fastmcp 4.12.5 → 4.12.7

package/README.md

@@ -2,9 +2,9 @@
 
 A TypeScript framework for building [MCP](https://glama.ai/mcp) servers capable of handling client sessions.
 
-> [!NOTE]
+> [!IMPORTANT]
 >
-> For a Python implementation, see [FastMCP](https://github.com/jlowin/fastmcp).
+> FastMCP implements the legacy, handshake-based MCP revisions (`2025-11-25` and earlier). It does not support the current specification, [`2026-07-28`](https://modelcontextprotocol.io/specification/2026-07-28/), which made the protocol stateless — no `initialize` handshake and no `Mcp-Session-Id`. For a framework targeting the current spec, use [ViteMCP](https://github.com/vitemcp/server).
 
 ## Features
 

package/dist/FastMCP.cjs

@@ -24,7 +24,7 @@ var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
-var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
+var _chunk6DTYLKSCcjs = require('./chunk-6DTYLKSC.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+exports.AuthProvider = _chunk6DTYLKSCcjs.AuthProvider; exports.AzureProvider = _chunk6DTYLKSCcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunk6DTYLKSCcjs.GitHubProvider; exports.GoogleProvider = _chunk6DTYLKSCcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk6DTYLKSCcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunk6DTYLKSCcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunk6DTYLKSCcjs.requireAll; exports.requireAny = _chunk6DTYLKSCcjs.requireAny; exports.requireAuth = _chunk6DTYLKSCcjs.requireAuth; exports.requireRole = _chunk6DTYLKSCcjs.requireRole; exports.requireScopes = _chunk6DTYLKSCcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_E71LUD.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_E71LUD.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-2ZFQSPXZ.js";
+} from "./chunk-VFBUPSNI.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-B_E71LUD.d.cts → OAuthProvider-B_OJFNC0.d.cts}

@@ -388,11 +388,14 @@ interface TokenStorage {
      * Atomically retrieve a value and delete it, returning `null` if the key was
      * absent. At most one caller may observe a given value.
      *
-     * Optional, but **required for correctness when more than one process shares
-     * this storage**: the OAuth proxy consumes authorization codes and
-     * transactions through it, and single-use enforcement depends on the
-     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
-     * where two concurrent requests can both redeem the same authorization code.
+     * Optional, but **required for correctness whenever concurrent requests can
+     * reach the same record** — which includes a single process, since the check
+     * and the delete straddle an await. The OAuth proxy consumes authorization
+     * codes, transactions and refresh-token mappings through it, and single-use
+     * enforcement depends on the atomicity. Without it the proxy falls back to a
+     * non-atomic get + delete, where two concurrent requests can both redeem the
+     * same authorization code, or both redeem the same refresh token and walk
+     * away with two independent token chains.
      *
      * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
      * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
@@ -604,10 +607,27 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Put a claimed refresh-token mapping back after a rotation failed, keeping
+     * whatever lifetime it had left.
+     *
+     * A mapping that is already expired, or that carries no usable expiry, is
+     * dropped instead. Inventing a TTL here would extend the lifetime of a
+     * credential in a security path, and every mapping this proxy writes records
+     * `expiresAt`.
+     */
+    private restoreMapping;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
     private startCleanup;
+    /**
+     * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+     * one caller — across all processes sharing the storage — can receive a given
+     * mapping, which is what makes single use enforceable. Falls back to a
+     * non-atomic get + delete for storages that do not implement `take`.
+     */
+    private takeMapping;
     /**
      * Validate a redirect URI against the configured allow-list.
      *

package/dist/{OAuthProvider-B_E71LUD.d.ts → OAuthProvider-B_OJFNC0.d.ts}

@@ -388,11 +388,14 @@ interface TokenStorage {
      * Atomically retrieve a value and delete it, returning `null` if the key was
      * absent. At most one caller may observe a given value.
      *
-     * Optional, but **required for correctness when more than one process shares
-     * this storage**: the OAuth proxy consumes authorization codes and
-     * transactions through it, and single-use enforcement depends on the
-     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
-     * where two concurrent requests can both redeem the same authorization code.
+     * Optional, but **required for correctness whenever concurrent requests can
+     * reach the same record** — which includes a single process, since the check
+     * and the delete straddle an await. The OAuth proxy consumes authorization
+     * codes, transactions and refresh-token mappings through it, and single-use
+     * enforcement depends on the atomicity. Without it the proxy falls back to a
+     * non-atomic get + delete, where two concurrent requests can both redeem the
+     * same authorization code, or both redeem the same refresh token and walk
+     * away with two independent token chains.
      *
      * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
      * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
@@ -604,10 +607,27 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Put a claimed refresh-token mapping back after a rotation failed, keeping
+     * whatever lifetime it had left.
+     *
+     * A mapping that is already expired, or that carries no usable expiry, is
+     * dropped instead. Inventing a TTL here would extend the lifetime of a
+     * credential in a security path, and every mapping this proxy writes records
+     * `expiresAt`.
+     */
+    private restoreMapping;
     /**
      * Start periodic cleanup of expired transactions and codes
      */
     private startCleanup;
+    /**
+     * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+     * one caller — across all processes sharing the storage — can receive a given
+     * mapping, which is what makes single use enforceable. Falls back to a
+     * non-atomic get + delete for storages that do not implement `take`.
+     */
+    private takeMapping;
     /**
      * Validate a redirect URI against the configured allow-list.
      *

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
+var _chunk6DTYLKSCcjs = require('../chunk-6DTYLKSC.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkENMHHQJFcjs = require('../chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.ConsentManager = _chunkENMHHQJFcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkENMHHQJFcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkENMHHQJFcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkENMHHQJFcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkENMHHQJFcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkENMHHQJFcjs.DiskStore; exports.EncryptedTokenStorage = _chunkENMHHQJFcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.JWKSVerifier = _chunkENMHHQJFcjs.JWKSVerifier; exports.JWTIssuer = _chunkENMHHQJFcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkENMHHQJFcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.OAuthProxy = _chunkENMHHQJFcjs.OAuthProxy; exports.OAuthProxyError = _chunkENMHHQJFcjs.OAuthProxyError; exports.PKCEUtils = _chunkENMHHQJFcjs.PKCEUtils; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+exports.AuthProvider = _chunk6DTYLKSCcjs.AuthProvider; exports.AzureProvider = _chunk6DTYLKSCcjs.AzureProvider; exports.ConsentManager = _chunk6DTYLKSCcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk6DTYLKSCcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk6DTYLKSCcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk6DTYLKSCcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk6DTYLKSCcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk6DTYLKSCcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk6DTYLKSCcjs.DiskStore; exports.EncryptedTokenStorage = _chunk6DTYLKSCcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk6DTYLKSCcjs.GitHubProvider; exports.GoogleProvider = _chunk6DTYLKSCcjs.GoogleProvider; exports.JWKSVerifier = _chunk6DTYLKSCcjs.JWKSVerifier; exports.JWTIssuer = _chunk6DTYLKSCcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk6DTYLKSCcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk6DTYLKSCcjs.OAuthProvider; exports.OAuthProxy = _chunk6DTYLKSCcjs.OAuthProxy; exports.OAuthProxyError = _chunk6DTYLKSCcjs.OAuthProxyError; exports.PKCEUtils = _chunk6DTYLKSCcjs.PKCEUtils; exports.getAuthSession = _chunk6DTYLKSCcjs.getAuthSession; exports.requireAll = _chunk6DTYLKSCcjs.requireAll; exports.requireAny = _chunk6DTYLKSCcjs.requireAny; exports.requireAuth = _chunk6DTYLKSCcjs.requireAuth; exports.requireRole = _chunk6DTYLKSCcjs.requireRole; exports.requireScopes = _chunk6DTYLKSCcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_E71LUD.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_E71LUD.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-2ZFQSPXZ.js";
+} from "../chunk-VFBUPSNI.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-ENMHHQJF.cjs → chunk-6DTYLKSC.cjs}

