@lovable.dev/mcp-js 0.20.0 → 0.20.1-rc.0

package/dist/{base-C9rhAHZ0.d.ts → base-RSqYamjy.d.ts}

@@ -1,4 +1,4 @@
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error" | "auth_upstream_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes. */
 interface InvocationRecord {

package/dist/{chunk-DUNDNXK5.js → chunk-A2GUTEAK.js}

@@ -7,7 +7,7 @@ import {
   oauthConfigurationErrorResponse,
   resolveProtectedResource,
   withCors
-} from "./chunk-EPEEEI3C.js";
+} from "./chunk-E7CPOJN6.js";
 import {
   describeError,
   log

package/dist/{chunk-EPEEEI3C.js → chunk-E7CPOJN6.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-6DXGZZA4.js";
 import {
   version
-} from "./chunk-FTTVLHNN.js";
+} from "./chunk-OMEL6F6I.js";
 
 // src/core/http.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };
@@ -289,6 +289,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -313,21 +325,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
   }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -350,14 +378,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -423,8 +458,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
@@ -565,6 +606,12 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
+function oauthUpstreamUnreachableResponse() {
+  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+    status: 503,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
+  });
+}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -637,6 +684,16 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
+        if (err instanceof OAuthUpstreamUnreachableError) {
+          log.error("auth.upstream_unreachable", { ...describeError(err), outcome: "503" });
+          await recorder?.emit({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_upstream_unreachable",
+            durationMs: nowMs() - startedAt
+          });
+          return { ok: false, response: oauthUpstreamUnreachableResponse() };
+        }
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({

package/dist/{chunk-WW7NRRCJ.js → chunk-ID3YWZBR.js}

@@ -7,7 +7,7 @@ import {
   createRequestAuthorizer,
   nowMs,
   withCors
-} from "./chunk-EPEEEI3C.js";
+} from "./chunk-E7CPOJN6.js";
 import {
   describeError,
   log

package/dist/{chunk-FTTVLHNN.js → chunk-OMEL6F6I.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.20.0";
+var version = "0.20.1-rc.0";
 
 export {
   version

package/dist/{chunk-WKIXRW46.js → chunk-RT2I26ZN.js}

@@ -10,7 +10,7 @@ import {
   methodNotAllowed,
   nowMs,
   withCors
-} from "./chunk-EPEEEI3C.js";
+} from "./chunk-E7CPOJN6.js";
 
 // src/protocols/rest/invoke-tool.ts
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";

package/dist/{chunk-7JJEPFSO.js → chunk-YAXKWTJK.js}

@@ -6,7 +6,7 @@ import {
   headResponse,
   methodNotAllowed,
   withCors
-} from "./chunk-EPEEEI3C.js";
+} from "./chunk-E7CPOJN6.js";
 
 // src/protocols/rest/list-tools.ts
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";

package/dist/cli/extract-manifest.cjs

@@ -13,7 +13,7 @@ function isFileMissing(err) {
 }
 
 // package.json
-var version = "0.20.0";
+var version = "0.20.1-rc.0";
 
 // src/protocols/rest/list-tools.ts
 var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");

package/dist/cli/extract-manifest.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   buildMcpListing
-} from "../chunk-7JJEPFSO.js";
-import "../chunk-EPEEEI3C.js";
+} from "../chunk-YAXKWTJK.js";
+import "../chunk-E7CPOJN6.js";
 import "../chunk-H37EB22A.js";
 import "../chunk-6DXGZZA4.js";
 import {
@@ -10,7 +10,7 @@ import {
 } from "../chunk-Y3ZFPEQH.js";
 import {
   version
-} from "../chunk-FTTVLHNN.js";
+} from "../chunk-OMEL6F6I.js";
 
 // src/manifest/io.ts
 import { randomUUID } from "crypto";

package/dist/protocols/mcp/index.cjs

@@ -153,6 +153,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -177,21 +189,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
-}
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
+  }
+}
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -214,14 +242,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -314,8 +349,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
@@ -456,6 +497,12 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
+function oauthUpstreamUnreachableResponse() {
+  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+    status: 503,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
+  });
+}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -520,6 +567,16 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
+        if (err instanceof OAuthUpstreamUnreachableError) {
+          log.error("auth.upstream_unreachable", { ...describeError(err), outcome: "503" });
+          await recorder?.emit({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_upstream_unreachable",
+            durationMs: nowMs() - startedAt
+          });
+          return { ok: false, response: oauthUpstreamUnreachableResponse() };
+        }
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-CPkhCRxc.js';
-import { M as MetricsRecorder } from '../../base-C9rhAHZ0.js';
+import { M as MetricsRecorder } from '../../base-RSqYamjy.js';
 import 'zod';
 
