@lovable.dev/mcp-js 0.21.0 → 0.21.1-rc.0

package/dist/{base-CFy5vZ5Z.d.ts → base-CM-KCpp6.d.ts}

@@ -12,6 +12,9 @@ interface InvocationRecord {
     durationMs: number;
     reqBytes?: number;
     resBytes?: number;
+    /** The app end-user that made the call (the access token `sub`), or
+     *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+    endUserId?: string;
     /** The `tool_error` message (text content of an `isError` result). Local log
      *  only — never sent to the collector, so it stays on-box for the operator. */
     errorText?: string;

package/dist/{chunk-QPKPYDPB.js → chunk-4QNNVJBZ.js}

@@ -13,7 +13,7 @@ import {
   methodNotAllowed,
   nowMs,
   withCors
-} from "./chunk-YLU2JTHL.js";
+} from "./chunk-SJJDRA6X.js";
 
 // src/protocols/rest/invoke-tool.ts
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
@@ -36,6 +36,7 @@ function createInvokeToolHandler(mcp, options = {}) {
     const authResult = await authorizer.authorize(request, recorder);
     if (!authResult.ok)
       return authResult.response;
+    const endUserId = authResult.auth?.principal.sub;
     if (request.method !== "POST")
       return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
@@ -93,7 +94,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
         status: 500,
@@ -105,7 +107,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
         status: 500,
@@ -117,7 +120,8 @@ function createInvokeToolHandler(mcp, options = {}) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return Response.json({
       content: result.content ?? [],

package/dist/{chunk-CI7JYLV3.js → chunk-ACFNK34P.js}

@@ -10,7 +10,7 @@ import {
   createRequestAuthorizer,
   nowMs,
   withCors
-} from "./chunk-YLU2JTHL.js";
+} from "./chunk-SJJDRA6X.js";
 import {
   describeError,
   log
@@ -20,6 +20,7 @@ import {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 function adaptToolToSdkCallback(tool, auth, recorder) {
+  const endUserId = auth?.principal.sub;
   return async (first) => {
     const args = tool.inputSchema ? first ?? {} : {};
     const start = nowMs();
@@ -31,7 +32,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
     }
@@ -40,7 +42,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
     }
@@ -49,7 +52,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };
@@ -84,7 +88,13 @@ function createMcpProtocolHandler(mcp, options = {}) {
       await server.connect(transport);
       return await transport.handleRequest(request);
     } catch (err) {
-      await recorder.emit({ tool: null, method: "transport", outcome: "transport_error", durationMs: 0 });
+      await recorder.emit({
+        tool: null,
+        method: "transport",
+        outcome: "transport_error",
+        durationMs: 0,
+        endUserId: authResult.auth?.principal.sub
+      });
       log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },

package/dist/{chunk-ENJDNFEB.js → chunk-BLY5L4KI.js}

@@ -7,7 +7,7 @@ import {
   oauthConfigurationErrorResponse,
   resolveProtectedResource,
   withCors
-} from "./chunk-YLU2JTHL.js";
+} from "./chunk-SJJDRA6X.js";
 import {
   describeError,
   log

package/dist/{chunk-E3Q3FRKQ.js → chunk-L5ZOZKAL.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.21.0";
+var version = "0.21.1-rc.0";
 
 export {
   version

package/dist/{chunk-YLU2JTHL.js → chunk-SJJDRA6X.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-6DXGZZA4.js";
 import {
   version
-} from "./chunk-E3Q3FRKQ.js";
+} from "./chunk-L5ZOZKAL.js";
 
 // src/core/http.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };
@@ -75,6 +75,8 @@ function toLogRecord(rec) {
   if (rec.resBytes !== void 0)
     attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
   attributes.push(strAttr("mcp.stack", rec.stack));
+  if (rec.endUserId !== void 0)
+    attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
   return {
     timeUnixNano: rec.timeUnixNano,
     observedTimeUnixNano: rec.timeUnixNano,

package/dist/{chunk-LFXK3FNF.js → chunk-ZLWXDYOZ.js}

@@ -6,7 +6,7 @@ import {
   headResponse,
   methodNotAllowed,
   withCors
-} from "./chunk-YLU2JTHL.js";
+} from "./chunk-SJJDRA6X.js";
 
 // src/protocols/rest/list-tools.ts
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";

package/dist/cli/extract-manifest.cjs

@@ -13,7 +13,7 @@ function isFileMissing(err) {
 }
 
 // package.json
-var version = "0.21.0";
+var version = "0.21.1-rc.0";
 
 // src/protocols/rest/list-tools.ts
 var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");

package/dist/cli/extract-manifest.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   buildMcpListing
-} from "../chunk-LFXK3FNF.js";
-import "../chunk-YLU2JTHL.js";
+} from "../chunk-ZLWXDYOZ.js";
+import "../chunk-SJJDRA6X.js";
 import "../chunk-H37EB22A.js";
 import "../chunk-6DXGZZA4.js";
 import {
@@ -10,7 +10,7 @@ import {
 } from "../chunk-Y3ZFPEQH.js";
 import {
   version
-} from "../chunk-E3Q3FRKQ.js";
+} from "../chunk-L5ZOZKAL.js";
 
 // src/manifest/io.ts
 import { randomUUID } from "crypto";

package/dist/protocols/mcp/index.cjs

@@ -656,6 +656,7 @@ function corsPreflightResponse(allowMethods) {
 
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth, recorder) {
+  const endUserId = auth?.principal.sub;
   return async (first) => {
     const args = tool.inputSchema ? first ?? {} : {};
     const start = nowMs();
@@ -667,7 +668,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
     }
@@ -676,7 +678,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
     }
@@ -685,7 +688,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };
@@ -720,7 +724,13 @@ function createMcpProtocolHandler(mcp, options = {}) {
       await server.connect(transport);
       return await transport.handleRequest(request);
     } catch (err) {
-      await recorder.emit({ tool: null, method: "transport", outcome: "transport_error", durationMs: 0 });
+      await recorder.emit({
+        tool: null,
+        method: "transport",
+        outcome: "transport_error",
+        durationMs: 0,
+        endUserId: authResult.auth?.principal.sub
+      });
       log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import { M as MetricsRecorder } from '../../base-CFy5vZ5Z.js';
+import { M as MetricsRecorder } from '../../base-CM-KCpp6.js';
 import 'zod';
 
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import { M as MetricsRecorder } from '../../base-CFy5vZ5Z.js';
+import { M as MetricsRecorder } from '../../base-CM-KCpp6.js';
 import 'zod';
 
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.js

@@ -1,12 +1,12 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-CI7JYLV3.js";
+} from "../../chunk-ACFNK34P.js";
 import "../../chunk-6QFZYYUV.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-YLU2JTHL.js";
+import "../../chunk-SJJDRA6X.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-E3Q3FRKQ.js";
+import "../../chunk-L5ZOZKAL.js";
 export {
   createMcpProtocolHandler
 };

package/dist/protocols/oauth-metadata.js

@@ -1,10 +1,10 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-ENJDNFEB.js";
-import "../chunk-YLU2JTHL.js";
+} from "../chunk-BLY5L4KI.js";
+import "../chunk-SJJDRA6X.js";
 import "../chunk-H37EB22A.js";
 import "../chunk-6DXGZZA4.js";
-import "../chunk-E3Q3FRKQ.js";
+import "../chunk-L5ZOZKAL.js";
 export {
   createOAuthProtectedResourceMetadataHandler
 };

package/dist/protocols/rest/index.cjs

@@ -737,6 +737,7 @@ function createInvokeToolHandler(mcp, options = {}) {
     const authResult = await authorizer.authorize(request, recorder);
     if (!authResult.ok)
       return authResult.response;
+    const endUserId = authResult.auth?.principal.sub;
     if (request.method !== "POST")
       return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
@@ -794,7 +795,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
         status: 500,
@@ -806,7 +808,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
         status: 500,
@@ -818,7 +821,8 @@ function createInvokeToolHandler(mcp, options = {}) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return Response.json({
       content: result.content ?? [],

package/dist/protocols/rest/index.d.cts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import { M as MetricsRecorder } from '../../base-CFy5vZ5Z.js';
+import { M as MetricsRecorder } from '../../base-CM-KCpp6.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/rest/index.d.ts

@@ -1,6 +1,6 @@
 import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import { M as MetricsRecorder } from '../../base-CFy5vZ5Z.js';
+import { M as MetricsRecorder } from '../../base-CM-KCpp6.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/rest/index.js

@@ -1,15 +1,15 @@
 import {
   createInvokeToolHandler
-} from "../../chunk-QPKPYDPB.js";
+} from "../../chunk-4QNNVJBZ.js";
 import {
   createListToolsHandler
-} from "../../chunk-LFXK3FNF.js";
+} from "../../chunk-ZLWXDYOZ.js";
 import "../../chunk-6QFZYYUV.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-YLU2JTHL.js";
+import "../../chunk-SJJDRA6X.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-E3Q3FRKQ.js";
+import "../../chunk-L5ZOZKAL.js";
 export {
   createInvokeToolHandler,
   createListToolsHandler

package/dist/stacks/supabase/index.cjs

@@ -174,7 +174,7 @@ function describeError(err) {
 }
 
 // package.json
-var version = "0.21.0";
+var version = "0.21.1-rc.0";
 
 // src/metrics/otlp.ts
 var SCOPE_NAME = "@lovable.dev/mcp-js";
@@ -200,6 +200,8 @@ function toLogRecord(rec) {
   if (rec.resBytes !== void 0)
     attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
   attributes.push(strAttr("mcp.stack", rec.stack));
+  if (rec.endUserId !== void 0)
+    attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
   return {
     timeUnixNano: rec.timeUnixNano,
     observedTimeUnixNano: rec.timeUnixNano,
@@ -930,6 +932,7 @@ function corsPreflightResponse(allowMethods) {
 
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth, recorder) {
+  const endUserId = auth?.principal.sub;
   return async (first) => {
     const args = tool.inputSchema ? first ?? {} : {};
     const start = nowMs();
@@ -941,7 +944,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
     }
@@ -950,7 +954,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
     }
@@ -959,7 +964,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };
@@ -994,7 +1000,13 @@ function createMcpProtocolHandler(mcp, options = {}) {
       await server.connect(transport);
       return await transport.handleRequest(request);
     } catch (err) {
-      await recorder.emit({ tool: null, method: "transport", outcome: "transport_error", durationMs: 0 });
+      await recorder.emit({
+        tool: null,
+        method: "transport",
+        outcome: "transport_error",
+        durationMs: 0,
+        endUserId: authResult.auth?.principal.sub
+      });
       log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
@@ -1135,6 +1147,7 @@ function createInvokeToolHandler(mcp, options = {}) {
     const authResult = await authorizer.authorize(request, recorder);
     if (!authResult.ok)
       return authResult.response;
+    const endUserId = authResult.auth?.principal.sub;
     if (request.method !== "POST")
       return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
@@ -1192,7 +1205,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
         status: 500,
@@ -1204,7 +1218,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
         status: 500,
@@ -1216,7 +1231,8 @@ function createInvokeToolHandler(mcp, options = {}) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return Response.json({
       content: result.content ?? [],

package/dist/stacks/supabase/index.js

@@ -3,22 +3,22 @@ import {
 } from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
-} from "../../chunk-CI7JYLV3.js";
+} from "../../chunk-ACFNK34P.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-ENJDNFEB.js";
+} from "../../chunk-BLY5L4KI.js";
 import {
   createInvokeToolHandler
-} from "../../chunk-QPKPYDPB.js";
+} from "../../chunk-4QNNVJBZ.js";
 import {
   createListToolsHandler
-} from "../../chunk-LFXK3FNF.js";
+} from "../../chunk-ZLWXDYOZ.js";
 import "../../chunk-6QFZYYUV.js";
 import "../../chunk-MA5H6PSF.js";
 import {
   assertResourcePathShape,
   createRecorderForRuntime
-} from "../../chunk-YLU2JTHL.js";
+} from "../../chunk-SJJDRA6X.js";
 import {
   trimTrailingSlash
 } from "../../chunk-H37EB22A.js";
@@ -29,7 +29,7 @@ import {
   FUNCTIONS_MOUNT_PREFIX,
   assertFunctionName
 } from "../../chunk-XQWJN6DC.js";
-import "../../chunk-E3Q3FRKQ.js";
+import "../../chunk-L5ZOZKAL.js";
 
 // src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {

package/dist/stacks/supabase/vite.cjs

@@ -33,7 +33,7 @@ var import_node_fs = require("fs");
 var import_node_path = require("path");
 
 // package.json
-var version = "0.21.0";
+var version = "0.21.1-rc.0";
 
 // src/core/fs-errors.ts
 function isFileMissing(err) {

package/dist/stacks/supabase/vite.js

@@ -7,7 +7,7 @@ import {
 } from "../../chunk-XQWJN6DC.js";
 import {
   version
-} from "../../chunk-E3Q3FRKQ.js";
+} from "../../chunk-L5ZOZKAL.js";
 
 // src/stacks/supabase/vite.ts
 import { resolve as resolve2, sep as sep2 } from "path";

package/dist/stacks/tanstack/index.cjs

@@ -129,7 +129,7 @@ function describeError(err) {
 }
 
 // package.json
-var version = "0.21.0";
+var version = "0.21.1-rc.0";
 
 // src/metrics/otlp.ts
 var SCOPE_NAME = "@lovable.dev/mcp-js";
@@ -155,6 +155,8 @@ function toLogRecord(rec) {
   if (rec.resBytes !== void 0)
     attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
   attributes.push(strAttr("mcp.stack", rec.stack));
+  if (rec.endUserId !== void 0)
+    attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
   return {
     timeUnixNano: rec.timeUnixNano,
     observedTimeUnixNano: rec.timeUnixNano,
@@ -933,6 +935,7 @@ function corsPreflightResponse(allowMethods) {
 
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth, recorder) {
+  const endUserId = auth?.principal.sub;
   return async (first) => {
     const args = tool.inputSchema ? first ?? {} : {};
     const start = nowMs();
@@ -944,7 +947,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
     }
@@ -953,7 +957,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
     }
@@ -962,7 +967,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
   };
@@ -997,7 +1003,13 @@ function createMcpProtocolHandler(mcp, options = {}) {
       await server.connect(transport);
       return await transport.handleRequest(request);
     } catch (err) {
-      await recorder.emit({ tool: null, method: "transport", outcome: "transport_error", durationMs: 0 });
+      await recorder.emit({
+        tool: null,
+        method: "transport",
+        outcome: "transport_error",
+        durationMs: 0,
+        endUserId: authResult.auth?.principal.sub
+      });
       log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
@@ -1138,6 +1150,7 @@ function createInvokeToolHandler(mcp, options = {}) {
     const authResult = await authorizer.authorize(request, recorder);
     if (!authResult.ok)
       return authResult.response;
+    const endUserId = authResult.auth?.principal.sub;
     if (request.method !== "POST")
       return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
@@ -1195,7 +1208,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
         status: 500,
@@ -1207,7 +1221,8 @@ function createInvokeToolHandler(mcp, options = {}) {
         tool: tool.name,
         method: "tools/call",
         outcome: "handler_error",
-        durationMs: nowMs() - start
+        durationMs: nowMs() - start,
+        endUserId
       });
       return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
         status: 500,
@@ -1219,7 +1234,8 @@ function createInvokeToolHandler(mcp, options = {}) {
       method: "tools/call",
       outcome: result.isError ? "tool_error" : "ok",
       durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
     });
     return Response.json({
       content: result.content ?? [],

package/dist/stacks/tanstack/index.js

@@ -3,24 +3,24 @@ import {
 } from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
-} from "../../chunk-CI7JYLV3.js";
+} from "../../chunk-ACFNK34P.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-ENJDNFEB.js";
+} from "../../chunk-BLY5L4KI.js";
 import {
   createInvokeToolHandler
-} from "../../chunk-QPKPYDPB.js";
+} from "../../chunk-4QNNVJBZ.js";
 import {
   createListToolsHandler
-} from "../../chunk-LFXK3FNF.js";
+} from "../../chunk-ZLWXDYOZ.js";
 import "../../chunk-6QFZYYUV.js";
 import "../../chunk-MA5H6PSF.js";
 import {
   createRecorderForRuntime
-} from "../../chunk-YLU2JTHL.js";
+} from "../../chunk-SJJDRA6X.js";
 import "../../chunk-H37EB22A.js";
 import "../../chunk-6DXGZZA4.js";
-import "../../chunk-E3Q3FRKQ.js";
+import "../../chunk-L5ZOZKAL.js";
 
 // src/stacks/tanstack/handlers.ts
 var STACK = "tanstack";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.21.0",
+  "version": "0.21.1-rc.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {