@lovable.dev/mcp-js 0.21.0-rc.3 → 0.21.0-rc.4

package/README.md

@@ -179,7 +179,8 @@ Use an OAuth access token from the configured authorization server for MCP calls
 | --- | --- |
 | `issuer` | OAuth/OIDC issuer URL. Must be HTTPS except localhost development URLs and must match the token `iss` exactly. Required. |
 | `resource` | Canonical protected-resource URL published in metadata. It also anchors the accepted audience unless `acceptedAudiences` is set. When omitted, the published resource is derived from the request origin plus the stack adapter's `resourcePath` and you must set `acceptedAudiences`; the metadata handler throws at construction if neither `resource` nor `resourcePath` is set. |
-| `acceptedAudiences` | Accepted JWT audience(s). Defaults to `resource` when that is set. One of `resource` or `acceptedAudiences` is required. |
+| `acceptedAudiences` | Accepted JWT audience(s). Defaults to `resource` when that is set. One of `resource` or `acceptedAudiences` is required. A populated token `aud` must match one of these exactly; when `aud` is empty or absent, see `acceptResourceClaim`. |
+| `acceptResourceClaim` | Defaults to `true`: a token whose `aud` is an empty array or absent is accepted when its `resource` claim matches an accepted audience (trailing slashes ignored). The fallback engages for **any** configured issuer minting such tokens, not only Lovable's. The `resource` claim is a Lovable OAuth convention derived from the RFC 8707 `resource` request parameter, not a registered JWT claim; Lovable's OAuth server validates the requested resource at authorization time before stamping it. A populated `aud` is always authoritative — the fallback never rescues a non-matching `aud`. Set `false` to require a matching `aud` (strict RFC 9068). |
 | `jwksUri` | JWKS URL override. If omitted, the runtime discovers `jwks_uri` from OAuth/OIDC metadata; setting it skips discovery entirely. |
 | `requiredScopes` | Required scopes. Advertised in metadata/challenges and enforced against the token `scope`. |
 | `requireOAuthClientClaim` | Defaults to `true`; rejects tokens carrying neither `client_id` nor the OIDC `azp` (authorized party) so copied app-session JWTs do not pass as OAuth client tokens. Supabase OAuth 2.1 server tokens carry `client_id` and issuers like Google/Keycloak/Entra use `azp`, so keep the default; only legacy `signInWithPassword` session tokens lack both and need `false`. |

package/dist/{base-DTtaX5Rf.d.ts → base-CFy5vZ5Z.d.ts}

@@ -1,6 +1,8 @@
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
- *  tool name, the JSON-RPC method, the result class, timing, and byte sizes. */
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
 interface InvocationRecord {
     /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
     tool: string | null;
@@ -10,6 +12,9 @@ interface InvocationRecord {
     durationMs: number;
     reqBytes?: number;
     resBytes?: number;
+    /** The `tool_error` message (text content of an `isError` result). Local log
+     *  only — never sent to the collector, so it stays on-box for the operator. */
+    errorText?: string;
 }
 /** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
  *  single OTLP POST, awaited so it lands before the request ends. */

package/dist/{chunk-SIDWSSWV.js → chunk-2PJKJI76.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.21.0-rc.3";
+var version = "0.21.0-rc.4";
 
 export {
   version

package/dist/chunk-6QFZYYUV.js

@@ -0,0 +1,11 @@
+// src/core/content.ts
+function extractTextContent(content) {
+  if (!content)
+    return void 0;
+  const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+  return text.length > 0 ? text : void 0;
+}
+
+export {
+  extractTextContent
+};

package/dist/{chunk-TVU5FL2T.js → chunk-7G743K3G.js}

@@ -6,7 +6,7 @@ import {
   headResponse,
   methodNotAllowed,
   withCors
-} from "./chunk-CIAVINZ5.js";
+} from "./chunk-Q22Z6G6N.js";
 
 // src/protocols/rest/list-tools.ts
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";

package/dist/{chunk-JIOOUIDX.js → chunk-FBR7D3XV.js}

@@ -1,3 +1,6 @@
+import {
+  extractTextContent
+} from "./chunk-6QFZYYUV.js";
 import {
   ToolContext
 } from "./chunk-MA5H6PSF.js";
@@ -10,7 +13,7 @@ import {
   methodNotAllowed,
   nowMs,
   withCors
-} from "./chunk-CIAVINZ5.js";
+} from "./chunk-Q22Z6G6N.js";
 
