@lovable.dev/mcp-js 0.21.1-rc.1 → 0.22.0-rc.0

package/dist/authorize-BMeXd_Sh.d.ts

@@ -0,0 +1,25 @@
+interface McpRuntimeOptions {
+    /**
+     * Public MCP protocol path. REST companion handlers pass this so OAuth
+     * resource/audience checks bind to `/mcp`, not internal `/.mcp/*` RPC URLs.
+     */
+    resourcePath?: string;
+    /**
+     * Host-relative path of the SDK-served protected-resource metadata document.
+     * The Vite plugin injects it into every emitted handler when it generates the
+     * PRM route, so the 401 challenge advertises the same path the route serves.
+     * Its presence is the signal that the SDK owns the PRM document, so it is
+     * mutually exclusive with `auth.protectedResourceMetadataUrl` (which points at
+     * an externally hosted document). Defaults to the well-known path when absent.
+     */
+    metadataPath?: string;
+    /**
+     * Derive the request origin (and thus the advertised `resource`/metadata URLs)
+     * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
+     * this before invoking the handler, so the OAuth runtime never sees it; safe
+     * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+     */
+    trustForwardedHost?: boolean;
+}
+
+export type { McpRuntimeOptions as M };

package/dist/base-CM-KCpp6.d.ts

@@ -0,0 +1,28 @@
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+    /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+    tool: string | null;
+    /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+    method: string;
+    outcome: InvocationOutcome;
+    durationMs: number;
+    reqBytes?: number;
+    resBytes?: number;
+    /** The app end-user that made the call (the access token `sub`), or
+     *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+    endUserId?: string;
+    /** The `tool_error` message (text content of an `isError` result). Local log
+     *  only — never sent to the collector, so it stays on-box for the operator. */
+    errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+    emit(ev: InvocationRecord): Promise<void>;
+}
+
+export type { MetricsRecorder as M };

package/dist/chunk-4BAHMNLD.js

@@ -0,0 +1,141 @@
+import {
+  extractTextContent
+} from "./chunk-6QFZYYUV.js";
+import {
+  ToolContext
+} from "./chunk-MA5H6PSF.js";
+import {
+  JSON_HEADERS,
+  assertRestResourceBinding,
+  corsPreflightResponse,
+  createNoopRecorder,
+  createRequestAuthorizer,
+  methodNotAllowed,
+  nowMs,
+  withCors
+} from "./chunk-BE6FQG4R.js";
+
+// src/protocols/rest/invoke-tool.ts
+import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+var MAX_REFLECTED_TOOL_NAME = 256;
+function safeReflectName(name) {
+  const text = String(name);
+  return text.length > MAX_REFLECTED_TOOL_NAME ? `${text.slice(0, MAX_REFLECTED_TOOL_NAME)}\u2026` : text;
+}
+function isEmptyArgs(value) {
+  if (value == null)
+    return true;
+  if (typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.keys(value).length === 0;
+}
+function createInvokeToolHandler(mcp, options = {}) {
+  assertRestResourceBinding(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options);
+  const handle = async (request, toolName, recorder) => {
+    const authResult = await authorizer.authorize(request, recorder);
+    if (!authResult.ok)
+      return authResult.response;
+    const endUserId = authResult.auth?.principal.sub;
+    if (request.method !== "POST")
+      return methodNotAllowed("POST, OPTIONS");
+    const tool = mcp.tools.find((t) => t.name === toolName);
+    if (!tool) {
+      return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
+        status: 404,
+        headers: JSON_HEADERS
+      });
+    }
+    let rawArgs = {};
+    const text = await request.text();
+    if (text) {
+      try {
+        rawArgs = JSON.parse(text);
+      } catch {
+        return new Response(JSON.stringify({ error: "invalid JSON body" }), {
+          status: 400,
+          headers: JSON_HEADERS
+        });
+      }
+    }
+    let args = rawArgs;
+    if (tool.inputSchema) {
+      try {
+        const schema = objectFromShape(tool.inputSchema);
+        const parsed = await safeParseAsync(schema, rawArgs);
+        if (!parsed.success) {
+          return new Response(
+            JSON.stringify({
+              error: "validation failed",
+              details: getParseErrorMessage(parsed.error)
+            }),
+            { status: 400, headers: JSON_HEADERS }
+          );
+        }
+        args = parsed.data;
+      } catch {
+        return new Response(JSON.stringify({ error: "schema error", tool: toolName }), {
+          status: 500,
+          headers: JSON_HEADERS
+        });
+      }
+    } else if (!isEmptyArgs(rawArgs)) {
+      return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
+        status: 400,
+        headers: JSON_HEADERS
+      });
+    }
+    let result;
+    const start = nowMs();
+    try {
+      result = await tool.handler(args, new ToolContext(authResult.auth));
+    } catch {
+      await recorder.emit({
+        tool: tool.name,
+        method: "tools/call",
+        outcome: "handler_error",
+        durationMs: nowMs() - start,
+        endUserId
+      });
+      return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
+        status: 500,
+        headers: JSON_HEADERS
+      });
+    }
+    if (result == null) {
+      await recorder.emit({
+        tool: tool.name,
+        method: "tools/call",
+        outcome: "handler_error",
+        durationMs: nowMs() - start,
+        endUserId
+      });
+      return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
+        status: 500,
+        headers: JSON_HEADERS
+      });
+    }
+    await recorder.emit({
+      tool: tool.name,
+      method: "tools/call",
+      outcome: result.isError ? "tool_error" : "ok",
+      durationMs: nowMs() - start,
+      errorText: result.isError ? extractTextContent(result.content) : void 0,
+      endUserId
+    });
+    return Response.json({
+      content: result.content ?? [],
+      structuredContent: result.structuredContent,
+      isError: result.isError
+    });
+  };
+  return async (request, toolName, recorder = createNoopRecorder()) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName, recorder));
+  };
+}
+
+export {
+  createInvokeToolHandler
+};

package/dist/chunk-6DXGZZA4.js

@@ -0,0 +1,6 @@
+// src/auth/metadata-path.ts
+var OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+
+export {
+  OAUTH_PROTECTED_RESOURCE_METADATA_PATH
+};

package/dist/chunk-6QFZYYUV.js

@@ -0,0 +1,11 @@
+// src/core/content.ts
+function extractTextContent(content) {
+  if (!content)
+    return void 0;
+  const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+  return text.length > 0 ? text : void 0;
+}
+
+export {
+  extractTextContent
+};