fastmcp 4.12.2 → 4.12.4

package/README.md

@@ -848,6 +848,7 @@ server.addTool({
 The `imageContent` function takes the following options:
 
 - `url`: The URL of the image.
+- `timeoutMs`: Optional timeout for a URL download in milliseconds (defaults to 30 seconds).
 - `path`: The path to the image file.
 - `buffer`: The image data as a buffer.
 
@@ -1025,6 +1026,7 @@ server.addTool({
 The `audioContent` function takes the following options:
 
 - `url`: The URL of the audio.
+- `timeoutMs`: Optional timeout for a URL download in milliseconds (defaults to 30 seconds).
 - `path`: The path to the audio file.
 - `buffer`: The audio data as a buffer.
 

package/dist/FastMCP.cjs

@@ -10,8 +10,8 @@
 
 
 
-var _chunkPOXZCEYEcjs = require('./chunk-POXZCEYE.cjs');
 
+var _chunkDD63MJG7cjs = require('./chunk-DD63MJG7.cjs');
 
 
 
@@ -23,8 +23,8 @@ var _chunkPOXZCEYEcjs = require('./chunk-POXZCEYE.cjs');
 
 
 
-var _chunkRAIXP3PScjs = require('./chunk-RAIXP3PS.cjs');
 
+var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
@@ -47,5 +47,7 @@ var _chunkRAIXP3PScjs = require('./chunk-RAIXP3PS.cjs');
 
 
 
-exports.AuthProvider = _chunkRAIXP3PScjs.AuthProvider; exports.AzureProvider = _chunkRAIXP3PScjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkPOXZCEYEcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkPOXZCEYEcjs.FastMCP; exports.FastMCPError = _chunkPOXZCEYEcjs.FastMCPError; exports.FastMCPSession = _chunkPOXZCEYEcjs.FastMCPSession; exports.GitHubProvider = _chunkRAIXP3PScjs.GitHubProvider; exports.GoogleProvider = _chunkRAIXP3PScjs.GoogleProvider; exports.OAuthProvider = _chunkRAIXP3PScjs.OAuthProvider; exports.ServerState = _chunkPOXZCEYEcjs.ServerState; exports.SessionError = _chunkPOXZCEYEcjs.SessionError; exports.UnexpectedStateError = _chunkPOXZCEYEcjs.UnexpectedStateError; exports.UserError = _chunkPOXZCEYEcjs.UserError; exports.audioContent = _chunkPOXZCEYEcjs.audioContent; exports.getAuthSession = _chunkRAIXP3PScjs.getAuthSession; exports.imageContent = _chunkPOXZCEYEcjs.imageContent; exports.jsonSchemaAdapter = _chunkPOXZCEYEcjs.jsonSchemaAdapter; exports.requireAll = _chunkRAIXP3PScjs.requireAll; exports.requireAny = _chunkRAIXP3PScjs.requireAny; exports.requireAuth = _chunkRAIXP3PScjs.requireAuth; exports.requireRole = _chunkRAIXP3PScjs.requireRole; exports.requireScopes = _chunkRAIXP3PScjs.requireScopes;
+
+
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkDD63MJG7cjs.DiscoveryDocumentCache; exports.FastMCP = _chunkDD63MJG7cjs.FastMCP; exports.FastMCPError = _chunkDD63MJG7cjs.FastMCPError; exports.FastMCPSession = _chunkDD63MJG7cjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkDD63MJG7cjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkDD63MJG7cjs.ServerState; exports.SessionError = _chunkDD63MJG7cjs.SessionError; exports.UnexpectedStateError = _chunkDD63MJG7cjs.UnexpectedStateError; exports.UserError = _chunkDD63MJG7cjs.UserError; exports.audioContent = _chunkDD63MJG7cjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkDD63MJG7cjs.imageContent; exports.jsonSchemaAdapter = _chunkDD63MJG7cjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,+tCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,0yCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -21,9 +21,11 @@ declare class DiscoveryDocumentCache {
     get size(): number;
     /**
      * @param options - configuration options
+     * @param options.timeoutMs - timeout in miliseconds for the upstream fetch
      * @param options.ttl - time-to-live in miliseconds
      */
     constructor(options?: {
+        timeoutMs?: number;
         ttl?: number;
     });
     /**
@@ -139,20 +141,23 @@ type FastMCPSessionEvents = {
         roots: Root[];
     }) => void;
 };
-declare const imageContent: (input: {
-    buffer: Buffer;
-} | {
-    path: string;
-} | {
-    url: string;
-}) => Promise<ImageContent>;
-declare const audioContent: (input: {
+/**
+ * Timeout for image/audio URL fetches (in milliseconds). The OAuth upstream
+ * fetches (#304) use 10s because they are short interactive exchanges; media
+ * downloads can be larger and slower, so 30s is the balance between hanging
+ * forever on an unresponsive server and false positives on slow connections.
+ */
+declare const MEDIA_FETCH_TIMEOUT_MS = 30000;
+type MediaContentInput = {
     buffer: Buffer;
 } | {
     path: string;
 } | {
+    timeoutMs?: number;
     url: string;
-}) => Promise<AudioContent>;
+};
+declare const imageContent: (input: MediaContentInput) => Promise<ImageContent>;
+declare const audioContent: (input: MediaContentInput) => Promise<AudioContent>;
 type Context<T extends FastMCPSessionAuth> = {
     client: {
         version: ReturnType<Server["getClientVersion"]>;
@@ -1052,4 +1057,4 @@ declare class FastMCP<T extends FastMCPSessionAuth = FastMCPSessionAuth> extends
     stop(): Promise<void>;
 }
 
-export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };
+export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, MEDIA_FETCH_TIMEOUT_MS, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -21,9 +21,11 @@ declare class DiscoveryDocumentCache {
     get size(): number;
     /**
      * @param options - configuration options
+     * @param options.timeoutMs - timeout in miliseconds for the upstream fetch
      * @param options.ttl - time-to-live in miliseconds
      */
     constructor(options?: {
+        timeoutMs?: number;
         ttl?: number;
     });
     /**
@@ -139,20 +141,23 @@ type FastMCPSessionEvents = {
         roots: Root[];
     }) => void;
 };
-declare const imageContent: (input: {
-    buffer: Buffer;
-} | {
-    path: string;
-} | {
-    url: string;
-}) => Promise<ImageContent>;
-declare const audioContent: (input: {
+/**
+ * Timeout for image/audio URL fetches (in milliseconds). The OAuth upstream
+ * fetches (#304) use 10s because they are short interactive exchanges; media
+ * downloads can be larger and slower, so 30s is the balance between hanging
+ * forever on an unresponsive server and false positives on slow connections.
+ */
+declare const MEDIA_FETCH_TIMEOUT_MS = 30000;
+type MediaContentInput = {
     buffer: Buffer;
 } | {
     path: string;
 } | {
+    timeoutMs?: number;
     url: string;
-}) => Promise<AudioContent>;
+};
+declare const imageContent: (input: MediaContentInput) => Promise<ImageContent>;
+declare const audioContent: (input: MediaContentInput) => Promise<AudioContent>;
 type Context<T extends FastMCPSessionAuth> = {
     client: {
         version: ReturnType<Server["getClientVersion"]>;
@@ -1052,4 +1057,4 @@ declare class FastMCP<T extends FastMCPSessionAuth = FastMCPSessionAuth> extends
     stop(): Promise<void>;
 }
 
-export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };
+export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, MEDIA_FETCH_TIMEOUT_MS, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };

package/dist/FastMCP.js

@@ -3,6 +3,7 @@ import {
   FastMCP,
   FastMCPError,
   FastMCPSession,
+  MEDIA_FETCH_TIMEOUT_MS,
   ServerState,
   SessionError,
   UnexpectedStateError,
@@ -10,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-5BQXF2VT.js";
+} from "./chunk-FKX5QBJV.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -23,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-PNBJIDG6.js";
+} from "./chunk-2ZFQSPXZ.js";
 export {
   AuthProvider,
   AzureProvider,
@@ -33,6 +34,7 @@ export {
   FastMCPSession,
   GitHubProvider,
   GoogleProvider,
+  MEDIA_FETCH_TIMEOUT_MS,
   OAuthProvider,
   ServerState,
   SessionError,

package/dist/{OAuthProvider-BNqoBTYA.d.cts → OAuthProvider-B_E71LUD.d.cts}

@@ -260,6 +260,8 @@ interface OAuthProxyConfig {
     upstreamClientId: string;
     /** Pre-registered client secret with upstream provider */
     upstreamClientSecret: string;
+    /** Timeout in milliseconds for upstream token/refresh HTTP requests (default: 10000) */
+    upstreamRequestTimeoutMs?: number;
     /** Upstream provider's token endpoint URL */
     upstreamTokenEndpoint: string;
     /** Upstream token endpoint authentication method (default: "client_secret_basic") */
@@ -540,6 +542,13 @@ declare class OAuthProxy {
      * Combines claims from access token and ID token (if present)
      */
     private extractUpstreamClaims;
+    /**
+     * POST to the upstream token endpoint with a bounded wait.
+     *
+     * Maps an abort of the configured timeout signal to a clean OAuth error
+     * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+     */
+    private fetchUpstream;
     /**
      * Generate authorization code for client
      */

package/dist/{OAuthProvider-BNqoBTYA.d.ts → OAuthProvider-B_E71LUD.d.ts}

@@ -260,6 +260,8 @@ interface OAuthProxyConfig {
     upstreamClientId: string;
     /** Pre-registered client secret with upstream provider */
     upstreamClientSecret: string;
+    /** Timeout in milliseconds for upstream token/refresh HTTP requests (default: 10000) */
+    upstreamRequestTimeoutMs?: number;
     /** Upstream provider's token endpoint URL */
     upstreamTokenEndpoint: string;
     /** Upstream token endpoint authentication method (default: "client_secret_basic") */
@@ -540,6 +542,13 @@ declare class OAuthProxy {
      * Combines claims from access token and ID token (if present)
      */
     private extractUpstreamClaims;
+    /**
+     * POST to the upstream token endpoint with a bounded wait.
+     *
+     * Maps an abort of the configured timeout signal to a clean OAuth error
+     * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+     */
+    private fetchUpstream;
     /**
      * Generate authorization code for client
      */

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkRAIXP3PScjs = require('../chunk-RAIXP3PS.cjs');
+var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkRAIXP3PScjs = require('../chunk-RAIXP3PS.cjs');
 
 
 
-exports.AuthProvider = _chunkRAIXP3PScjs.AuthProvider; exports.AzureProvider = _chunkRAIXP3PScjs.AzureProvider; exports.ConsentManager = _chunkRAIXP3PScjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkRAIXP3PScjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkRAIXP3PScjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkRAIXP3PScjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkRAIXP3PScjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkRAIXP3PScjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkRAIXP3PScjs.DiskStore; exports.EncryptedTokenStorage = _chunkRAIXP3PScjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkRAIXP3PScjs.GitHubProvider; exports.GoogleProvider = _chunkRAIXP3PScjs.GoogleProvider; exports.JWKSVerifier = _chunkRAIXP3PScjs.JWKSVerifier; exports.JWTIssuer = _chunkRAIXP3PScjs.JWTIssuer; exports.MemoryTokenStorage = _chunkRAIXP3PScjs.MemoryTokenStorage; exports.OAuthProvider = _chunkRAIXP3PScjs.OAuthProvider; exports.OAuthProxy = _chunkRAIXP3PScjs.OAuthProxy; exports.OAuthProxyError = _chunkRAIXP3PScjs.OAuthProxyError; exports.PKCEUtils = _chunkRAIXP3PScjs.PKCEUtils; exports.getAuthSession = _chunkRAIXP3PScjs.getAuthSession; exports.requireAll = _chunkRAIXP3PScjs.requireAll; exports.requireAny = _chunkRAIXP3PScjs.requireAny; exports.requireAuth = _chunkRAIXP3PScjs.requireAuth; exports.requireRole = _chunkRAIXP3PScjs.requireRole; exports.requireScopes = _chunkRAIXP3PScjs.requireScopes;
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.ConsentManager = _chunkENMHHQJFcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkENMHHQJFcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkENMHHQJFcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkENMHHQJFcjs.DiskStore; exports.EncryptedTokenStorage = _chunkENMHHQJFcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.JWKSVerifier = _chunkENMHHQJFcjs.JWKSVerifier; exports.JWTIssuer = _chunkENMHHQJFcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkENMHHQJFcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.OAuthProxy = _chunkENMHHQJFcjs.OAuthProxy; exports.OAuthProxyError = _chunkENMHHQJFcjs.OAuthProxyError; exports.PKCEUtils = _chunkENMHHQJFcjs.PKCEUtils; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-PNBJIDG6.js";
+} from "../chunk-2ZFQSPXZ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-PNBJIDG6.js → chunk-2ZFQSPXZ.js}

@@ -274,6 +274,7 @@ var DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536e3;
 var DEFAULT_REFRESH_TOKEN_TTL = 2592e3;
 var DEFAULT_AUTHORIZATION_CODE_TTL = 300;
 var DEFAULT_TRANSACTION_TTL = 600;
+var DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS = 1e4;
 
 // src/auth/utils/claimsExtractor.ts
 var ClaimsExtractor = class {
@@ -1151,6 +1152,7 @@ var OAuthProxy = class {
       // Enabled by default for security
       redirectPath: "/oauth/callback",
       transactionTtl: DEFAULT_TRANSACTION_TTL,
+      upstreamRequestTimeoutMs: DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS,
       upstreamTokenEndpointAuthMethod: "client_secret_basic",
       ...config
     };
@@ -1595,11 +1597,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "server_error";
       let errorDescription;
@@ -1668,6 +1666,31 @@ var OAuthProxy = class {
     }
     return Object.keys(allClaims).length > 0 ? allClaims : null;
   }
+  /**
+   * POST to the upstream token endpoint with a bounded wait.
+   *
+   * Maps an abort of the configured timeout signal to a clean OAuth error
+   * instead of letting the raw `TimeoutError`/`AbortError` propagate.
+   */
+  async fetchUpstream(bodyParams, headers) {
+    let tokenResponse;
+    try {
+      tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
+        body: new URLSearchParams(bodyParams),
+        headers,
+        method: "POST",
+        signal: AbortSignal.timeout(
+          this.config.upstreamRequestTimeoutMs ?? DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS
+        )
+      });
+    } catch (error) {
+      if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+        throw new OAuthProxyError("server_error", "Upstream request timed out");
+      }
+      throw error;
+    }
+    return tokenResponse;
+  }
   /**
    * Generate authorization code for client
    */
@@ -1738,11 +1761,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "invalid_grant";
       let errorDescription;
@@ -2064,11 +2083,7 @@ var OAuthProxy = class {
     if (useBasicAuth) {
       headers["Authorization"] = this.getBasicAuthHeader();
     }
-    const tokenResponse = await fetch(this.config.upstreamTokenEndpoint, {
-      body: new URLSearchParams(bodyParams),
-      headers,
-      method: "POST"
-    });
+    const tokenResponse = await this.fetchUpstream(bodyParams, headers);
     if (!tokenResponse.ok) {
       let errorCode = "invalid_grant";
       let errorDescription = "Upstream refresh failed";
@@ -2623,15 +2638,15 @@ var JWKSVerifier = class {
         verifyOptions
       );
       const claims = {
+        ...payload,
+        // Include all other claims
         aud: payload.aud,
         client_id: payload.client_id || payload.sub,
         exp: payload.exp,
         iat: payload.iat,
         iss: payload.iss,
         jti: payload.jti || "",
-        scope: this.parseScope(payload.scope),
-        ...payload
-        // Include all other claims
+        scope: this.parseScope(payload.scope)
       };
       return {
         claims,
@@ -2718,4 +2733,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-PNBJIDG6.js.map
+//# sourceMappingURL=chunk-2ZFQSPXZ.js.map