@lovable.dev/mcp-js 0.7.0 → 0.7.1

package/dist/{chunk-G5GWSV5D.js → chunk-3XPKR4G6.js}

@@ -5,7 +5,7 @@ import {
   corsPreflightResponse,
   createRequestAuthorizer,
   withCors
-} from "./chunk-NTXHOUK6.js";
+} from "./chunk-HRMLGCXV.js";
 import {
   describeError,
   log

package/dist/{chunk-NTXHOUK6.js → chunk-HRMLGCXV.js}

@@ -170,7 +170,7 @@ function createOAuthDiscoveryResolver(auth) {
 }
 
 // src/auth/verifier.ts
-import { createRemoteJWKSet, decodeProtectedHeader, errors as joseErrors, jwtVerify } from "jose";
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 
 // src/auth/claims.ts
 function readString(value) {
@@ -190,6 +190,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -209,12 +210,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof joseErrors.JWKSTimeout || err instanceof joseErrors.JWKSInvalid)
-    return true;
-  if (!(err instanceof joseErrors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return createLocalJWKSet(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -229,10 +235,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -277,8 +279,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = createRemoteJWKSet(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/{chunk-53M2X7FU.js → chunk-LMT6RXUF.js}

@@ -9,7 +9,7 @@ import {
   headResponse,
   methodNotAllowed,
   withCors
-} from "./chunk-NTXHOUK6.js";
+} from "./chunk-HRMLGCXV.js";
 
 // src/protocols/rest/list-tools.ts
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";

package/dist/{chunk-722HKLIU.js → chunk-W7F6JRDB.js}

@@ -7,7 +7,7 @@ import {
   oauthConfigurationErrorResponse,
   resolveProtectedResource,
   withCors
-} from "./chunk-NTXHOUK6.js";
+} from "./chunk-HRMLGCXV.js";
 import {
   describeError,
   log

package/dist/protocols/mcp/index.cjs

@@ -281,6 +281,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -300,12 +301,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -320,10 +326,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -368,8 +370,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/protocols/mcp/index.js

@@ -1,8 +1,8 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-G5GWSV5D.js";
+} from "../../chunk-3XPKR4G6.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/oauth-metadata.cjs

@@ -283,6 +283,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -302,12 +303,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -322,10 +328,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -370,8 +372,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/protocols/oauth-metadata.js

@@ -1,7 +1,7 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-722HKLIU.js";
-import "../chunk-NTXHOUK6.js";
+} from "../chunk-W7F6JRDB.js";
+import "../chunk-HRMLGCXV.js";
 import "../chunk-QC3DXQTH.js";
 import "../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/rest/index.cjs

@@ -291,6 +291,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -310,12 +311,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -330,10 +336,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -378,8 +380,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/protocols/rest/index.js

@@ -1,9 +1,9 @@
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-53M2X7FU.js";
+} from "../../chunk-LMT6RXUF.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/stacks/tanstack/index.cjs

@@ -293,6 +293,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -312,12 +313,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -332,10 +338,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -380,8 +382,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/stacks/tanstack/index.js

@@ -1,15 +1,15 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-G5GWSV5D.js";
+} from "../../chunk-3XPKR4G6.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-722HKLIU.js";
+} from "../../chunk-W7F6JRDB.js";
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-53M2X7FU.js";
+} from "../../chunk-LMT6RXUF.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and the framework adapter (TanStack today, Supabase Edge Functions next) emits the route(s) at build time.",
   "type": "module",
   "repository": {