@@ -938,11 +938,11 @@ var PKCEUtils = class _PKCEUtils {
       return false;
     }
     if (method === "plain") {
-      return verifier === challenge;
+      return equalsConstantTime(verifier, challenge);
     }
     if (method === "S256") {
       const computedChallenge = _PKCEUtils.generateChallenge(verifier, "S256");
-      return computedChallenge === challenge;
+      return equalsConstantTime(computedChallenge, challenge);
     }
     return false;
   }
@@ -955,6 +955,11 @@ var PKCEUtils = class _PKCEUtils {
     return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
   }
 };
+function equalsConstantTime(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
+}
 
 // src/auth/utils/tokenStore.ts
 
@@ -1802,51 +1807,62 @@ var OAuthProxy = (_class4 = class {
     if (!jti) {
       throw new OAuthProxyError("invalid_grant", "Refresh token missing JTI");
     }
-    const mapping = await this.tokenStorage.get(`mapping:${jti}`);
+    const mapping = await this.takeMapping(jti);
     if (!mapping) {
       throw new OAuthProxyError(
         "invalid_grant",
         "Refresh token already used or expired"
       );
     }
-    const upstreamTokens = await this.tokenStorage.get(
-      `upstream:${mapping.upstreamTokenKey}`
-    );
-    if (!upstreamTokens) {
-      throw new OAuthProxyError(
-        "invalid_grant",
-        "Upstream tokens not found or expired"
+    try {
+      const upstreamTokens = await this.tokenStorage.get(
+        `upstream:${mapping.upstreamTokenKey}`
       );
-    }
-    if (!upstreamTokens.refreshToken) {
-      throw new OAuthProxyError(
-        "invalid_grant",
-        "No upstream refresh token available"
+      if (!upstreamTokens) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "Upstream tokens not found or expired"
+        );
+      }
+      if (!upstreamTokens.refreshToken) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "No upstream refresh token available"
+        );
+      }
+      const refreshedUpstreamTokens = await this.refreshUpstreamTokens(
+        upstreamTokens.refreshToken,
+        request.scope
       );
+      if (refreshedUpstreamTokens.scope.length === 0) {
+        refreshedUpstreamTokens.scope = upstreamTokens.scope;
+      }
+      const refreshTokenTtl = _nullishCoalesce(_nullishCoalesce(refreshedUpstreamTokens.refreshExpiresIn, () => ( this.config.refreshTokenTtl)), () => ( DEFAULT_REFRESH_TOKEN_TTL));
+      const accessTokenTtl = this.calculateAccessTokenTtl(
+        refreshedUpstreamTokens
+      );
+      const upstreamStorageTtl = Math.max(accessTokenTtl, refreshTokenTtl, 1);
+      await this.tokenStorage.save(
+        `upstream:${mapping.upstreamTokenKey}`,
+        refreshedUpstreamTokens,
+        upstreamStorageTtl
+      );
+      return await this.issueSwappedTokensForRefresh(
+        mapping.clientId,
+        refreshedUpstreamTokens,
+        mapping.upstreamTokenKey
+      );
+    } catch (error) {
+      try {
+        await this.restoreMapping(jti, mapping);
+      } catch (restoreError) {
+        console.error(
+          `Failed to restore refresh token mapping ${jti}:`,
+          restoreError
+        );
+      }
+      throw error;
     }
-    const refreshedUpstreamTokens = await this.refreshUpstreamTokens(
-      upstreamTokens.refreshToken,
-      request.scope
-    );
-    if (refreshedUpstreamTokens.scope.length === 0) {
-      refreshedUpstreamTokens.scope = upstreamTokens.scope;
-    }
-    const refreshTokenTtl = _nullishCoalesce(_nullishCoalesce(refreshedUpstreamTokens.refreshExpiresIn, () => ( this.config.refreshTokenTtl)), () => ( DEFAULT_REFRESH_TOKEN_TTL));
-    const accessTokenTtl = this.calculateAccessTokenTtl(
-      refreshedUpstreamTokens
-    );
-    const upstreamStorageTtl = Math.max(accessTokenTtl, refreshTokenTtl, 1);
-    await this.tokenStorage.save(
-      `upstream:${mapping.upstreamTokenKey}`,
-      refreshedUpstreamTokens,
-      upstreamStorageTtl
-    );
-    return await this.issueSwappedTokensForRefresh(
-      mapping.clientId,
-      refreshedUpstreamTokens,
-      mapping.upstreamTokenKey,
-      jti
-    );
   }
   /**
    * Issue swapped tokens (JWT pattern)
@@ -1927,11 +1943,10 @@ var OAuthProxy = (_class4 = class {
   /**
    * Issue swapped tokens for refresh flow
    */
-  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey, oldJti) {
+  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey) {
     if (!this.jwtIssuer) {
       throw new Error("JWT issuer not initialized");
     }
-    await this.tokenStorage.delete(`mapping:${oldJti}`);
     const customClaims = await this.extractUpstreamClaims(upstreamTokens);
     const accessTokenTtl = this.calculateAccessTokenTtl(upstreamTokens);
     const refreshTokenTtl = upstreamTokens.refreshToken ? _nullishCoalesce(_nullishCoalesce(upstreamTokens.refreshExpiresIn, () => ( this.config.refreshTokenTtl)), () => ( DEFAULT_REFRESH_TOKEN_TTL)) : 0;
@@ -2108,6 +2123,29 @@ var OAuthProxy = (_class4 = class {
       tokenType: tokens.token_type || "Bearer"
     };
   }
+  /**
+   * Put a claimed refresh-token mapping back after a rotation failed, keeping
+   * whatever lifetime it had left.
+   *
+   * A mapping that is already expired, or that carries no usable expiry, is
+   * dropped instead. Inventing a TTL here would extend the lifetime of a
+   * credential in a security path, and every mapping this proxy writes records
+   * `expiresAt`.
+   */
+  async restoreMapping(jti, mapping) {
+    if (!mapping.expiresAt) {
+      return;
+    }
+    const expiresAt = new Date(mapping.expiresAt).getTime();
+    if (Number.isNaN(expiresAt)) {
+      return;
+    }
+    const ttl = Math.ceil((expiresAt - Date.now()) / 1e3);
+    if (ttl <= 0) {
+      return;
+    }
+    await this.tokenStorage.save(`mapping:${jti}`, mapping, ttl);
+  }
   /**
    * Start periodic cleanup of expired transactions and codes
    */
@@ -2116,6 +2154,24 @@ var OAuthProxy = (_class4 = class {
       this.cleanup();
     }, 6e4);
   }
+  /**
+   * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+   * one caller — across all processes sharing the storage — can receive a given
+   * mapping, which is what makes single use enforceable. Falls back to a
+   * non-atomic get + delete for storages that do not implement `take`.
+   */
+  async takeMapping(jti) {
+    const key = `mapping:${jti}`;
+    if (this.tokenStorage.take) {
+      return await this.tokenStorage.take(key);
+    }
+    const stored = await this.tokenStorage.get(key);
+    if (stored === null) {
+      return null;
+    }
+    await this.tokenStorage.delete(key);
+    return stored;
+  }
   /**
    * Validate a redirect URI against the configured allow-list.
    *
@@ -2733,4 +2789,4 @@ Original error: ${error.message}`
 
