@kadoa/mcp 0.6.5-rc.1 → 0.6.5

package/README.md

@@ -468,7 +468,7 @@ The server starts in HTTP mode. You authenticate via OAuth the same way as with
 | `MCP_AUTH_JWKS_URL` | JWKS URL for the issuer |
 | `MCP_AUTH_AUDIENCE` | Exact MCP resource URL served by this deployment; its path must be `/mcp` |
 | `MCP_DOWNSTREAM_TOKEN_ENDPOINT` | Public API service-authenticated downstream exchange endpoint |
-| `MCP_DOWNSTREAM_EXCHANGE_SECRET` | Dedicated service credential shared only with the downstream exchange |
+| `MCP_DOWNSTREAM_EXCHANGE_SECRET` | Dedicated service credential shared only with the downstream exchange; must satisfy the same validation as Public API `KADOA_MCP_DOWNSTREAM_EXCHANGE_SECRET` |
 | `MCP_ALLOWED_ORIGIN_HOSTNAMES` | Comma-separated hostnames admitted when an HTTP Origin header is present; required outside loopback |
 | `MCP_LEGACY_TRANSPORT_ENABLED` | `true` serves supported 2025 protocol versions through central auth; `false` rejects them |
 

package/dist/index.js

@@ -47084,7 +47084,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kadoa/mcp",
-    version: "0.6.5-rc.1",
+    version: "0.6.5",
     description: "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
     type: "module",
     main: "dist/index.js",
@@ -49264,15 +49264,24 @@ class ServiceDownstreamTokenExchanger {
     this.fetchImpl = fetchImpl;
   }
   async exchange(subjectToken) {
-    const response = await this.fetchImpl(this.config.endpoint, {
-      method: "POST",
-      redirect: "error",
-      headers: {
-        authorization: `Bearer ${this.config.exchangeSecret}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ subject_token: subjectToken, resource: this.config.mcpResource })
-    });
+    let response;
+    try {
+      response = await this.fetchImpl(this.config.endpoint, {
+        method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(DOWNSTREAM_TOKEN_EXCHANGE_TIMEOUT_MS),
+        headers: {
+          authorization: `Bearer ${this.config.exchangeSecret}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ subject_token: subjectToken, resource: this.config.mcpResource })
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "TimeoutError") {
+        throw new Error("MCP downstream token exchange failed: request timed out");
+      }
+      throw new Error(`MCP downstream token exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
     if (!response.ok) {
       throw new Error(`MCP downstream token exchange failed with status ${response.status}`);
     }
@@ -49290,6 +49299,7 @@ function requestLocalDownstreamTokenProvider(exchanger, subjectToken) {
     return exchange;
   };
 }
+var DOWNSTREAM_TOKEN_EXCHANGE_TIMEOUT_MS = 5000;
 
 // src/kadoa-access-token.ts
 import { createPublicKey, verify } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.6.5-rc.1",
+  "version": "0.6.5",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",