@lovable.dev/mcp-js 0.21.1-rc.1 → 0.22.0

package/dist/index.js

@@ -1,144 +1,203 @@
-import { a as setLogLevel, l as resolveMetricsConfig, o as parseSafeUrl, s as trimTrailingSlash } from "./logger-2OXtfiIW.js";
-import { t as ToolContext } from "./context-CIpPzN7P.js";
-//#region src/core/define.ts
+import {
+  ToolContext
+} from "./chunk-MA5H6PSF.js";
+import {
+  parseSafeUrl,
+  resolveMetricsConfig,
+  setLogLevel,
+  trimTrailingSlash
+} from "./chunk-H37EB22A.js";
+
+// src/core/define.ts
 function assertUniqueNames(mcp) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const tool of mcp.tools) {
-		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-		seen.add(tool.name);
-	}
+  const seen = /* @__PURE__ */ new Set();
+  for (const tool of mcp.tools) {
+    if (seen.has(tool.name)) {
+      throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
+    }
+    seen.add(tool.name);
+  }
 }
 function assertNonEmptyString(label, value) {
-	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
+  if (value.trim() === "") {
+    throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
+  }
+  if (value !== value.trim()) {
+    throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
+  }
 }
 function assertHttpsUrlField(name, value) {
-	assertNonEmptyString(`auth.${name}`, value);
-	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
+  assertNonEmptyString(`auth.${name}`, value);
+  parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
 }
 function assertScope(scope) {
-	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
+  if (scope.trim() === "" || /\s/.test(scope)) {
+    throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
+  }
 }
 function assertJwtAlgorithm(algorithm) {
-	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
+  if (algorithm.trim() === "" || /\s/.test(algorithm)) {
+    throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
+  }
+  if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") {
+    throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
+  }
 }
-const MAX_CLOCK_TOLERANCE_SECONDS = 300;
+var MAX_CLOCK_TOLERANCE_SECONDS = 300;
 function assertClockToleranceSeconds(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) {
+    throw new Error(
+      `@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`
+    );
+  }
 }
-function assertOAuthConfig(auth) {
-	if (auth.type !== "oauth") {
-		const authType = String(auth.type);
-		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-	}
-	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-	assertHttpsUrlField("issuer", auth.issuer);
-	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
-	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
-	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
-	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
-	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
-	if (auth.acceptedAudiences !== void 0) {
-		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-		for (const audience of auth.acceptedAudiences) {
-			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-			assertNonEmptyString("auth.acceptedAudiences", audience);
-			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-		}
-	}
-	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-	if (auth.requiredScopes !== void 0) {
-		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-		for (const scope of auth.requiredScopes) assertScope(scope);
-	}
-	if (auth.algorithms !== void 0) {
-		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
-	}
-	if (auth.accessTokenTyp !== void 0) {
-		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-		for (const typ of auth.accessTokenTyp) {
-			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-			assertNonEmptyString("auth.accessTokenTyp", typ);
-		}
-	}
-	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
-	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
+function assertOAuthConfig(auth2) {
+  if (auth2.type !== "oauth") {
+    const authType = String(auth2.type);
+    throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
+  }
+  if (auth2.issuer === void 0) {
+    throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
+  }
+  assertHttpsUrlField("issuer", auth2.issuer);
+  if (auth2.jwksUri !== void 0) {
+    assertHttpsUrlField("jwksUri", auth2.jwksUri);
+  }
+  if (auth2.resource !== void 0) {
+    assertHttpsUrlField("resource", auth2.resource);
+  }
+  if (auth2.resourceName !== void 0) {
+    assertNonEmptyString("auth.resourceName", auth2.resourceName);
+  }
+  if (auth2.resourceDocumentation !== void 0) {
+    assertHttpsUrlField("resourceDocumentation", auth2.resourceDocumentation);
+  }
+  if (auth2.protectedResourceMetadataUrl !== void 0) {
+    assertHttpsUrlField("protectedResourceMetadataUrl", auth2.protectedResourceMetadataUrl);
+  }
+  if (auth2.acceptedAudiences !== void 0) {
+    if (!Array.isArray(auth2.acceptedAudiences)) {
+      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
+    }
+    if (auth2.acceptedAudiences.length === 0) {
+      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
+    }
+    for (const audience of auth2.acceptedAudiences) {
+      if (typeof audience !== "string") {
+        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
+      }
+      assertNonEmptyString("auth.acceptedAudiences", audience);
+      if (trimTrailingSlash(audience) === "") {
+        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+      }
+    }
+  }
+  if (auth2.requireOAuthClientClaim !== void 0 && typeof auth2.requireOAuthClientClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+  }
+  if (auth2.acceptResourceClaim !== void 0 && typeof auth2.acceptResourceClaim !== "boolean") {
+    throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+  }
+  if (auth2.requiredScopes !== void 0) {
+    if (!Array.isArray(auth2.requiredScopes)) {
+      throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
+    }
+    for (const scope of auth2.requiredScopes)
+      assertScope(scope);