 
 exports.getAuthSession = getAuthSession; exports.requireAll = requireAll; exports.requireAny = requireAny; exports.requireAuth = requireAuth; exports.requireRole = requireRole; exports.requireScopes = requireScopes; exports.DEFAULT_ACCESS_TOKEN_TTL = DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_REFRESH_TOKEN_TTL = DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_AUTHORIZATION_CODE_TTL = DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_TRANSACTION_TTL = DEFAULT_TRANSACTION_TTL; exports.ConsentManager = ConsentManager; exports.JWTIssuer = JWTIssuer; exports.PKCEUtils = PKCEUtils; exports.EncryptedTokenStorage = EncryptedTokenStorage; exports.MemoryTokenStorage = MemoryTokenStorage; exports.OAuthProxy = OAuthProxy; exports.OAuthProxyError = OAuthProxyError; exports.AuthProvider = AuthProvider; exports.AzureProvider = AzureProvider; exports.GitHubProvider = GitHubProvider; exports.GoogleProvider = GoogleProvider; exports.OAuthProvider = OAuthProvider; exports.DiskStore = DiskStore; exports.JWKSVerifier = JWKSVerifier;
-//# sourceMappingURL=chunk-ENMHHQJF.cjs.map
+//# sourceMappingURL=chunk-6DTYLKSC.cjs.map