fastmcp 4.12.7 → 4.13.0

package/dist/FastMCP.cjs

@@ -24,7 +24,7 @@ var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
-var _chunk6DTYLKSCcjs = require('./chunk-6DTYLKSC.cjs');
+var _chunk5FVNY65Mcjs = require('./chunk-5FVNY65M.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunk6DTYLKSCcjs = require('./chunk-6DTYLKSC.cjs');
 
 
 
-exports.AuthProvider = _chunk6DTYLKSCcjs.AuthProvider; exports.AzureProvider = _chunk6DTYLKSCcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunk6DTYLKSCcjs.GitHubProvider; exports.GoogleProvider = _chunk6DTYLKSCcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk6DTYLKSCcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunk6DTYLKSCcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunk6DTYLKSCcjs.requireAll; exports.requireAny = _chunk6DTYLKSCcjs.requireAny; exports.requireAuth = _chunk6DTYLKSCcjs.requireAuth; exports.requireRole = _chunk6DTYLKSCcjs.requireRole; exports.requireScopes = _chunk6DTYLKSCcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-B_OJFNC0.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-B_OJFNC0.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-VFBUPSNI.js";
+} from "./chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-B_OJFNC0.d.cts → OAuthProvider-Bvt5a7yr.d.cts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */
@@ -454,6 +470,14 @@ declare class OAuthProxy {
     private config;
     private consentManager;
     private jwtIssuer?;
+    /**
+     * The fallback storage this proxy created for itself, if any. It runs a
+     * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+     * it — and once the storage is wrapped for encryption it is reachable
+     * through nothing else. A caller-supplied storage is deliberately not
+     * recorded here: its lifetime belongs to the caller.
+     */
+    private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
      * for the defence-in-depth callback checks. A registration never changes

package/dist/{OAuthProvider-B_OJFNC0.d.ts → OAuthProvider-Bvt5a7yr.d.ts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */
@@ -454,6 +470,14 @@ declare class OAuthProxy {
     private config;
     private consentManager;
     private jwtIssuer?;
+    /**
+     * The fallback storage this proxy created for itself, if any. It runs a
+     * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+     * it — and once the storage is wrapped for encryption it is reachable
+     * through nothing else. A caller-supplied storage is deliberately not
+     * recorded here: its lifetime belongs to the caller.
+     */
+    private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
      * for the defence-in-depth callback checks. A registration never changes

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunk6DTYLKSCcjs = require('../chunk-6DTYLKSC.cjs');
+var _chunk5FVNY65Mcjs = require('../chunk-5FVNY65M.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunk6DTYLKSCcjs = require('../chunk-6DTYLKSC.cjs');
 
 
 
-exports.AuthProvider = _chunk6DTYLKSCcjs.AuthProvider; exports.AzureProvider = _chunk6DTYLKSCcjs.AzureProvider; exports.ConsentManager = _chunk6DTYLKSCcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk6DTYLKSCcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk6DTYLKSCcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk6DTYLKSCcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk6DTYLKSCcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk6DTYLKSCcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk6DTYLKSCcjs.DiskStore; exports.EncryptedTokenStorage = _chunk6DTYLKSCcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk6DTYLKSCcjs.GitHubProvider; exports.GoogleProvider = _chunk6DTYLKSCcjs.GoogleProvider; exports.JWKSVerifier = _chunk6DTYLKSCcjs.JWKSVerifier; exports.JWTIssuer = _chunk6DTYLKSCcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk6DTYLKSCcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk6DTYLKSCcjs.OAuthProvider; exports.OAuthProxy = _chunk6DTYLKSCcjs.OAuthProxy; exports.OAuthProxyError = _chunk6DTYLKSCcjs.OAuthProxyError; exports.PKCEUtils = _chunk6DTYLKSCcjs.PKCEUtils; exports.getAuthSession = _chunk6DTYLKSCcjs.getAuthSession; exports.requireAll = _chunk6DTYLKSCcjs.requireAll; exports.requireAny = _chunk6DTYLKSCcjs.requireAny; exports.requireAuth = _chunk6DTYLKSCcjs.requireAuth; exports.requireRole = _chunk6DTYLKSCcjs.requireRole; exports.requireScopes = _chunk6DTYLKSCcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.ConsentManager = _chunk5FVNY65Mcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk5FVNY65Mcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk5FVNY65Mcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk5FVNY65Mcjs.DiskStore; exports.EncryptedTokenStorage = _chunk5FVNY65Mcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.JWKSVerifier = _chunk5FVNY65Mcjs.JWKSVerifier; exports.JWTIssuer = _chunk5FVNY65Mcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk5FVNY65Mcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.OAuthProxy = _chunk5FVNY65Mcjs.OAuthProxy; exports.OAuthProxyError = _chunk5FVNY65Mcjs.OAuthProxyError; exports.PKCEUtils = _chunk5FVNY65Mcjs.PKCEUtils; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-B_OJFNC0.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-B_OJFNC0.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-VFBUPSNI.js";
+} from "../chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-6DTYLKSC.cjs → chunk-5FVNY65M.cjs}