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-CPkhCRxc.js';
-import { M as MetricsRecorder } from '../../base-C9rhAHZ0.js';
+import { M as MetricsRecorder } from '../../base-RSqYamjy.js';
 import 'zod';
 
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.js

@@ -1,11 +1,11 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-WW7NRRCJ.js";
+} from "../../chunk-ID3YWZBR.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-EPEEEI3C.js";
+import "../../chunk-E7CPOJN6.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-FTTVLHNN.js";
+import "../../chunk-OMEL6F6I.js";
 export {
   createMcpProtocolHandler
 };

package/dist/protocols/oauth-metadata.cjs

@@ -148,6 +148,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -172,21 +184,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
   }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -209,14 +237,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -306,8 +341,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();

package/dist/protocols/oauth-metadata.js

@@ -1,10 +1,10 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-DUNDNXK5.js";
-import "../chunk-EPEEEI3C.js";
+} from "../chunk-A2GUTEAK.js";
+import "../chunk-E7CPOJN6.js";
 import "../chunk-H37EB22A.js";
 import "../chunk-6DXGZZA4.js";
-import "../chunk-FTTVLHNN.js";
+import "../chunk-OMEL6F6I.js";
 export {
   createOAuthProtectedResourceMetadataHandler
 };

package/dist/protocols/rest/index.cjs

@@ -163,6 +163,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -187,21 +199,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
-}
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
+  }
+}
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -224,14 +252,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -324,8 +359,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
@@ -466,6 +507,12 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
+function oauthUpstreamUnreachableResponse() {
+  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+    status: 503,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
+  });
+}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -538,6 +585,16 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
+        if (err instanceof OAuthUpstreamUnreachableError) {
+          log.error("auth.upstream_unreachable", { ...describeError(err), outcome: "503" });
+          await recorder?.emit({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_upstream_unreachable",
+            durationMs: nowMs() - startedAt
+          });
+          return { ok: false, response: oauthUpstreamUnreachableResponse() };
+        }
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({

package/dist/protocols/rest/index.d.cts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-CPkhCRxc.js';
-import { M as MetricsRecorder } from '../../base-C9rhAHZ0.js';
+import { M as MetricsRecorder } from '../../base-RSqYamjy.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/rest/index.d.ts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-CPkhCRxc.js';
-import { M as MetricsRecorder } from '../../base-C9rhAHZ0.js';
+import { M as MetricsRecorder } from '../../base-RSqYamjy.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/rest/index.js

@@ -1,14 +1,14 @@
 import {
   createInvokeToolHandler
-} from "../../chunk-WKIXRW46.js";
+} from "../../chunk-RT2I26ZN.js";
 import {
   createListToolsHandler
-} from "../../chunk-7JJEPFSO.js";
+} from "../../chunk-YAXKWTJK.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-EPEEEI3C.js";
+import "../../chunk-E7CPOJN6.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-FTTVLHNN.js";
+import "../../chunk-OMEL6F6I.js";
 export {
   createInvokeToolHandler,
   createListToolsHandler

package/dist/stacks/supabase/index.cjs

@@ -174,7 +174,7 @@ function describeError(err) {
 }
 
 // package.json
-var version = "0.20.0";
+var version = "0.20.1-rc.0";
 
 // src/metrics/otlp.ts
 var SCOPE_NAME = "@lovable.dev/mcp-js";
@@ -445,6 +445,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -469,21 +481,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
   }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -506,14 +534,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -579,8 +614,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
@@ -721,6 +762,12 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
+function oauthUpstreamUnreachableResponse() {
+  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+    status: 503,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
+  });
+}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -793,6 +840,16 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
+        if (err instanceof OAuthUpstreamUnreachableError) {
+          log.error("auth.upstream_unreachable", { ...describeError(err), outcome: "503" });
+          await recorder?.emit({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_upstream_unreachable",
+            durationMs: nowMs() - startedAt
+          });
+          return { ok: false, response: oauthUpstreamUnreachableResponse() };
+        }
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({

package/dist/stacks/supabase/index.js

@@ -3,21 +3,21 @@ import {
 } from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
-} from "../../chunk-WW7NRRCJ.js";
+} from "../../chunk-ID3YWZBR.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-DUNDNXK5.js";
+} from "../../chunk-A2GUTEAK.js";
 import {
   createInvokeToolHandler
-} from "../../chunk-WKIXRW46.js";
+} from "../../chunk-RT2I26ZN.js";
 import {
   createListToolsHandler
-} from "../../chunk-7JJEPFSO.js";
+} from "../../chunk-YAXKWTJK.js";
 import "../../chunk-MA5H6PSF.js";
 import {
   assertResourcePathShape,
   createRecorderForRuntime
-} from "../../chunk-EPEEEI3C.js";
+} from "../../chunk-E7CPOJN6.js";
 import {
   trimTrailingSlash
 } from "../../chunk-H37EB22A.js";
@@ -28,7 +28,7 @@ import {
   FUNCTIONS_MOUNT_PREFIX,
   assertFunctionName
 } from "../../chunk-XQWJN6DC.js";
-import "../../chunk-FTTVLHNN.js";
+import "../../chunk-OMEL6F6I.js";
 
 // src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {

package/dist/stacks/supabase/vite.cjs

@@ -33,7 +33,7 @@ var import_node_fs = require("fs");
 var import_node_path = require("path");
 
 // package.json
-var version = "0.20.0";
+var version = "0.20.1-rc.0";
 
 // src/core/fs-errors.ts
 function isFileMissing(err) {

package/dist/stacks/supabase/vite.js

@@ -7,7 +7,7 @@ import {
 } from "../../chunk-XQWJN6DC.js";
 import {
   version
-} from "../../chunk-FTTVLHNN.js";
+} from "../../chunk-OMEL6F6I.js";
 
 // src/stacks/supabase/vite.ts
 import { resolve as resolve2, sep as sep2 } from "path";

package/dist/stacks/tanstack/index.cjs

@@ -129,7 +129,7 @@ function describeError(err) {
 }
 
 // package.json
-var version = "0.20.0";
+var version = "0.20.1-rc.0";
 
 // src/metrics/otlp.ts
 var SCOPE_NAME = "@lovable.dev/mcp-js";
@@ -421,6 +421,18 @@ var OAuthConfigurationError = class extends Error {
     this.name = "OAuthConfigurationError";
   }
 };
+var OAuthUpstreamUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthUpstreamUnreachableError";
+  }
+};
+var MetadataUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MetadataUnreachableError";
+  }
+};
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
   const path = trimTrailingSlash(url.pathname);
@@ -445,21 +457,37 @@ function oauthMetadataUrlsForIssuer(issuer) {
   return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
 }
 async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
+  const controller = new AbortController();
+  const attempts = metadataUrls.map(
+    (url) => fetchOAuthServerMetadata(url, expectedIssuer, controller.signal).catch((err) => {
       log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
+      throw err instanceof Error ? err : new Error(String(err));
+    })
+  );
+  try {
+    const metadata = await Promise.any(attempts);
+    controller.abort();
+    return metadata;
+  } catch (aggregate) {
+    const causes = aggregate instanceof AggregateError ? aggregate.errors : [aggregate];
+    const unreachable = causes.some((c) => c instanceof MetadataUnreachableError);
+    const detail = causes.map((c) => c instanceof Error ? c.message : String(c)).join("; ");
+    log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
+    const message = `failed to discover OAuth server metadata (${detail})`;
+    throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
   }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
+async function fetchOAuthServerMetadata(url, expectedIssuer, signal) {
   log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  let response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.any([signal, AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS)]),
+      redirect: "manual"
+    });
+  } catch (err) {
+    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+  }
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -482,14 +510,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+    if (err instanceof MetadataUnreachableError) {
+      log.error("oauth.discovery.unreachable", {
+        issuer,
+        ...describeError(err),
+        outcome: "503 authorization server unreachable"
+      });
+      throw new OAuthUpstreamUnreachableError(message);
+    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw new OAuthConfigurationError(message);
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -582,8 +617,14 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
+  let response;
+  try {
+    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+  } catch (err) {
+    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
+    throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
@@ -724,6 +765,12 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
+function oauthUpstreamUnreachableResponse() {
+  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+    status: 503,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
+  });
+}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -796,6 +843,16 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
+        if (err instanceof OAuthUpstreamUnreachableError) {
+          log.error("auth.upstream_unreachable", { ...describeError(err), outcome: "503" });
+          await recorder?.emit({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_upstream_unreachable",
+            durationMs: nowMs() - startedAt
+          });
+          return { ok: false, response: oauthUpstreamUnreachableResponse() };
+        }
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({

package/dist/stacks/tanstack/index.js

@@ -3,23 +3,23 @@ import {
 } from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
-} from "../../chunk-WW7NRRCJ.js";
+} from "../../chunk-ID3YWZBR.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-DUNDNXK5.js";
+} from "../../chunk-A2GUTEAK.js";
 import {
   createInvokeToolHandler
-} from "../../chunk-WKIXRW46.js";
+} from "../../chunk-RT2I26ZN.js";
 import {
   createListToolsHandler
-} from "../../chunk-7JJEPFSO.js";
+} from "../../chunk-YAXKWTJK.js";
 import "../../chunk-MA5H6PSF.js";
 import {
   createRecorderForRuntime
-} from "../../chunk-EPEEEI3C.js";
+} from "../../chunk-E7CPOJN6.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-FTTVLHNN.js";
+import "../../chunk-OMEL6F6I.js";
 
 // src/stacks/tanstack/handlers.ts
 var STACK = "tanstack";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.20.0",
+  "version": "0.20.1-rc.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {