@lovable.dev/mcp-js 0.14.0 → 0.15.1

package/dist/stacks/supabase/vite.js

@@ -1,6 +1,3 @@
-import {
-  version
-} from "../../chunk-NOFPRSSI.js";
 import {
   isFileMissing
 } from "../../chunk-Y3ZFPEQH.js";
@@ -8,9 +5,13 @@ import {
   FUNCTIONS_MOUNT_PREFIX,
   assertFunctionName
 } from "../../chunk-XQWJN6DC.js";
+import {
+  version
+} from "../../chunk-GIHCQT6L.js";
 
 // src/stacks/supabase/vite.ts
 import { resolve as resolve2, sep as sep2 } from "path";
+import { loadEnv } from "vite";
 
 // src/stacks/supabase/emit.ts
 import { build } from "esbuild";
@@ -95,7 +96,16 @@ function externalizeBareAsNpm(versions) {
     }
   };
 }
-async function bundleFunctionEntry(projectRoot, mcpEntryAbs, functionName) {
+function importMetaEnvDefines(inlineEnv) {
+  const env = inlineEnv ?? {};
+  const defines = { "import.meta.env": JSON.stringify(env) };
+  for (const [key, value] of Object.entries(env)) {
+    if (/^[A-Za-z_$][\w$]*$/.test(key))
+      defines[`import.meta.env.${key}`] = JSON.stringify(value);
+  }
+  return defines;
+}
+async function bundleFunctionEntry(projectRoot, mcpEntryAbs, functionName, inlineEnv) {
   const versions = readProjectDependencyVersions(projectRoot);
   const wrapper = `import mcp from ${JSON.stringify(mcpEntryAbs)};
 import { createSupabaseHandler } from "@lovable.dev/mcp-js/stacks/supabase";
@@ -111,6 +121,7 @@ Deno.serve(createSupabaseHandler(mcp, { functionName: ${JSON.stringify(functionN
     target: "esnext",
     absWorkingDir: projectRoot,
     logLevel: "silent",
+    define: importMetaEnvDefines(inlineEnv),
     plugins: [externalizeBareAsNpm(versions)]
   });
   const out = result.outputFiles[0]?.text ?? "";
@@ -149,7 +160,7 @@ async function syncSupabaseFunction(options) {
     cleanupOrphans(paths.functionDir, /* @__PURE__ */ new Set(), removed);
     return { written, removed, inputs: [] };
   }
-  const { code, inputs } = await bundleFunctionEntry(projectRoot, paths.mcpEntryAbs, functionName);
+  const { code, inputs } = await bundleFunctionEntry(projectRoot, paths.mcpEntryAbs, functionName, options.inlineEnv);
   if (writeIfChanged(paths.functionEntry, code, hasGeneratedBanner)) {
     written.push(paths.functionEntry);
   }
@@ -193,6 +204,16 @@ function cleanupOrphans(functionDir, expected, removed) {
 function normalizePath(p) {
   return p.split(sep2).join("/");
 }
+function productionImportMetaEnv(config) {
+  return {
+    ...loadEnv("production", config.envDir, config.envPrefix),
+    MODE: "production",
+    BASE_URL: config.base ?? "/",
+    DEV: false,
+    PROD: true,
+    SSR: false
+  };
+}
 function mcpPlugin(options = {}) {
   const mcpEntryOption = options.mcpEntry ?? DEFAULT_MCP_ENTRY;
   const functionsDirOption = options.functionsDir ?? DEFAULT_FUNCTIONS_DIR;
@@ -200,13 +221,15 @@ function mcpPlugin(options = {}) {
   const urlPath = `${FUNCTIONS_MOUNT_PREFIX}${functionName}`;
   let projectRoot = process.cwd();
   let mcpEntryAbs = resolve2(projectRoot, mcpEntryOption);
+  let inlineEnv = {};
   let watchedInputs = /* @__PURE__ */ new Set();
   const regenerate = async () => {
     const { inputs } = await syncSupabaseFunction({
       projectRoot,
       mcpEntry: mcpEntryOption,
       functionsDir: functionsDirOption,
-      functionName
+      functionName,
+      inlineEnv
     });
     watchedInputs = new Set(inputs.map(normalizePath));
   };
@@ -224,6 +247,7 @@ function mcpPlugin(options = {}) {
     async configResolved(config) {
       projectRoot = config.root;
       mcpEntryAbs = resolve2(projectRoot, mcpEntryOption);
+      inlineEnv = productionImportMetaEnv(config);
       await regenerate();
     },
     configureServer(server) {

package/dist/stacks/tanstack/index.cjs

@@ -107,6 +107,214 @@ function describeError(err) {
   return { value: String(err) };
 }
 