@@ -419,6 +419,16 @@ var ClaimsExtractor = (_class = class {
 
 // src/auth/utils/consent.ts
 
+
+// src/auth/utils/constantTime.ts
+
+function equalsConstantTime(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
+}
+
+// src/auth/utils/consent.ts
 var ConsentManager = class {
   
   constructor(signingKey) {
@@ -671,9 +681,7 @@ var ConsentManager = class {
       }
       const payload = Buffer.from(payloadB64, "base64").toString("utf8");
       const expectedSignature = this.sign(payload);
-      const actualBuf = Buffer.from(signature);
-      const expectedBuf = Buffer.from(expectedSignature);
-      if (actualBuf.length !== expectedBuf.length || !_crypto.timingSafeEqual.call(void 0, actualBuf, expectedBuf)) {
+      if (!equalsConstantTime(signature, expectedSignature)) {
         return null;
       }
       const data = JSON.parse(payload);
@@ -805,9 +813,7 @@ var JWTIssuer = class {
       }
       const [headerB64, payloadB64, signatureB64] = parts;
       const expectedSignature = this.sign(`${headerB64}.${payloadB64}`);
-      const actualBuf = Buffer.from(signatureB64);
-      const expectedBuf = Buffer.from(expectedSignature);
-      if (actualBuf.length !== expectedBuf.length || !_crypto.timingSafeEqual.call(void 0, actualBuf, expectedBuf)) {
+      if (!signatureB64 || !equalsConstantTime(signatureB64, expectedSignature)) {
         return {
           error: "Invalid signature",
           valid: false
@@ -955,11 +961,6 @@ var PKCEUtils = class _PKCEUtils {
     return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
   }
 };
-function equalsConstantTime(a, b) {
-  const bufA = Buffer.from(a, "utf8");
-  const bufB = Buffer.from(b, "utf8");
-  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
-}
 
 // src/auth/utils/tokenStore.ts
 
@@ -1140,17 +1141,26 @@ var OAuthProxy = (_class4 = class {
   
   
   
+  /**
+   * The fallback storage this proxy created for itself, if any. It runs a
+   * cleanup timer that keeps the event loop alive, so `destroy()` has to stop
+   * it — and once the storage is wrapped for encryption it is reachable
+   * through nothing else. A caller-supplied storage is deliberately not
+   * recorded here: its lifetime belongs to the caller.
+   */
+  __init7() {this.ownedTokenStorage = null}
   /**
    * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
    * for the defence-in-depth callback checks. A registration never changes
    * after it is written, so caching it locally cannot go stale; it is also
    * persisted, so another instance can hydrate it.
    */
-  __init7() {this.registeredClientsByClientId = /* @__PURE__ */ new Map()}
+  __init8() {this.registeredClientsByClientId = /* @__PURE__ */ new Map()}
   
