80.httpStream, 'optionalAccess', _81 => _81.endpoint]) || endpointArg || envEndpoint || "/mcp";
+      const host = _optionalChain([overrides, 'optionalAccess', _87 => _87.httpStream, 'optionalAccess', _88 => _88.host]) || hostArg || envHost || "localhost";
+      const endpoint = _optionalChain([overrides, 'optionalAccess', _89 => _89.httpStream, 'optionalAccess', _90 => _90.endpoint]) || endpointArg || envEndpoint || "/mcp";
       const basePath = normalizeBasePath(
-        _optionalChain([overrides, 'optionalAccess', _82 => _82.httpStream, 'optionalAccess', _83 => _83.basePath]) || basePathArg || envBasePath
+        _optionalChain([overrides, 'optionalAccess', _91 => _91.httpStream, 'optionalAccess', _92 => _92.basePath]) || basePathArg || envBasePath
       );
-      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _84 => _84.httpStream, 'optionalAccess', _85 => _85.enableJsonResponse]) || false;
-      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _86 => _86.httpStream, 'optionalAccess', _87 => _87.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
+      const enableJsonResponse = _optionalChain([overrides, 'optionalAccess', _93 => _93.httpStream, 'optionalAccess', _94 => _94.enableJsonResponse]) || false;
+      const stateless = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([overrides, 'optionalAccess', _95 => _95.httpStream, 'optionalAccess', _96 => _96.stateless]), () => ( // A bare `--stateless` means `--stateless true`.
       (statelessArg === "" ? true : parseBooleanSetting(statelessArg, "--stateless")))), () => ( parseBooleanSetting(envStateless, "FASTMCP_STATELESS"))), () => ( false));
-      const cors = _optionalChain([overrides, 'optionalAccess', _88 => _88.httpStream, 'optionalAccess', _89 => _89.cors]);
-      const eventStore = _optionalChain([overrides, 'optionalAccess', _90 => _90.httpStream, 'optionalAccess', _91 => _91.eventStore]);
-      const sslCa = _optionalChain([overrides, 'optionalAccess', _92 => _92.httpStream, 'optionalAccess', _93 => _93.sslCa]);
-      const sslCert = _optionalChain([overrides, 'optionalAccess', _94 => _94.httpStream, 'optionalAccess', _95 => _95.sslCert]);
-      const sslKey = _optionalChain([overrides, 'optionalAccess', _96 => _96.httpStream, 'optionalAccess', _97 => _97.sslKey]);
+      const cors = _optionalChain([overrides, 'optionalAccess', _97 => _97.httpStream, 'optionalAccess', _98 => _98.cors]);
+      const eventStore = _optionalChain([overrides, 'optionalAccess', _99 => _99.httpStream, 'optionalAccess', _100 => _100.eventStore]);
+      const sslCa = _optionalChain([overrides, 'optionalAccess', _101 => _101.httpStream, 'optionalAccess', _102 => _102.sslCa]);
+      const sslCert = _optionalChain([overrides, 'optionalAccess', _103 => _103.httpStream, 'optionalAccess', _104 => _104.sslCert]);
+      const sslKey = _optionalChain([overrides, 'optionalAccess', _105 => _105.httpStream, 'optionalAccess', _106 => _106.sslKey]);
       return {
         httpStream: {
           basePath,
@@ -3157,7 +3184,7 @@ var FastMCP = class extends FastMCPEventEmitter {
    */
   #useEndpointAsResource(endpoint) {
     const oauth = this.#options.oauth;
-    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _98 => _98.protectedResource]))
+    if (this.#providerResourceBase === void 0 || !_optionalChain([oauth, 'optionalAccess', _107 => _107.protectedResource]))
       return;
     this.#options = {
       ...this.#options,
@@ -3186,4 +3213,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-TBJSX5UF.cjs.map
+//# sourceMappingURL=chunk-2PXF6JQB.cjs.map