 // src/protocols/rest/invoke-tool.ts
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
@@ -113,7 +116,8 @@ function createInvokeToolHandler(mcp, options = {}) {
       tool: tool.name,
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
-      durationMs: nowMs() - start
+      durationMs: nowMs() - start,
+      errorText: result.isError ? extractTextContent(result.content) : void 0
     });
     return Response.json({
       content: result.content ?? [],

package/dist/{chunk-5W6JK6OS.js → chunk-PML3SKRA.js}

@@ -1,3 +1,6 @@
+import {
+  extractTextContent
+} from "./chunk-6QFZYYUV.js";
 import {
   ToolContext
 } from "./chunk-MA5H6PSF.js";
@@ -7,7 +10,7 @@ import {
   createRequestAuthorizer,
   nowMs,
   withCors
-} from "./chunk-CIAVINZ5.js";
+} from "./chunk-Q22Z6G6N.js";
 import {
   describeError,
   log
@@ -45,7 +48,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
       tool: tool.name,
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
-      durationMs: nowMs() - start
+      durationMs: nowMs() - start,
+      errorText: result.isError ? extractTextContent(result.content) : void 0
     });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };

package/dist/{chunk-CIAVINZ5.js → chunk-Q22Z6G6N.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-6DXGZZA4.js";
 import {
   version
-} from "./chunk-SIDWSSWV.js";
+} from "./chunk-2PJKJI76.js";
 
 // src/core/http.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };
@@ -156,7 +156,8 @@ var BaseMetricRecorder = class {
       method: ev.method,
       outcome: ev.outcome,
       durationMs: ev.durationMs,
-      stack: this.stack
+      stack: this.stack,
+      ...ev.errorText !== void 0 && { errorText: ev.errorText }
     });
     if (!this.config.enabled)
       return;
@@ -284,23 +285,9 @@ function cachedPromise(load, label) {
 
 // src/auth/discovery.ts
 var OAuthConfigurationError = class extends Error {
-  constructor(message, stage) {
-    super(message);
-    this.stage = stage;
-    this.name = "OAuthConfigurationError";
-  }
-};
-var OAuthUpstreamUnreachableError = class extends Error {
-  constructor(message, stage) {
-    super(message);
-    this.stage = stage;
-    this.name = "OAuthUpstreamUnreachableError";
-  }
-};
-var MetadataUnreachableError = class extends Error {
   constructor(message) {
     super(message);
-    this.name = "MetadataUnreachableError";
+    this.name = "OAuthConfigurationError";
   }
 };
 var METADATA_FETCH_TIMEOUT_MS = 5e3;
@@ -332,28 +319,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
-      const error = err instanceof Error ? err : new Error(String(err));
-      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(error) });
-      errors.push(error);
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
+      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  const unreachable = errors.some((e) => e instanceof MetadataUnreachableError);
-  const detail = errors.map((e) => e.message).join("; ");
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors: detail, unreachable });
-  const message = `failed to discover OAuth server metadata (${detail})`;
-  throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
+  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
   log.debug("oauth.discovery.fetch", { url });
-  let response;
-  try {
-    response = await fetch(url, {
-      signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
-      redirect: "manual"
-    });
-  } catch (err) {
-    throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
-  }
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -376,21 +351,14 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
-    const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
-    if (err instanceof MetadataUnreachableError) {
-      log.error("oauth.discovery.unreachable", {
-        issuer,
-        ...describeError(err),
-        outcome: "503 authorization server unreachable"
-      });
-      throw new OAuthUpstreamUnreachableError(message, "discovery");
-    }
     log.error("oauth.discovery.config_error", {
       issuer,
       ...describeError(err),
       outcome: "500 oauth configuration error"
     });
-    throw new OAuthConfigurationError(message, "discovery");
+    throw new OAuthConfigurationError(
+      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 function createOAuthDiscoveryResolver(auth) {
@@ -423,13 +391,18 @@ function readString(value) {
 function splitScopes(value) {
   if (typeof value === "string")
     return value.split(/\s+/).filter(Boolean);
-  if (Array.isArray(value))
-    return value.filter((entry) => typeof entry === "string" && entry.length > 0);
-  return [];
+  return stringClaimList(value);
 }
 function stringClaim(claims, name) {
   return readString(claims[name]);
 }
+function stringClaimList(value) {
+  if (typeof value === "string")
+    return value === "" ? [] : [value];
+  if (Array.isArray(value))
+    return value.filter((entry) => typeof entry === "string" && entry !== "");
+  return [];
+}
 