   
-  constructor(config) {;_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);_class4.prototype.__init7.call(this);
+  constructor(config) {;_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);_class4.prototype.__init7.call(this);_class4.prototype.__init8.call(this);
     this.config = {
+      allowPlainPkce: true,
       authorizationCodeTtl: DEFAULT_AUTHORIZATION_CODE_TTL,
       consentRequired: true,
       enableTokenSwap: true,
@@ -1161,7 +1171,11 @@ var OAuthProxy = (_class4 = class {
       upstreamTokenEndpointAuthMethod: "client_secret_basic",
       ...config
     };
-    let storage = config.tokenStorage || new MemoryTokenStorage();
+    let storage = config.tokenStorage;
+    if (!storage) {
+      this.ownedTokenStorage = new MemoryTokenStorage();
+      storage = this.ownedTokenStorage;
+    }
     const isAlreadyEncrypted = storage.constructor.name === "EncryptedTokenStorage";
     if (!isAlreadyEncrypted && config.encryptionKey !== false) {
       const encryptionKey = typeof config.encryptionKey === "string" ? config.encryptionKey : this.generateSigningKey();
@@ -1221,6 +1235,12 @@ var OAuthProxy = (_class4 = class {
         "code_challenge_method required when code_challenge is present"
       );
     }
+    if (params.code_challenge_method === "plain" && !this.config.allowPlainPkce) {
+      throw new OAuthProxyError(
+        "invalid_request",
+        "code_challenge_method 'plain' is not supported; use S256"
+      );
+    }
     const transaction = await this.createTransaction(params);
     if (this.config.consentRequired && !transaction.consentGiven) {
       return this.consentManager.createConsentResponse(
@@ -1238,6 +1258,7 @@ var OAuthProxy = (_class4 = class {
       clearInterval(this.cleanupInterval);
       this.cleanupInterval = null;
     }
+    _optionalChain([this, 'access', _8 => _8.ownedTokenStorage, 'optionalAccess', _9 => _9.destroy, 'call', _10 => _10()]);
     this.registeredClientsByClientId.clear();
   }
   /**
@@ -1279,6 +1300,12 @@ var OAuthProxy = (_class4 = class {
           "code_verifier required for PKCE"
         );
       }
+      if (clientCode.codeChallengeMethod === "plain" && !this.config.allowPlainPkce) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "code_challenge_method 'plain' is not supported; use S256"
+        );
+      }
       const valid = PKCEUtils.validateChallenge(
         request.code_verifier,
         clientCode.codeChallenge,
@@ -1332,7 +1359,7 @@ var OAuthProxy = (_class4 = class {
   getAuthorizationServerMetadata() {
     return {
       authorizationEndpoint: `${this.config.baseUrl}/oauth/authorize`,
-      codeChallengeMethodsSupported: ["S256", "plain"],
+      codeChallengeMethodsSupported: this.config.allowPlainPkce ? ["S256", "plain"] : ["S256"],
       grantTypesSupported: ["authorization_code", "refresh_token"],
       issuer: this.config.baseUrl,
       registrationEndpoint: `${this.config.baseUrl}/oauth/register`,
@@ -1448,7 +1475,7 @@ var OAuthProxy = (_class4 = class {
       return null;
     }
     const result = await this.jwtIssuer.verify(fastmcpToken);
-    if (!result.valid || !_optionalChain([result, 'access', _8 => _8.claims, 'optionalAccess', _9 => _9.jti])) {
+    if (!result.valid || !_optionalChain([result, 'access', _11 => _11.claims, 'optionalAccess', _12 => _12.jti])) {
       return null;
     }
     const mapping = await this.tokenStorage.get(
@@ -1635,7 +1662,7 @@ var OAuthProxy = (_class4 = class {
       throw new Error("JWT issuer not initialized");
     }
     const result = await this.jwtIssuer.verify(token);
-    if (!result.valid || !_optionalChain([result, 'access', _10 => _10.claims, 'optionalAccess', _11 => _11.jti])) {
+    if (!result.valid || !_optionalChain([result, 'access', _13 => _13.claims, 'optionalAccess', _14 => _14.jti])) {
       throw new Error("Failed to extract JTI from token");
     }
     return result.claims.jti;
@@ -1803,7 +1830,7 @@ var OAuthProxy = (_class4 = class {
         "Invalid or expired refresh token"
       );
     }
-    const jti = _optionalChain([verifyResult, 'access', _12 => _12.claims, 'optionalAccess', _13 => _13.jti]);
+    const jti = _optionalChain([verifyResult, 'access', _15 => _15.claims, 'optionalAccess', _16 => _16.jti]);
     if (!jti) {
       throw new OAuthProxyError("invalid_grant", "Refresh token missing JTI");
     }
@@ -2252,7 +2279,7 @@ var AuthProvider = class {
     if (!request) {
       return void 0;
     }
-    const authHeader = _optionalChain([request, 'access', _14 => _14.headers, 'optionalAccess', _15 => _15.authorization]);
+    const authHeader = _optionalChain([request, 'access', _17 => _17.headers, 'optionalAccess', _18 => _18.authorization]);
     if (!authHeader || !authHeader.startsWith("Bearer ")) {
       return void 0;
     }
@@ -2453,10 +2480,10 @@ var OAuthProvider = class extends AuthProvider {
 var _promises = require('fs/promises');
 var _path = require('path');
 var DiskStore = (_class5 = class {
-  __init8() {this.cleanupInterval = null}
+  __init9() {this.cleanupInterval = null}
   
