fastmcp 4.12.1 → 4.12.3

package/dist/FastMCP.cjs

@@ -10,7 +10,7 @@
 
 
 
-var _chunkPOXZCEYEcjs = require('./chunk-POXZCEYE.cjs');
+var _chunk3O5ZKWCCcjs = require('./chunk-3O5ZKWCC.cjs');
 
 
 
@@ -23,7 +23,7 @@ var _chunkPOXZCEYEcjs = require('./chunk-POXZCEYE.cjs');
 
 
 
-var _chunkDZYT6QAHcjs = require('./chunk-DZYT6QAH.cjs');
+var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
@@ -47,5 +47,5 @@ var _chunkDZYT6QAHcjs = require('./chunk-DZYT6QAH.cjs');
 
 
 
-exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkPOXZCEYEcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkPOXZCEYEcjs.FastMCP; exports.FastMCPError = _chunkPOXZCEYEcjs.FastMCPError; exports.FastMCPSession = _chunkPOXZCEYEcjs.FastMCPSession; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.ServerState = _chunkPOXZCEYEcjs.ServerState; exports.SessionError = _chunkPOXZCEYEcjs.SessionError; exports.UnexpectedStateError = _chunkPOXZCEYEcjs.UnexpectedStateError; exports.UserError = _chunkPOXZCEYEcjs.UserError; exports.audioContent = _chunkPOXZCEYEcjs.audioContent; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.imageContent = _chunkPOXZCEYEcjs.imageContent; exports.jsonSchemaAdapter = _chunkPOXZCEYEcjs.jsonSchemaAdapter; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunk3O5ZKWCCcjs.DiscoveryDocumentCache; exports.FastMCP = _chunk3O5ZKWCCcjs.FastMCP; exports.FastMCPError = _chunk3O5ZKWCCcjs.FastMCPError; exports.FastMCPSession = _chunk3O5ZKWCCcjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunk3O5ZKWCCcjs.ServerState; exports.SessionError = _chunk3O5ZKWCCcjs.SessionError; exports.UnexpectedStateError = _chunk3O5ZKWCCcjs.UnexpectedStateError; exports.UserError = _chunk3O5ZKWCCcjs.UserError; exports.audioContent = _chunk3O5ZKWCCcjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunk3O5ZKWCCcjs.imageContent; exports.jsonSchemaAdapter = _chunk3O5ZKWCCcjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -21,9 +21,11 @@ declare class DiscoveryDocumentCache {
     get size(): number;
     /**
      * @param options - configuration options
+     * @param options.timeoutMs - timeout in miliseconds for the upstream fetch
      * @param options.ttl - time-to-live in miliseconds
      */
     constructor(options?: {
+        timeoutMs?: number;
         ttl?: number;
     });
     /**

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -21,9 +21,11 @@ declare class DiscoveryDocumentCache {
     get size(): number;
     /**
      * @param options - configuration options
+     * @param options.timeoutMs - timeout in miliseconds for the upstream fetch
      * @param options.ttl - time-to-live in miliseconds
      */
     constructor(options?: {
+        timeoutMs?: number;
         ttl?: number;
     });
     /**

package/dist/FastMCP.js

@@ -10,7 +10,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-5BQXF2VT.js";
+} from "./chunk-5K4GLQMV.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -23,7 +23,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-GM44BOI7.js";
+} from "./chunk-2ZFQSPXZ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-BNqoBTYA.d.cts → OAuthProvider-B_E71LUD.d.cts}

@@ -260,6 +260,8 @@ interface OAuthProxyConfig {
     upstreamClientId: string;
     /** Pre-registered client secret with upstream provider */
     upstreamClientSecret: string;
+    /** Timeout in milliseconds for upstream token/refresh HTTP requests (default: 10000) */
+    upstreamRequestTimeoutMs?: number;
     /** Upstream provider's token endpoint URL */
     upstreamTokenEndpoint: string;
     /** Upstream token endpoint authentication method (default: "client_secret_basic") */
@@ -540,6 +542,13 @@ declare class OAuthProxy {
      * Combines claims from access token and ID token (if present)
      */
     private extractUpstreamClaims;
+    /**
+     * POST to the upstream token endpoint with a bounded wait.
+     *
+     * Maps an abort of the configured timeout signal to a clean OAuth error
+     * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+     */
+    private fetchUpstream;
     /**
      * Generate authorization code for client
      */

package/dist/{OAuthProvider-BNqoBTYA.d.ts → OAuthProvider-B_E71LUD.d.ts}

@@ -260,6 +260,8 @@ interface OAuthProxyConfig {
     upstreamClientId: string;
     /** Pre-registered client secret with upstream provider */
     upstreamClientSecret: string;
+    /** Timeout in milliseconds for upstream token/refresh HTTP requests (default: 10000) */
+    upstreamRequestTimeoutMs?: number;
     /** Upstream provider's token endpoint URL */
     upstreamTokenEndpoint: string;
     /** Upstream token endpoint authentication method (default: "client_secret_basic") */
@@ -540,6 +542,13 @@ declare class OAuthProxy {
      * Combines claims from access token and ID token (if present)
      */
     private extractUpstreamClaims;
+    /**
+     * POST to the upstream token endpoint with a bounded wait.
+     *
+     * Maps an abort of the configured timeout signal to a clean OAuth error
+     * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+     */
+    private fetchUpstream;
     /**
      * Generate authorization code for client
      */

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkDZYT6QAHcjs = require('../chunk-DZYT6QAH.cjs');
+var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkDZYT6QAHcjs = require('../chunk-DZYT6QAH.cjs');
 
 
 
-exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.ConsentManager = _chunkDZYT6QAHcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkDZYT6QAHcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkDZYT6QAHcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkDZYT6QAHcjs.DiskStore; exports.EncryptedTokenStorage = _chunkDZYT6QAHcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.JWKSVerifier = _chunkDZYT6QAHcjs.JWKSVerifier; exports.JWTIssuer = _chunkDZYT6QAHcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkDZYT6QAHcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.OAuthProxy = _chunkDZYT6QAHcjs.OAuthProxy; exports.OAuthProxyError = _chunkDZYT6QAHcjs.OAuthProxyError; exports.PKCEUtils = _chunkDZYT6QAHcjs.PKCEUtils; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.ConsentManager = _chunkENMHHQJFcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkENMHHQJFcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkENMHHQJFcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkENMHHQJFcjs.DiskStore; exports.EncryptedTokenStorage = _chunkENMHHQJFcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.JWKSVerifier = _chunkENMHHQJFcjs.JWKSVerifier; exports.JWTIssuer = _chunkENMHHQJFcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkENMHHQJFcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.OAuthProxy = _chunkENMHHQJFcjs.OAuthProxy; exports.OAuthProxyError = _chunkENMHHQJFcjs.OAuthProxyError; exports.PKCEUtils = _chunkENMHHQJFcjs.PKCEUtils; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-GM44BOI7.js";
+} from "../chunk-2ZFQSPXZ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-GM44BOI7.js → chunk-2ZFQSPXZ.js}

@@ -274,6 +274,7 @@ var DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536e3;
 var DEFAULT_REFRESH_TOKEN_TTL = 2592e3;
 var DEFAULT_AUTHORIZATION_CODE_TTL = 300;
 var DEFAULT_TRANSACTION_TTL = 600;
+var DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS = 1e4;
 
 // src/auth/utils/claimsExtractor.ts
 var ClaimsExtractor = class {
@@ -417,7 +418,7 @@ var ClaimsExtractor = class {
 };
 
 // src/auth/utils/consent.ts
-import { createHmac } from "crypto";
+import { createHmac, timingSafeEqual } from "crypto";
 var ConsentManager = class {
   signingKey;
   constructor(signingKey) {
@@ -670,7 +671,9 @@ var ConsentManager = class {
       }
       const payload = Buffer.from(payloadB64, "base64").toString("utf8");
       const expectedSignature = this.sign(payload);
-      if (signature !== expectedSignature) {
+      const actualBuf = Buffer.from(signature);
+      const expectedBuf = Buffer.from(expectedSignature);
+      if (actualBuf.length !== expectedBuf.length || !timingSafeEqual(actualBuf, expectedBuf)) {
         return null;
       }
       const data = JSON.parse(payload);
@@ -725,7 +728,7 @@ var ConsentManager = class {
 };
 
 // src/auth/utils/jwtIssuer.ts
-import { createHmac as createHmac2, pbkdf2, randomBytes } from "crypto";
+import { createHmac as createHmac2, pbkdf2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { promisify } from "util";
 var pbkdf2Async = promisify(pbkdf2);
 var JWTIssuer = class {
@@ -802,7 +805,9 @@ var JWTIssuer = class {
       }
       const [headerB64, payloadB64, signatureB64] = parts;
       const expectedSignature = this.sign(`${headerB64}.${payloadB64}`);
-      if (signatureB64 !== expectedSignature) {
+      const actualBuf = Buffer.from(signatureB64);
+      const expectedBuf = Buffer.from(expectedSignature);
+      if (actualBuf.length !== expectedBuf.length || !timingSafeEqual2(actualBuf, expectedBuf)) {
         return {
           error: "Invalid signature",
           valid: false
@@ -1147,6 +1152,7 @@ var OAuthProxy = class {
       // Enabled by default for security
       redirectPath: "/oauth/callback",
       transactionTtl: DEFAULT_TRANSACTION_TTL,
+      upstreamRequestTimeoutMs: DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS,
       upstreamTokenEndpointAuthMethod: "client_secret_basic",
       ...config
     };
@@ -1591,11 +1597,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "server_error";
       let errorDescription;
@@ -1664,6 +1666,31 @@ var OAuthProxy = class {
     }
     return Object.keys(allClaims).length > 0 ? allClaims : null;
   }
+  /**
+   * POST to the upstream token endpoint with a bounded wait.
+   *
+   * Maps an abort of the configured timeout signal to a clean OAuth error
+   * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+   */
+  async fetchUpstream(bodyParams, headers) {
+    let tokenResponse;
+    try {
+      tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
+        body: new URLSearchParams(bodyParams),
+        headers,
+        method: "POST",
+        signal: AbortSignal.timeout(
+          this.config.upstreamRequestTimeoutMs ?? DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS
+        )
+      });
+    } catch (error) {
+      if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+        throw new OAuthProxyError("server_error", "Upstream request timed out");
+      }
+      throw error;
+    }
+    return tokenResponse;
+  }
   /**
    * Generate authorization code for client
    */
@@ -1734,11 +1761,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "invalid_grant";
       let errorDescription;
@@ -2060,11 +2083,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "invalid_grant";
       let errorDescription = "Upstream refresh failed";
@@ -2619,15 +2638,15 @@ var JWKSVerifier = class {
         verifyOptions
       );
       const claims = {
+        ...payload,
+        // Include all other claims
         aud: payload.aud,
         client_id: payload.client_id || payload.sub,
         exp: payload.exp,
         iat: payload.iat,
         iss: payload.iss,
         jti: payload.jti || "",
-        scope: this.parseScope(payload.scope),
-        ...payload
-        // Include all other claims
+        scope: this.parseScope(payload.scope)
       };
       return {
         claims,
@@ -2714,4 +2733,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-GM44BOI7.js.map
+//# sourceMappingURL=chunk-2ZFQSPXZ.js.map