@lovable.dev/mcp-js 0.21.0 → 0.21.1-rc.1

package/dist/protocols/oauth-metadata.d.ts

@@ -1,8 +1,7 @@
-import { M as McpRuntimeOptions } from '../authorize-BMeXd_Sh.js';
-import { d as McpDefinition } from '../types-qqrmJ736.js';
-import 'zod';
-
+import { c as McpDefinition } from "../types-BYdYYTjk.js";
+import { t as McpRuntimeOptions } from "../authorize-D6p4-9_D.js";
+//#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
-
-export { type OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };
+//#endregion
+export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.js

@@ -1,10 +1,52 @@
-import {
-  createOAuthProtectedResourceMetadataHandler
-} from "../chunk-ENJDNFEB.js";
-import "../chunk-YLU2JTHL.js";
-import "../chunk-H37EB22A.js";
-import "../chunk-6DXGZZA4.js";
-import "../chunk-E3Q3FRKQ.js";
-export {
-  createOAuthProtectedResourceMetadataHandler
-};
+import { i as log, r as describeError } from "../logger-2OXtfiIW.js";
+import { a as getOAuthRuntime, c as resolveProtectedResource, f as JSON_HEADERS, m as methodNotAllowed, n as withCors, o as oauthConfigurationErrorResponse, p as headResponse, t as corsPreflightResponse } from "../cors-B7CTXIHD.js";
+//#region src/protocols/oauth-metadata.ts
+function notFound() {
+	return withCors(new Response(JSON.stringify({ error: "not found" }), {
+		status: 404,
+		headers: {
+			...JSON_HEADERS,
+			"Cache-Control": "no-store"
+		}
+	}));
+}
+async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
+	const issuer = await discovery.resolveIssuer();
+	const body = {
+		resource: resolveProtectedResource(auth, request, options),
+		authorization_servers: [issuer],
+		bearer_methods_supported: ["header"],
+		resource_name: auth.resourceName ?? mcp.title,
+		resource_documentation: auth.resourceDocumentation
+	};
+	if (auth.requiredScopes && auth.requiredScopes.length > 0) body.scopes_supported = auth.requiredScopes;
+	return body;
+}
+function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
+	const runtime = getOAuthRuntime(mcp, options);
+	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0 && runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
+	return async (request) => {
+		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
+		if (request.method !== "GET" && request.method !== "HEAD") return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
+		const headers = {
+			...JSON_HEADERS,
+			"Cache-Control": "public, max-age=300",
+			Vary: "Host"
+		};
+		try {
+			const metadata = await buildProtectedResourceMetadata(mcp, runtime.auth, request, runtime.options, runtime.discovery);
+			const response = withCors(Response.json(metadata, { headers }));
+			return request.method === "HEAD" ? headResponse(response) : response;
+		} catch (err) {
+			log.error("oauth.metadata.config_error", {
+				...describeError(err),
+				outcome: "500 oauth configuration error"
+			});
+			const response = withCors(oauthConfigurationErrorResponse());
+			return request.method === "HEAD" ? headResponse(response) : response;
+		}
+	};
+}
+//#endregion
+export { createOAuthProtectedResourceMetadataHandler };