   
-  constructor(options) {;_class5.prototype.__init8.call(this);
+  constructor(options) {;_class5.prototype.__init9.call(this);
     this.directory = options.directory;
     this.fileExtension = options.fileExtension || ".json";
     void this.ensureDirectory();
@@ -2629,9 +2656,9 @@ var DiskStore = (_class5 = class {
 var JWKSVerifier = (_class6 = class {
   
   
-  __init9() {this.joseLoaded = false}
+  __init10() {this.joseLoaded = false}
   
-  constructor(config) {;_class6.prototype.__init9.call(this);
+  constructor(config) {;_class6.prototype.__init10.call(this);
     this.config = {
       cacheDuration: 36e5,
       // 1 hour
@@ -2789,4 +2816,4 @@ Original error: ${error.message}`
 
 
 exports.getAuthSession = getAuthSession; exports.requireAll = requireAll; exports.requireAny = requireAny; exports.requireAuth = requireAuth; exports.requireRole = requireRole; exports.requireScopes = requireScopes; exports.DEFAULT_ACCESS_TOKEN_TTL = DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_REFRESH_TOKEN_TTL = DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_AUTHORIZATION_CODE_TTL = DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_TRANSACTION_TTL = DEFAULT_TRANSACTION_TTL; exports.ConsentManager = ConsentManager; exports.JWTIssuer = JWTIssuer; exports.PKCEUtils = PKCEUtils; exports.EncryptedTokenStorage = EncryptedTokenStorage; exports.MemoryTokenStorage = MemoryTokenStorage; exports.OAuthProxy = OAuthProxy; exports.OAuthProxyError = OAuthProxyError; exports.AuthProvider = AuthProvider; exports.AzureProvider = AzureProvider; exports.GitHubProvider = GitHubProvider; exports.GoogleProvider = GoogleProvider; exports.OAuthProvider = OAuthProvider; exports.DiskStore = DiskStore; exports.JWKSVerifier = JWKSVerifier;
-//# sourceMappingURL=chunk-6DTYLKSC.cjs.map
+//# sourceMappingURL=chunk-5FVNY65M.cjs.map