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
@@ -456,24 +429,15 @@ function tokenHeaderFields(token) {
   }
 }
 async function fetchVerificationKeySet(jwksUri) {
-  let response;
-  try {
-    response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
-  } catch (err) {
-    log.error("oauth.jwks.unreachable", { ...describeError(err), outcome: "503 authorization server unreachable" });
-    throw new OAuthUpstreamUnreachableError(
-      `JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`,
-      "jwks"
-    );
-  }
   try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
     if (!response.ok)
       throw new Error(`JWKS endpoint returned ${response.status}`);
     const json = await response.json();
     return createLocalJWKSet(json);
   } catch (err) {
     log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function assertAccessTokenTyp(token, allowed) {
@@ -490,13 +454,12 @@ function assertAccessTokenTyp(token, allowed) {
     throw new OAuthTokenError(401, "invalid_token", "Access token typ header is not accepted");
   }
 }
-async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
+async function verifyJwtClaims(token, keySet, issuer, auth) {
   try {
     const { payload } = await jwtVerify(token, keySet, {
       // `issuer` is trimmed of any trailing slash; accept both forms so a token whose
       // `iss` carries the slash the AS publishes still verifies.
       issuer: [issuer, `${issuer}/`],
-      audience: [...audience],
       algorithms: auth.algorithms ? [...auth.algorithms] : DEFAULT_JWT_ALGORITHMS,
       requiredClaims: ["sub", "exp"],
       clockTolerance: auth.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS
@@ -507,6 +470,22 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     throw err;
   }
 }
+function checkAcceptedAudience(claims, accepted, auth) {
+  const audPopulated = claims.aud !== void 0 && !(Array.isArray(claims.aud) && claims.aud.length === 0);
+  if (audPopulated) {
+    if (stringClaimList(claims.aud).some((audience) => accepted.includes(audience)))
+      return "aud";
+    log.debug("oauth.verify.bad_audience", { tokenAud: claims.aud, accepted, outcome: "401 invalid_token" });
+  } else if (auth.acceptResourceClaim !== false) {
+    const acceptedTrimmed = accepted.map(trimTrailingSlash);
+    if (stringClaimList(claims.resource).some((resource) => acceptedTrimmed.includes(trimTrailingSlash(resource))))
+      return "resource";
+    log.debug("oauth.verify.bad_resource", { tokenResource: claims.resource, accepted, outcome: "401 invalid_token" });
+  } else {
+    log.debug("oauth.verify.empty_audience", { accepted, outcome: "401 invalid_token" });
+  }
+  throw new OAuthTokenError(401, "invalid_token", "token audience is not accepted");
+}
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
@@ -551,14 +530,16 @@ function createOAuthTokenVerifier(auth, discovery) {
     log.debug("oauth.jwks.fetch", { jwksUri });
     const keySet = await fetchVerificationKeySet(jwksUri);
     assertAccessTokenTyp(token, allowedTyps);
-    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
+    const claims = await verifyJwtClaims(token, keySet, issuer, auth);
+    const audienceVia = checkAcceptedAudience(claims, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
     log.info("oauth.verify.ok", {
       sub: context.principal.sub,
       clientId: context.principal.clientId,
-      scopes: context.principal.scopes
+      scopes: context.principal.scopes,
+      audienceVia
     });
     return context;
   };
@@ -607,12 +588,6 @@ function oauthConfigurationErrorResponse() {
     headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
   });
 }
-function oauthUpstreamUnreachableResponse() {
-  return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
-    status: 503,
-    headers: { ...JSON_HEADERS, "Cache-Control": "no-store", "Retry-After": "30" }
-  });
-}
 function parseBearerToken(request) {
   const header = request.headers.get("Authorization");
   if (!header)
@@ -685,22 +660,12 @@ function createRequestAuthorizer(mcp, options = {}) {
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
-        if (err instanceof OAuthUpstreamUnreachableError) {
-          log.error("auth.upstream_unreachable", { ...describeError(err), stage: err.stage, outcome: "503" });
-          await recorder?.emit({
-            tool: null,
-            method: "authorize",
-            outcome: err.stage === "jwks" ? "auth_jwks_unreachable" : "auth_discovery_unreachable",
-            durationMs: nowMs() - startedAt
-          });
-          return { ok: false, response: oauthUpstreamUnreachableResponse() };
-        }
         if (err instanceof OAuthConfigurationError) {
-          log.error("auth.config_error", { ...describeError(err), stage: err.stage, outcome: "500" });
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           await recorder?.emit({
             tool: null,
             method: "authorize",
-            outcome: err.stage === "jwks" ? "auth_jwks_config_error" : "auth_discovery_config_error",
+            outcome: "auth_config_error",
             durationMs: nowMs() - startedAt
           });
           return { ok: false, response: oauthConfigurationErrorResponse() };

package/dist/{chunk-NENAFXZJ.js → chunk-XPYU4DI6.js}

@@ -7,7 +7,7 @@ import {
   oauthConfigurationErrorResponse,
   resolveProtectedResource,
   withCors
-} from "./chunk-CIAVINZ5.js";
+} from "./chunk-Q22Z6G6N.js";
 import {
   describeError,
   log

package/dist/cli/extract-manifest.cjs

@@ -13,7 +13,7 @@ function isFileMissing(err) {
 }
 
 // package.json
-var version = "0.21.0-rc.3";
+var version = "0.21.0-rc.4";
 
