fastmcp 4.12.4 → 4.12.6

package/README.md

@@ -2015,20 +2015,23 @@ For more control over OAuth behavior, you can use the `oauth` option directly:
 import { FastMCP } from "fastmcp";
 import { GoogleProvider } from "fastmcp/auth";
 
-const authProxy = new GoogleProvider({
-  clientId: process.env.GOOGLE_CLIENT_ID,
-  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+const authProvider = new GoogleProvider({
   baseUrl: "https://your-server.com",
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
   scopes: ["openid", "profile", "email"],
 });
 
 const server = new FastMCP({
   name: "My Server",
   oauth: {
+    authorizationServer: authProvider
+      .getProxy()
+      .getAuthorizationServerMetadata(),
     enabled: true,
-    authorizationServer: authProxy.getAuthorizationServerMetadata(),
-    proxy: authProxy,
+    proxy: authProvider.getProxy(),
   },
+  version: "1.0.0",
 });
 ```
 

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkDD63MJG7cjs = require('./chunk-DD63MJG7.cjs');
+var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkDD63MJG7cjs = require('./chunk-DD63MJG7.cjs');
 
 
 
-var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
+var _chunkRQ6222DUcjs = require('./chunk-RQ6222DU.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkDD63MJG7cjs.DiscoveryDocumentCache; exports.FastMCP = _chunkDD63MJG7cjs.FastMCP; exports.FastMCPError = _chunkDD63MJG7cjs.FastMCPError; exports.FastMCPSession = _chunkDD63MJG7cjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkDD63MJG7cjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkDD63MJG7cjs.ServerState; exports.SessionError = _chunkDD63MJG7cjs.SessionError; exports.UnexpectedStateError = _chunkDD63MJG7cjs.UnexpectedStateError; exports.UserError = _chunkDD63MJG7cjs.UserError; exports.audioContent = _chunkDD63MJG7cjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkDD63MJG7cjs.imageContent; exports.jsonSchemaAdapter = _chunkDD63MJG7cjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+exports.AuthProvider = _chunkRQ6222DUcjs.AuthProvider; exports.AzureProvider = _chunkRQ6222DUcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkRQ6222DUcjs.GitHubProvider; exports.GoogleProvider = _chunkRQ6222DUcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkRQ6222DUcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkRQ6222DUcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkRQ6222DUcjs.requireAll; exports.requireAny = _chunkRQ6222DUcjs.requireAny; exports.requireAuth = _chunkRQ6222DUcjs.requireAuth; exports.requireRole = _chunkRQ6222DUcjs.requireRole; exports.requireScopes = _chunkRQ6222DUcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-FKX5QBJV.js";
+} from "./chunk-HIIPZVNY.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-2ZFQSPXZ.js";
+} from "./chunk-SZ4XCW5X.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-B_E71LUD.d.cts → OAuthProvider-B_OJFNC0.d.cts}

@@ -388,11 +388,14 @@ interface TokenStorage {
      * Atomically retrieve a value and delete it, returning `null` if the key was
      * absent. At most one caller may observe a given value.
      *
-     * Optional, but **required for correctness when more than one process shares
-     * this storage**: the OAuth proxy consumes authorization codes and
-     * transactions through it, and single-use enforcement depends on the
-     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
-     * where two concurrent requests can both redeem the same authorization code.
+     * Optional, but **required for correctness whenever concurrent requests can
+     * reach the same record** — which includes a single process, since the check
+     * and the delete straddle an await. The OAuth proxy consumes authorization
+     * codes, transactions and refresh-token mappings through it, and single-use
+     * enforcement depends on the atomicity. Without it the proxy falls back to a
+     * non-atomic get + delete, where two concurrent requests can both redeem the
+     * same authorization code, or both redeem the same refresh token and walk
+     * away with two independent token chains.
      *
      * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
      * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
@@ -604,10 +607,27 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Put a claimed refresh-token mapping back after a rotation failed, keeping
+     * whatever lifetime it had left.
+     *
+     * A mapping that is already expired, or that carries no usable expiry, is
+     * dropped instead. Inventing a TTL here would extend the lifetime of a
+     * credential in a security path, and every mapping this proxy writes records
+     * `expiresAt`.
+     */
+    private restoreMapping;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
     private startCleanup;
+    /**
+     * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+     * one caller — across all processes sharing the storage — can receive a given
+     * mapping, which is what makes single use enforceable. Falls back to a
+     * non-atomic get + delete for storages that do not implement `take`.
+     */
+    private takeMapping;
     /**
      * Validate a redirect URI against the configured allow-list.
      *

package/dist/{OAuthProvider-B_E71LUD.d.ts → OAuthProvider-B_OJFNC0.d.ts}

@@ -388,11 +388,14 @@ interface TokenStorage {
      * Atomically retrieve a value and delete it, returning `null` if the key was
      * absent. At most one caller may observe a given value.
      *
-     * Optional, but **required for correctness when more than one process shares
-     * this storage**: the OAuth proxy consumes authorization codes and
-     * transactions through it, and single-use enforcement depends on the
-     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
-     * where two concurrent requests can both redeem the same authorization code.
+     * Optional, but **required for correctness whenever concurrent requests can
+     * reach the same record** — which includes a single process, since the check
+     * and the delete straddle an await. The OAuth proxy consumes authorization
+     * codes, transactions and refresh-token mappings through it, and single-use
+     * enforcement depends on the atomicity. Without it the proxy falls back to a
+     * non-atomic get + delete, where two concurrent requests can both redeem the
+     * same authorization code, or both redeem the same refresh token and walk
+     * away with two independent token chains.
      *
      * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
      * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
@@ -604,10 +607,27 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Put a claimed refresh-token mapping back after a rotation failed, keeping
+     * whatever lifetime it had left.
+     *
+     * A mapping that is already expired, or that carries no usable expiry, is
+     * dropped instead. Inventing a TTL here would extend the lifetime of a
+     * credential in a security path, and every mapping this proxy writes records
+     * `expiresAt`.
+     */
+    private restoreMapping;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
     private startCleanup;
+    /**
+     * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+     * one caller — across all processes sharing the storage — can receive a given
+     * mapping, which is what makes single use enforceable. Falls back to a
+     * non-atomic get + delete for storages that do not implement `take`.
+     */
+    private takeMapping;
     /**
      * Validate a redirect URI against the configured allow-list.
      *

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
+var _chunkRQ6222DUcjs = require('../chunk-RQ6222DU.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.ConsentManager = _chunkENMHHQJFcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkENMHHQJFcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkENMHHQJFcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkENMHHQJFcjs.DiskStore; exports.EncryptedTokenStorage = _chunkENMHHQJFcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.JWKSVerifier = _chunkENMHHQJFcjs.JWKSVerifier; exports.JWTIssuer = _chunkENMHHQJFcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkENMHHQJFcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.OAuthProxy = _chunkENMHHQJFcjs.OAuthProxy; exports.OAuthProxyError = _chunkENMHHQJFcjs.OAuthProxyError; exports.PKCEUtils = _chunkENMHHQJFcjs.PKCEUtils; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+exports.AuthProvider = _chunkRQ6222DUcjs.AuthProvider; exports.AzureProvider = _chunkRQ6222DUcjs.AzureProvider; exports.ConsentManager = _chunkRQ6222DUcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkRQ6222DUcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkRQ6222DUcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkRQ6222DUcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkRQ6222DUcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkRQ6222DUcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkRQ6222DUcjs.DiskStore; exports.EncryptedTokenStorage = _chunkRQ6222DUcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkRQ6222DUcjs.GitHubProvider; exports.GoogleProvider = _chunkRQ6222DUcjs.GoogleProvider; exports.JWKSVerifier = _chunkRQ6222DUcjs.JWKSVerifier; exports.JWTIssuer = _chunkRQ6222DUcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkRQ6222DUcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkRQ6222DUcjs.OAuthProvider; exports.OAuthProxy = _chunkRQ6222DUcjs.OAuthProxy; exports.OAuthProxyError = _chunkRQ6222DUcjs.OAuthProxyError; exports.PKCEUtils = _chunkRQ6222DUcjs.PKCEUtils; exports.getAuthSession = _chunkRQ6222DUcjs.getAuthSession; exports.requireAll = _chunkRQ6222DUcjs.requireAll; exports.requireAny = _chunkRQ6222DUcjs.requireAny; exports.requireAuth = _chunkRQ6222DUcjs.requireAuth; exports.requireRole = _chunkRQ6222DUcjs.requireRole; exports.requireScopes = _chunkRQ6222DUcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-2ZFQSPXZ.js";
+} from "../chunk-SZ4XCW5X.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-FKX5QBJV.js → chunk-HIIPZVNY.js}

@@ -1462,6 +1462,7 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -2236,11 +2237,47 @@ var FastMCP = class extends FastMCPEventEmitter {
       try {
         if (req.method === "POST" && oauthPath === "/oauth/register") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const request = JSON.parse(body);
+                const request = JSON.parse(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const response = await oauthProxy.registerClient(request);
                 res.writeHead(201, { "Content-Type": "application/json" }).end(JSON.stringify(response));
               } catch (error) {
@@ -2306,14 +2343,48 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/consent") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
                 const mockRequest = new Request(
                   `http://${host}${url2.pathname}${url2.search}`,
                   {
-                    body,
+                    body: Buffer.concat(bodyChunks).toString("utf8"),
                     headers: {
                       "Content-Type": "application/x-www-form-urlencoded"
                     },
@@ -2344,11 +2415,47 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/token") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const params = new URLSearchParams(body);
+                const params = new URLSearchParams(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const grantType = params.get("grant_type");
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
@@ -2548,4 +2655,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-FKX5QBJV.js.map
+//# sourceMappingURL=chunk-HIIPZVNY.js.map