+  }
+  if (auth2.algorithms !== void 0) {
+    if (!Array.isArray(auth2.algorithms)) {
+      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
+    }
+    if (auth2.algorithms.length === 0) {
+      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
+    }
+    for (const algorithm of auth2.algorithms)
+      assertJwtAlgorithm(algorithm);
+  }
+  if (auth2.accessTokenTyp !== void 0) {
+    if (!Array.isArray(auth2.accessTokenTyp)) {
+      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
+    }
+    if (auth2.accessTokenTyp.length === 0) {
+      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
+    }
+    for (const typ of auth2.accessTokenTyp) {
+      if (typeof typ !== "string") {
+        throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
+      }
+      assertNonEmptyString("auth.accessTokenTyp", typ);
+    }
+  }
+  if (auth2.clockToleranceSeconds !== void 0)
+    assertClockToleranceSeconds(auth2.clockToleranceSeconds);
+  if (auth2.resource === void 0 && auth2.acceptedAudiences === void 0) {
+    throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
+  }
 }
-function freezeAuth(auth) {
-	if (!auth) return;
-	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
-	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
-	if (auth.algorithms) Object.freeze(auth.algorithms);
-	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
-	Object.freeze(auth);
+function freezeAuth(auth2) {
+  if (!auth2)
+    return;
+  if (auth2.acceptedAudiences)
+    Object.freeze(auth2.acceptedAudiences);
+  if (auth2.requiredScopes)
+    Object.freeze(auth2.requiredScopes);
+  if (auth2.algorithms)
+    Object.freeze(auth2.algorithms);
+  if (auth2.accessTokenTyp)
+    Object.freeze(auth2.accessTokenTyp);
+  Object.freeze(auth2);
 }
-/**
-* Declare a single MCP tool. Import the result into your MCP definition's
-* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
-*
-* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
-* full `z.object(...)` — the MCP SDK builds the object wrapper internally
-* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
-*/
 function defineTool(def) {
-	return def;
+  return def;
 }
-/**
-* Declare the MCP server. `export default` the result from your MCP
-* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
-* emit the framework-specific route(s) at build time.
-*/
 function defineMcp(def) {
-	assertNonEmptyString("name", def.name);
-	assertNonEmptyString("title", def.title);
-	assertNonEmptyString("version", def.version);
-	assertUniqueNames(def);
-	if (def.auth) assertOAuthConfig(def.auth);
-	resolveMetricsConfig(def.metrics);
-	freezeAuth(def.auth);
-	Object.freeze(def.tools);
-	for (const tool of def.tools) Object.freeze(tool);
-	return def;
+  assertNonEmptyString("name", def.name);
+  assertNonEmptyString("title", def.title);
+  assertNonEmptyString("version", def.version);
+  assertUniqueNames(def);
+  if (def.auth)
+    assertOAuthConfig(def.auth);
+  resolveMetricsConfig(def.metrics);
+  freezeAuth(def.auth);
+  Object.freeze(def.tools);
+  for (const tool of def.tools)
+    Object.freeze(tool);
+  return def;
 }
-//#endregion
-//#region src/auth/config.ts
+
+// src/auth/config.ts
 function frozenArray(value) {
-	return value === void 0 ? void 0 : Object.freeze([...value]);
+  return value === void 0 ? void 0 : Object.freeze([...value]);
 }
 function frozenAudiences(value) {
-	return frozenArray(typeof value === "string" ? [value] : value);
+  return frozenArray(typeof value === "string" ? [value] : value);
 }
-/** Mutates `value` in place; callers pass a fresh literal so deleting keys is safe. */
 function stripUndefined(value) {
-	for (const key of Object.keys(value)) if (value[key] === void 0) delete value[key];
-	return value;
+  for (const key of Object.keys(value)) {
+    if (value[key] === void 0)
+      delete value[key];
+  }
+  return value;
 }
-/**
-* Configure OAuth against an issuer. `acceptedAudiences` (or `resource`) is the
-* token-acceptance policy, not a per-request authorization decision: any token
-* carrying an accepted `aud` passes. When an issuer mints broad project-wide
-* audiences (e.g. Supabase's `aud: "authenticated"`), a token for one resource
-* is structurally accepted by another sharing that audience — so gate per-tool
-* authorization on `ctx.getClaims()` / `ctx.getClientId()`, never on the
-* accepted audience.
-*/
 function issuer(options) {
-	return Object.freeze(stripUndefined({
-		type: "oauth",
-		...options,
-		acceptedAudiences: frozenAudiences(options.acceptedAudiences),
-		requiredScopes: frozenArray(options.requiredScopes),
-		algorithms: frozenArray(options.algorithms),
-		accessTokenTyp: frozenArray(options.accessTokenTyp)
-	}));
+  return Object.freeze(
+    stripUndefined({
+      type: "oauth",
+      ...options,
+      acceptedAudiences: frozenAudiences(options.acceptedAudiences),
+      requiredScopes: frozenArray(options.requiredScopes),
+      algorithms: frozenArray(options.algorithms),
+      accessTokenTyp: frozenArray(options.accessTokenTyp)
+    })
+  );
 }
-const oauth = Object.freeze({ issuer });
-const auth = Object.freeze({ oauth });
-//#endregion
-export { ToolContext, auth, defineMcp, defineTool, setLogLevel };
+var oauth = Object.freeze({ issuer });
+var auth = Object.freeze({ oauth });
+export {
+  ToolContext,
+  auth,
+  defineMcp,
+  defineTool,
+  setLogLevel
+};

package/dist/{io-CS4UL6_A.d.ts → io-D4srzRKc.d.ts}

@@ -1,5 +1,3 @@
-import "./list-tools-CsWgiRy1.js";
-//#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read
  * back the resolved entry path and the URL the stack mounts the MCP server at.
@@ -8,8 +6,8 @@ import "./list-tools-CsWgiRy1.js";
  * which the function and its companion routes live).
  */
 interface McpPluginApi {
-  readonly mcpEntry: string;
-  readonly urlPath: string;
+    readonly mcpEntry: string;
+    readonly urlPath: string;
 }
-//#endregion
-export { McpPluginApi as t };
+
+export type { McpPluginApi as M };