@north-light/cli 0.3.414 → 0.3.415

package/packages/crouter-identity/dist/index.js

@@ -71,7 +71,70 @@ export function covers(held, requested) {
     }
     return held === requested;
 }
-/** Keys are scoped to one configured issuer; failed refreshes keep the last successful set. */
+/** A directory fetch ran past its deadline (or was aborted by its caller before that). `code` is `deadline_exceeded`;
+ *  `deadlineAt` is the instant (epoch ms) the operation had to finish by. The `@north-light/sdk` maps it to its
+ *  `DeadlineExceededError`. */
+export class FetchDeadlineError extends Error {
+    deadlineAt;
+    url;
+    code = 'deadline_exceeded';
+    constructor(deadlineAt, url) {
+        super(`${url} did not answer by the deadline (${new Date(deadlineAt).toISOString()})`);
+        this.deadlineAt = deadlineAt;
+        this.url = url;
+        this.name = 'FetchDeadlineError';
+    }
+}
+/** The default deadline for one `JwksCache.load`, covering its discovery read and its key-set read together. */
+export const DEFAULT_JWKS_TIMEOUT_MS = 10_000;
+/**
+ * One `fetch` plus the reading of its answer (`read`, e.g. `response.json()`), bounded by one absolute deadline. The
+ * request is aborted when the deadline passes or `signal` fires, and the returned promise rejects at that moment
+ * even when `fetcher` ignores its signal, so a directory that accepts the connection and never answers cannot hold a
+ * caller (or a lock the caller holds) past `deadlineAt`. Rejects `FetchDeadlineError` at the deadline and the signal's
+ * reason when `signal` fired first.
+ */
+export async function boundedFetch(fetcher, url, init, bounds, read) {
+    const { deadlineAt, signal } = bounds;
+    if (signal?.aborted)
+        throw signal.reason;
+    const remaining = deadlineAt - Date.now();
+    if (remaining <= 0)
+        throw new FetchDeadlineError(deadlineAt, url);
+    const controller = new AbortController();
+    let timer;
+    let onAbort;
+    const stop = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => { const error = new FetchDeadlineError(deadlineAt, url); controller.abort(error); reject(error); }, remaining);
+        if (signal) {
+            onAbort = () => { controller.abort(signal.reason); reject(signal.reason); };
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+    const work = (async () => {
+        const response = await fetcher(url, { ...init, signal: controller.signal });
+        // A response that arrives after the deadline won is discarded: close it so its connection is not retained.
+        if (controller.signal.aborted) {
+            void response.body?.cancel().catch(() => { });
+            throw controller.signal.reason;
+        }
+        return read(response);
+    })();
+    // The loser of the race must not surface as an unhandled rejection.
+    work.catch(() => { });
+    stop.catch(() => { });
+    try {
+        return await Promise.race([work, stop]);
+    }
+    finally {
+        clearTimeout(timer);
+        if (onAbort)
+            signal?.removeEventListener('abort', onAbort);
+    }
+}
+/** Keys are scoped to one configured issuer; failed refreshes keep the last successful set. Every `load` is bounded by
+ *  one deadline (`timeoutMs`, default `DEFAULT_JWKS_TIMEOUT_MS`) over its discovery read and its key-set read together;
+ *  callers that join an in-flight load share that load's deadline. */
 export class JwksCache {
     issuer;
     fetcher;
@@ -79,16 +142,20 @@ export class JwksCache {
     lastUnknownRefresh = -Infinity;
     loading;
     discovery;
-    constructor(issuer, fetcher = fetch, jwksUri) {
+    timeoutMs;
+    constructor(issuer, fetcher = fetch, jwksUri, options = {}) {
         this.issuer = issuer;
         this.fetcher = fetcher;
         if (jwksUri)
             this.discovery = { jwks_uri: jwksUri };
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_JWKS_TIMEOUT_MS;
+        if (!Number.isFinite(this.timeoutMs) || this.timeoutMs <= 0 || this.timeoutMs > 2_147_483_647)
+            throw new RangeError('JwksCache timeoutMs must be a positive finite number of at most 2147483647');
     }
     async load() {
         if (this.loading)
             return this.loading;
-        const loading = this.fetchKeys();
+        const loading = this.fetchKeys(Date.now() + this.timeoutMs);
         this.loading = loading;
         try {
             return await loading;
@@ -97,20 +164,22 @@ export class JwksCache {
             this.loading = undefined;
         }
     }
-    async fetchKeys() {
+    async fetchKeys(deadlineAt) {
         if (!this.discovery) {
-            const response = await this.fetcher(`${this.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`);
-            if (!response.ok)
-                throw new Error(`Directory discovery failed: ${response.status}`);
-            const value = await response.json();
+            const value = await boundedFetch(this.fetcher, `${this.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`, {}, { deadlineAt }, async (response) => {
+                if (!response.ok)
+                    throw new Error(`Directory discovery failed: ${response.status}`);
+                return await response.json();
+            });
             if (!value || typeof value !== 'object' || !('jwks_uri' in value) || typeof value.jwks_uri !== 'string')
                 throw new Error('Directory discovery has no jwks_uri');
             this.discovery = { jwks_uri: value.jwks_uri };
         }
-        const response = await this.fetcher(this.discovery.jwks_uri);
-        if (!response.ok)
-            throw new Error(`Directory JWKS failed: ${response.status}`);
-        const keys = await response.json();
+        const keys = await boundedFetch(this.fetcher, this.discovery.jwks_uri, {}, { deadlineAt }, async (response) => {
+            if (!response.ok)
+                throw new Error(`Directory JWKS failed: ${response.status}`);
+            return await response.json();
+        });
         if (!keys || typeof keys !== 'object' || !('keys' in keys) || !Array.isArray(keys.keys))
             throw new Error('Invalid directory JWKS');
         this.keys = keys;

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.414",
+  "version": "0.3.415",
   "description": "crouter cloud access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.414",
+  "version": "0.3.415",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "0.99.1",
         "@earendil-works/pi-coding-agent": "0.99.1",
         "@earendil-works/pi-tui": "0.99.1",
-        "@north-light/identity": "0.3.414",
+        "@north-light/identity": "0.3.415",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -13814,17 +13814,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -13832,20 +13832,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.414",
-        "@north-light/identity": "0.3.414"
+        "@north-light/api": "0.3.415",
+        "@north-light/identity": "0.3.415"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.414",
+      "version": "0.3.415",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.414",
-        "@north-light/identity": "0.3.414",
+        "@north-light/api": "0.3.415",
+        "@north-light/identity": "0.3.415",
         "jose": "^6.2.1"
       },
       "bin": {