+// src/metrics/config.ts
+var DEFAULT_METRICS_ENDPOINT = "https://api.lovable.dev/v1/app-mcp-usage";
+var METRICS_API_KEY_ENV_VAR = "LOVABLE_API_KEY";
+var METRICS_SAMPLE_RATE = 1;
+var METRICS_FLUSH_INTERVAL_MS = 5e3;
+var METRICS_MAX_BATCH_SIZE = 50;
+function assertMetricsEndpoint(endpoint) {
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be an absolute URL, got ${JSON.stringify(endpoint)}`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be http(s), got ${JSON.stringify(endpoint)}`);
+  }
+}
+function resolveMetricsConfig(config = true) {
+  const options = typeof config === "boolean" ? { enabled: config } : config;
+  const endpoint = options.endpoint ?? DEFAULT_METRICS_ENDPOINT;
+  assertMetricsEndpoint(endpoint);
+  return Object.freeze({
+    enabled: options.enabled ?? true,
+    endpoint,
+    headers: options.headers ?? {},
+    apiKeyEnvVar: METRICS_API_KEY_ENV_VAR,
+    sampleRate: METRICS_SAMPLE_RATE,
+    flushIntervalMs: METRICS_FLUSH_INTERVAL_MS,
+    maxBatchSize: METRICS_MAX_BATCH_SIZE
+  });
+}
+
+// package.json
+var version = "0.15.1";
+
+// src/metrics/otlp.ts
+var SCOPE_NAME = "@lovable.dev/mcp-js";
+var EVENT_NAME = "mcp.tool.invocation";
+var SEVERITY_INFO = 9;
+function strAttr(key, value) {
+  return { key, value: { stringValue: value } };
+}
+function intAttr(key, value) {
+  return { key, value: { intValue: String(Math.round(value)) } };
+}
+function toLogRecord(rec) {
+  const attributes = [
+    strAttr("event.name", EVENT_NAME),
+    strAttr("mcp.method", rec.method),
+    strAttr("mcp.outcome", rec.outcome),
+    intAttr("mcp.duration_ms", rec.durationMs)
+  ];
+  if (rec.tool !== null)
+    attributes.push(strAttr("mcp.tool", rec.tool));
+  if (rec.reqBytes !== void 0)
+    attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
+  if (rec.resBytes !== void 0)
+    attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
+  return {
+    timeUnixNano: rec.timeUnixNano,
+    observedTimeUnixNano: rec.timeUnixNano,
+    severityNumber: SEVERITY_INFO,
+    severityText: "INFO",
+    body: { stringValue: EVENT_NAME },
+    attributes
+  };
+}
+function buildLogsPayload(records, server) {
+  return JSON.stringify({
+    resourceLogs: [
+      {
+        resource: {
+          attributes: [
+            strAttr("service.name", server.name),
+            strAttr("service.version", server.version),
+            strAttr("telemetry.sdk.name", SCOPE_NAME),
+            strAttr("telemetry.sdk.version", version),
+            strAttr("telemetry.sdk.language", "webjs")
+          ]
+        },
+        scopeLogs: [
+          {
+            scope: { name: SCOPE_NAME, version },
+            logRecords: records.map(toLogRecord)
+          }
+        ]
+      }
+    ]
+  });
+}
+function nowUnixNano() {
+  return `${Date.now()}000000`;
+}
+
+// src/metrics/recorder.ts
+function nowMs() {
+  return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+}
+var NOOP_RECORDER = {
+  record() {
+  },
+  async flush() {
+  }
+};
+function createNoopRecorder() {
+  return NOOP_RECORDER;
+}
+function readRuntimeEnv(name) {
+  try {
+    const denoEnv = globalThis.Deno?.env;
+    const value = denoEnv?.get?.(name);
+    if (value)
+      return value;
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined") {
+      const value = process.env?.[name];
+      if (value)
+        return value;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function probeWaitUntil() {
+  const fn = globalThis.EdgeRuntime?.waitUntil;
+  return typeof fn === "function" ? fn.bind(globalThis.EdgeRuntime) : void 0;
+}
+function createMetricsRecorder(ctx, deps = {}) {
+  const { config, server } = ctx;
