fastmcp 4.12.3 → 4.12.5

package/dist/{chunk-3O5ZKWCC.cjs → chunk-U36NARZG.cjs}

@@ -197,12 +197,16 @@ function unwrapDefault(value) {
 }
 
 // src/FastMCP.ts
+var MEDIA_FETCH_TIMEOUT_MS = 3e4;
 var imageContent = async (input) => {
   let rawData;
   try {
     if ("url" in input) {
+      const timeoutMs = _nullishCoalesce(input.timeoutMs, () => ( MEDIA_FETCH_TIMEOUT_MS));
       try {
-        const response = await _undici.fetch.call(void 0, input.url);
+        const response = await _undici.fetch.call(void 0, input.url, {
+          signal: AbortSignal.timeout(timeoutMs)
+        });
         if (!response.ok) {
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
@@ -210,6 +214,11 @@ var imageContent = async (input) => {
         }
         rawData = Buffer.from(await response.arrayBuffer());
       } catch (error) {
+        if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+          throw new Error(
+            `Failed to fetch image from URL (${input.url}): timed out after ${timeoutMs}ms`
+          );
+        }
         throw new Error(
           `Failed to fetch image from URL (${input.url}): ${error instanceof Error ? error.message : String(error)}`
         );
@@ -254,8 +263,11 @@ var audioContent = async (input) => {
   let rawData;
   try {
     if ("url" in input) {
+      const timeoutMs = _nullishCoalesce(input.timeoutMs, () => ( MEDIA_FETCH_TIMEOUT_MS));
       try {
-        const response = await _undici.fetch.call(void 0, input.url);
+        const response = await _undici.fetch.call(void 0, input.url, {
+          signal: AbortSignal.timeout(timeoutMs)
+        });
         if (!response.ok) {
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
@@ -263,6 +275,11 @@ var audioContent = async (input) => {
         }
         rawData = Buffer.from(await response.arrayBuffer());
       } catch (error) {
+        if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+          throw new Error(
+            `Failed to fetch audio from URL (${input.url}): timed out after ${timeoutMs}ms`
+          );
+        }
         throw new Error(
           `Failed to fetch audio from URL (${input.url}): ${error instanceof Error ? error.message : String(error)}`
         );
@@ -1445,6 +1462,7 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -2219,11 +2237,47 @@ var FastMCP = class extends FastMCPEventEmitter {
       try {
         if (req.method === "POST" && oauthPath === "/oauth/register") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const request = JSON.parse(body);
+                const request = JSON.parse(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const response = await oauthProxy.registerClient(request);
                 res.writeHead(201, { "Content-Type": "application/json" }).end(JSON.stringify(response));
               } catch (error) {
@@ -2289,14 +2343,48 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/consent") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
                 const mockRequest = new Request(
                   `http://${host}${url2.pathname}${url2.search}`,
                   {
-                    body,
+                    body: Buffer.concat(bodyChunks).toString("utf8"),
                     headers: {
                       "Content-Type": "application/x-www-form-urlencoded"
                     },
@@ -2327,11 +2415,47 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/token") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const params = new URLSearchParams(body);
+                const params = new URLSearchParams(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const grantType = params.get("grant_type");
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
@@ -2529,5 +2653,6 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 
-exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-3O5ZKWCC.cjs.map
+
+exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
+//# sourceMappingURL=chunk-U36NARZG.cjs.map