 // src/protocols/rest/list-tools.ts
 var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
@@ -80,6 +80,8 @@ function manifestAuth(auth) {
     oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
   if (auth.requireOAuthClientClaim !== void 0)
     oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptResourceClaim !== void 0)
+    oauth.accept_resource_claim = auth.acceptResourceClaim;
   if (auth.acceptedAudiences !== void 0)
     oauth.accepted_audiences = auth.acceptedAudiences;
   if (auth.requiredScopes !== void 0)

package/dist/cli/extract-manifest.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   buildMcpListing
-} from "../chunk-TVU5FL2T.js";
-import "../chunk-CIAVINZ5.js";
+} from "../chunk-7G743K3G.js";
+import "../chunk-Q22Z6G6N.js";
 import "../chunk-H37EB22A.js";
 import "../chunk-6DXGZZA4.js";
 import {
@@ -10,7 +10,7 @@ import {
 } from "../chunk-Y3ZFPEQH.js";
 import {
   version
-} from "../chunk-SIDWSSWV.js";
+} from "../chunk-2PJKJI76.js";
 
 // src/manifest/io.ts
 import { randomUUID } from "crypto";
@@ -35,6 +35,8 @@ function manifestAuth(auth) {
     oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
   if (auth.requireOAuthClientClaim !== void 0)
     oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptResourceClaim !== void 0)
+    oauth.accept_resource_claim = auth.acceptResourceClaim;
   if (auth.acceptedAudiences !== void 0)
     oauth.accepted_audiences = auth.acceptedAudiences;
   if (auth.requiredScopes !== void 0)

package/dist/index.cjs

@@ -55,6 +55,9 @@ function resolveMetricsConfig(config = true) {
 }
 
 // src/core/url.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
 function isLocalHTTPHost(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
@@ -166,8 +169,17 @@ function assertOAuthConfig(auth2) {
         throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
       }
       assertNonEmptyString("auth.acceptedAudiences", audience);
+      if (trimTrailingSlash(audience) === "") {
+        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+      }
     }
   }
+  if (auth2.requireOAuthClientClaim !== void 0 && typeof auth2.requireOAuthClientClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+  }
+  if (auth2.acceptResourceClaim !== void 0 && typeof auth2.acceptResourceClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+  }
   if (auth2.requiredScopes !== void 0) {
     if (!Array.isArray(auth2.requiredScopes)) {
       throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-CPkhCRxc.js';
-export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-CPkhCRxc.js';
+import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-qqrmJ736.js';
+export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-qqrmJ736.js';
 import 'zod';
 
 /**
@@ -24,6 +24,7 @@ interface IssuerOAuthOptionsBase {
     readonly resourceDocumentation?: string;
     readonly protectedResourceMetadataUrl?: string;
     readonly requireOAuthClientClaim?: boolean;
+    readonly acceptResourceClaim?: boolean;
     readonly issuer: string;
     readonly requiredScopes?: readonly string[];
     readonly jwksUri?: string;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-CPkhCRxc.js';
-export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-CPkhCRxc.js';
+import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-qqrmJ736.js';
+export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-qqrmJ736.js';
 import 'zod';
 
 /**
@@ -24,6 +24,7 @@ interface IssuerOAuthOptionsBase {
     readonly resourceDocumentation?: string;
     readonly protectedResourceMetadataUrl?: string;
     readonly requireOAuthClientClaim?: boolean;
+    readonly acceptResourceClaim?: boolean;
     readonly issuer: string;
     readonly requiredScopes?: readonly string[];
     readonly jwksUri?: string;

package/dist/index.js

@@ -4,7 +4,8 @@ import {
 import {
   parseSafeUrl,
   resolveMetricsConfig,
-  setLogLevel
+  setLogLevel,
+  trimTrailingSlash
 } from "./chunk-H37EB22A.js";
 
 // src/core/define.ts
@@ -86,8 +87,17 @@ function assertOAuthConfig(auth2) {
         throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
       }
       assertNonEmptyString("auth.acceptedAudiences", audience);
+      if (trimTrailingSlash(audience) === "") {
+        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+      }
     }
   }
+  if (auth2.requireOAuthClientClaim !== void 0 && typeof auth2.requireOAuthClientClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+  }
+  if (auth2.acceptResourceClaim !== void 0 && typeof auth2.acceptResourceClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+  }
   if (auth2.requiredScopes !== void 0) {
     if (!Array.isArray(auth2.requiredScopes)) {
       throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);