+  if (!config.enabled)
+    return NOOP_RECORDER;
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  if (!doFetch)
+    return NOOP_RECORDER;
+  const usesLovableEndpoint = config.endpoint === DEFAULT_METRICS_ENDPOINT;
+  const apiKey = usesLovableEndpoint ? (deps.getApiKey ?? (() => readRuntimeEnv(config.apiKeyEnvVar)))() : void 0;
+  if (usesLovableEndpoint && !apiKey) {
+    log.debug("metrics.disabled_no_api_key", { envVar: config.apiKeyEnvVar });
+    return NOOP_RECORDER;
+  }
+  const waitUntil = deps.waitUntil ?? probeWaitUntil();
+  const buffer = [];
+  let timer;
+  const schedule = (p) => {
+    if (waitUntil) {
+      try {
+        waitUntil(p);
+        return;
+      } catch {
+      }
+    }
+    void p.catch(() => {
+    });
+  };
+  const headers = {};
+  if (!usesLovableEndpoint) {
+    for (const [key, value] of Object.entries(config.headers)) {
+      if (key.toLowerCase() !== "content-type")
+        headers[key] = value;
+    }
+  }
+  headers["content-type"] = "application/json";
+  if (apiKey)
+    headers.authorization = `Bearer ${apiKey}`;
+  const flush = async () => {
+    if (buffer.length === 0)
+      return;
+    const records = buffer.splice(0, buffer.length);
+    try {
+      const res = await doFetch(config.endpoint, {
+        method: "POST",
+        headers,
+        body: buildLogsPayload(records, server),
+        keepalive: true
+      });
+      if (!res.ok)
+        log.debug("metrics.flush_rejected", { status: res.status });
+    } catch (err) {
+      log.debug("metrics.flush_failed", describeError(err));
+    }
+  };
+  const ensureTimer = () => {
+    if (timer !== void 0)
+      return;
+    timer = setInterval(() => schedule(flush()), config.flushIntervalMs);
+    timer.unref?.();
+  };
+  return {
+    record(ev) {
+      if (config.sampleRate < 1 && Math.random() >= config.sampleRate)
+        return;
+      buffer.push({ ...ev, timeUnixNano: nowUnixNano() });
+      ensureTimer();
+      if (buffer.length >= config.maxBatchSize)
+        schedule(flush());
+    },
+    flush
+  };
+}
+function createRecorderForRuntime(mcp) {
+  const config = resolveMetricsConfig(mcp.metrics);
+  if (!config.enabled)
+    return createNoopRecorder();
+  return createMetricsRecorder({ config, server: { name: mcp.name, version: mcp.version } });
+}
+
 // src/core/promise.ts
 function cachedPromise(load, label) {
   let settled = false;
@@ -535,12 +743,13 @@ function assertRequiredScopes(auth, context) {
     throw new OAuthTokenError(403, "insufficient_scope", "Additional OAuth scope is required");
   }
 }
-function createRequestAuthorizer(mcp, options = {}) {
+function createRequestAuthorizer(mcp, options = {}, recorder) {
   const runtime = getOAuthRuntime(mcp, options);
   return {
     async authorize(request) {
       if (runtime.kind === "unconfigured")
         return { ok: true };
+      const startedAt = nowMs();
       const token = parseBearerToken(request);
       if (!token) {
         log.info("auth.no_bearer_token", { outcome: "401" });
@@ -553,6 +762,12 @@ function createRequestAuthorizer(mcp, options = {}) {
       } catch (err) {
         if (err instanceof OAuthConfigurationError) {
           log.error("auth.config_error", { ...describeError(err), outcome: "500" });
+          recorder?.record({
+            tool: null,
+            method: "authorize",
+            outcome: "auth_config_error",
+            durationMs: nowMs() - startedAt
+          });
           return { ok: false, response: oauthConfigurationErrorResponse() };
         }
         if (err instanceof OAuthTokenError) {
@@ -650,23 +865,32 @@ function corsPreflightResponse(allowMethods) {
 }
 
 // src/protocols/mcp/protocol.ts
-function adaptToolToSdkCallback(tool, auth) {
+function adaptToolToSdkCallback(tool, auth, recorder) {
   return async (first) => {
     const args = tool.inputSchema ? first ?? {} : {};
+    const start = nowMs();
     let result;
     try {
       result = await tool.handler(args, new ToolContext(auth));
     } catch {
+      recorder.record({ tool: tool.name, method: "tools/call", outcome: "handler_error", durationMs: nowMs() - start });
       return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
     }
     if (result == null) {
+      recorder.record({ tool: tool.name, method: "tools/call", outcome: "handler_error", durationMs: nowMs() - start });
       return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
     }
+    recorder.record({
+      tool: tool.name,
+      method: "tools/call",
+      outcome: result.isError ? "tool_error" : "ok",
+      durationMs: nowMs() - start
+    });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };
 }
-function createMcpProtocolHandler(mcp, options = {}) {
-  const authorizer = createRequestAuthorizer(mcp, options);
+function createMcpProtocolHandler(mcp, options = {}, recorder = createRecorderForRuntime(mcp)) {
+  const authorizer = createRequestAuthorizer(mcp, options, recorder);
   const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
@@ -686,7 +910,7 @@ function createMcpProtocolHandler(mcp, options = {}) {
             outputSchema: tool.outputSchema,
             annotations: tool.annotations
           },
-          adaptToolToSdkCallback(tool, authResult.auth)
+          adaptToolToSdkCallback(tool, authResult.auth, recorder)
         );
       }
       const transport = new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
@@ -695,6 +919,7 @@ function createMcpProtocolHandler(mcp, options = {}) {
       await server.connect(transport);
       return await transport.handleRequest(request);
     } catch (err) {
+      recorder.record({ tool: null, method: "transport", outcome: "transport_error", durationMs: 0 });
       log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
@@ -795,9 +1020,9 @@ function buildMcpListing(mcp) {
     }))
   };
 }
-function createListToolsHandler(mcp, options = {}) {
+function createListToolsHandler(mcp, options = {}, recorder = createRecorderForRuntime(mcp)) {
   assertRestResourceBinding(mcp, options);
-  const authorizer = createRequestAuthorizer(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options, recorder);
   const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
@@ -828,9 +1053,9 @@ function isEmptyArgs(value) {
     return false;
   return Object.keys(value).length === 0;
 }
-function createInvokeToolHandler(mcp, options = {}) {
+function createInvokeToolHandler(mcp, options = {}, recorder = createRecorderForRuntime(mcp)) {
   assertRestResourceBinding(mcp, options);
-  const authorizer = createRequestAuthorizer(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options, recorder);
   const handle = async (request, toolName) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
@@ -884,20 +1109,29 @@ function createInvokeToolHandler(mcp, options = {}) {
       });
     }
     let result;
+    const start = nowMs();
     try {
       result = await tool.handler(args, new ToolContext(authResult.auth));
     } catch {
+      recorder.record({ tool: tool.name, method: "tools/call", outcome: "handler_error", durationMs: nowMs() - start });
       return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
         status: 500,
         headers: JSON_HEADERS
       });
     }
     if (result == null) {
+      recorder.record({ tool: tool.name, method: "tools/call", outcome: "handler_error", durationMs: nowMs() - start });
       return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
         status: 500,
         headers: JSON_HEADERS
       });
     }
+    recorder.record({
+      tool: tool.name,
+      method: "tools/call",
+      outcome: result.isError ? "tool_error" : "ok",
+      durationMs: nowMs() - start
+    });
     return Response.json({
       content: result.content ?? [],
       structuredContent: result.structuredContent,

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
-import { d as McpDefinition } from '../../types-BanzncFh.js';
+import { d as McpDefinition } from '../../types-COY42xux.js';
 import 'zod';
 
 interface TanStackRouteCtx {

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
-import { d as McpDefinition } from '../../types-BanzncFh.js';
+import { d as McpDefinition } from '../../types-COY42xux.js';
 import 'zod';
 
 interface TanStackRouteCtx {

package/dist/stacks/tanstack/index.js

@@ -3,20 +3,21 @@ import {
 } from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
-} from "../../chunk-WLNT2FX7.js";
+} from "../../chunk-UCPYLSNN.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-QDKOF4UF.js";
+} from "../../chunk-ILYTJXDR.js";
 import {
   createInvokeToolHandler
-} from "../../chunk-YWLMMDET.js";
+} from "../../chunk-CEDD57G2.js";
 import {
   createListToolsHandler
-} from "../../chunk-VNRQPA4K.js";
+} from "../../chunk-QT5L4CS3.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-G4XA7IJM.js";
-import "../../chunk-QC3DXQTH.js";
+import "../../chunk-YTOMGJV5.js";
+import "../../chunk-DCWYK4CA.js";
 import "../../chunk-6DXGZZA4.js";
+import "../../chunk-GIHCQT6L.js";
 
 // src/stacks/tanstack/handlers.ts
 function forwarded(request, options) {

package/dist/{types-BanzncFh.d.ts → types-COY42xux.d.ts}

@@ -105,6 +105,29 @@ declare class ToolContext {
     getClaims(): JwtClaims | undefined;
 }
 
+/**
+ * Usage-metrics options. Pass a boolean to the Vite plugins for the common
+ * on/off case, or this object to override the ingest endpoint (e.g. to
+ * self-host the collector outside Lovable).
+ */
+interface MetricsOptions {
+    /** Master switch. Default `true`; metrics still self-disable at runtime when
+     *  the API key env var is absent. */
+    enabled?: boolean;
+    /** OTLP/HTTP (JSON) logs URL to POST batches to — the default Lovable route or
+     *  any OTLP collector. Must be an absolute http(s) URL.
+     *  @default "https://api.lovable.dev/v1/app-mcp-usage" */
+    endpoint?: string;
+    /** Extra request headers — e.g. the auth token for a private OTLP collector.
+     *  Sent verbatim with every batch (and baked into the build output, so source
+     *  your own build-time env for secrets). Ignored for the default Lovable
+     *  endpoint, which authenticates with `LOVABLE_API_KEY` instead. `content-type`
+     *  cannot be overridden (OTLP/HTTP JSON requires `application/json`). */
+    headers?: Record<string, string>;
+}
+/** Either the bare on/off toggle or the full options object. */
+type MetricsConfig = boolean | MetricsOptions;
+
 /**
  * Any zod schema. Aliased to zod's `ZodType` (no generics) — non-deprecated
  * in both v3 and v4. Use this when you need to type an individual schema;
@@ -273,10 +296,16 @@ interface McpDefinitionInput {
      */
     readonly instructions: string;
     readonly tools: readonly AnyToolDefinition[];
+    /**
+     * Usage-metrics emission (runtime telemetry), on by default. `false` opts out;
+     * `{ endpoint, headers }` sends to your own OTLP collector. Self-disables at
+     * runtime without `LOVABLE_API_KEY` on the default Lovable endpoint.
+     */
+    readonly metrics?: MetricsConfig;
 }
 declare const McpDefinitionBrand: unique symbol;
 type McpDefinition = McpDefinitionInput & {
     readonly [McpDefinitionBrand]: never;
 };
 
-export { type AudioContent as A, type ContentAnnotations as C, type EmbeddedBlobResource as E, type ImageContent as I, type JwtClaims as J, type McpAuthConfig as M, type ResourceLink as R, type TextContent as T, type ZodRawShape as Z, type ContentBlock as a, type EmbeddedResource as b, type EmbeddedTextResource as c, type McpDefinition as d, type McpDefinitionInput as e, type ResourceLinkIcon as f, type ToolAnnotations as g, type ToolContent as h, ToolContext as i, type ToolDefinition as j, type ToolHandlerResult as k, type ZodSchema as l };
+export { type AudioContent as A, type ContentAnnotations as C, type EmbeddedBlobResource as E, type ImageContent as I, type JwtClaims as J, type McpAuthConfig as M, type ResourceLink as R, type TextContent as T, type ZodRawShape as Z, type ContentBlock as a, type EmbeddedResource as b, type EmbeddedTextResource as c, type McpDefinition as d, type McpDefinitionInput as e, type MetricsConfig as f, type MetricsOptions as g, type ResourceLinkIcon as h, type ToolAnnotations as i, type ToolContent as j, ToolContext as k, type ToolDefinition as l, type ToolHandlerResult as m, type ZodSchema as n };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {