@lovable.dev/mcp-js 0.22.0 → 0.22.1-rc.1

package/dist/forwarded--h4efJy-.js

@@ -0,0 +1,43 @@
+//#region src/core/forwarded.ts
+/**
+* Rewrites a request's URL to the public origin a reverse proxy forwards via
+* `X-Forwarded-*`, so SDK-derived OAuth `resource`/metadata/`WWW-Authenticate`
+* URLs name the host the client actually connected to — not the internal
+* backend origin the proxy rewrites `Host` to. Without this, an app on a custom
+* domain advertises its internal `*.lovable.dev`/`*.supabase.co` host and every
+* MCP call 401s on an audience the client can't satisfy.
+*
+* Each header is trusted independently, because a forwarded value is only as
+* trustworthy as the proxy that sets it:
+* - `X-Forwarded-Host` can redirect the advertised resource to an attacker
+*   origin (the threat `auth/resource.ts` guards against), so it is honored only
+*   when `trustForwardedHost` is set — enabled on emit paths that sit behind a
+*   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
+*   bare SDK consumer.
+* - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
+*   Supabase terminates TLS upstream and forwards over http with a
+*   gateway-stamped proto, so that stack trusts it; the TanStack proxy does not
+*   sanitize proto, so that stack leaves it alone.
+*/
+function applyForwardedOrigin(request, options) {
+	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
+	const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
+	if (proto === void 0 && host === void 0) return request;
+	const url = new URL(request.url);
+	let changed = false;
+	if (proto !== void 0 && `${proto}:` !== url.protocol) {
+		url.protocol = `${proto}:`;
+		changed = true;
+	}
+	if (host !== void 0 && host !== url.host) {
+		url.host = host;
+		changed = true;
+	}
+	return changed ? new Request(url.href, request) : request;
+}
+function firstForwardedValue(request, header) {
+	const value = request.headers.get(header)?.split(",")[0]?.trim();
+	return value ? value : void 0;
+}
+//#endregion
+export { applyForwardedOrigin as t };

package/dist/forwarded-Pi8Hs5Ps.cjs

@@ -0,0 +1,48 @@
+//#region src/core/forwarded.ts
+/**
+* Rewrites a request's URL to the public origin a reverse proxy forwards via
+* `X-Forwarded-*`, so SDK-derived OAuth `resource`/metadata/`WWW-Authenticate`
+* URLs name the host the client actually connected to — not the internal
+* backend origin the proxy rewrites `Host` to. Without this, an app on a custom
+* domain advertises its internal `*.lovable.dev`/`*.supabase.co` host and every
+* MCP call 401s on an audience the client can't satisfy.
+*
+* Each header is trusted independently, because a forwarded value is only as
+* trustworthy as the proxy that sets it:
+* - `X-Forwarded-Host` can redirect the advertised resource to an attacker
+*   origin (the threat `auth/resource.ts` guards against), so it is honored only
+*   when `trustForwardedHost` is set — enabled on emit paths that sit behind a
+*   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
+*   bare SDK consumer.
+* - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
+*   Supabase terminates TLS upstream and forwards over http with a
+*   gateway-stamped proto, so that stack trusts it; the TanStack proxy does not
+*   sanitize proto, so that stack leaves it alone.
+*/
+function applyForwardedOrigin(request, options) {
+	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
+	const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
+	if (proto === void 0 && host === void 0) return request;
+	const url = new URL(request.url);
+	let changed = false;
+	if (proto !== void 0 && `${proto}:` !== url.protocol) {
+		url.protocol = `${proto}:`;
+		changed = true;
+	}
+	if (host !== void 0 && host !== url.host) {
+		url.host = host;
+		changed = true;
+	}
+	return changed ? new Request(url.href, request) : request;
+}
+function firstForwardedValue(request, header) {
+	const value = request.headers.get(header)?.split(",")[0]?.trim();
+	return value ? value : void 0;
+}
+//#endregion
+Object.defineProperty(exports, "applyForwardedOrigin", {
+	enumerable: true,
+	get: function() {
+		return applyForwardedOrigin;
+	}
+});

package/dist/fs-errors-CWNzOV75.cjs

@@ -0,0 +1,11 @@
+//#region src/core/fs-errors.ts
+function isFileMissing(err) {
+	return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+//#endregion
+Object.defineProperty(exports, "isFileMissing", {
+	enumerable: true,
+	get: function() {
+		return isFileMissing;
+	}
+});

package/dist/fs-errors-PA2t1TIp.js

@@ -0,0 +1,6 @@
+//#region src/core/fs-errors.ts
+function isFileMissing(err) {
+	return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+//#endregion
+export { isFileMissing as t };

package/dist/index.cjs

@@ -1,349 +1,149 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  ToolContext: () => ToolContext,
-  auth: () => auth,
-  defineMcp: () => defineMcp,
-  defineTool: () => defineTool,
-  setLogLevel: () => setLogLevel
-});
-module.exports = __toCommonJS(src_exports);
-
-// src/metrics/config.ts
-var DEFAULT_METRICS_ENDPOINT = "https://api.lovable.dev/v1/app-mcp-usage";
-var METRICS_API_KEY_ENV_VAR = "LOVABLE_API_KEY";
-function assertMetricsEndpoint(endpoint) {
-  let url;
-  try {
-    url = new URL(endpoint);
-  } catch {
-    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be an absolute URL, got ${JSON.stringify(endpoint)}`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be http(s), got ${JSON.stringify(endpoint)}`);
-  }
-}
-function resolveMetricsConfig(config = true) {
-  const options = typeof config === "boolean" ? { enabled: config } : config;
-  const endpoint = options.endpoint ?? DEFAULT_METRICS_ENDPOINT;
-  assertMetricsEndpoint(endpoint);
-  return Object.freeze({
-    enabled: options.enabled ?? true,
-    endpoint,
-    headers: options.headers ?? {},
-    apiKeyEnvVar: METRICS_API_KEY_ENV_VAR
-  });
-}
-
-// src/core/url.ts
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function isLocalHTTPHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function urlSafetyProblem(url) {
-  const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
-  if (url.protocol !== "https:" && !isAllowedHTTP) {
-    return "must use https://, except localhost development URLs";
-  }
-  if (url.username || url.password) {
-    return "must not include credentials";
-  }
-  if (url.search || url.hash) {
-    return "must not include query or fragment";
-  }
-  return void 0;
-}
-
-// src/core/validation.ts
-function parseSafeUrl(subject, raw, ErrorClass = Error) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new ErrorClass(`${subject} must be an absolute URL`);
-  }
-  const problem = urlSafetyProblem(url);
-  if (problem) {
-    throw new ErrorClass(`${subject} ${problem}`);
-  }
-  return url;
-}
-
-// src/core/define.ts
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_logger = require("./logger-BqPOa_E1.cjs");
+const require_context = require("./context-BweeEcoA.cjs");
+//#region src/core/define.ts
 function assertUniqueNames(mcp) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const tool of mcp.tools) {
-    if (seen.has(tool.name)) {
-      throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-    }
-    seen.add(tool.name);
-  }
+	const seen = /* @__PURE__ */ new Set();
+	for (const tool of mcp.tools) {
+		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
+		seen.add(tool.name);
+	}
 }
 function assertNonEmptyString(label, value) {
-  if (value.trim() === "") {
-    throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-  }
-  if (value !== value.trim()) {
-    throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
-  }
+	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
+	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
 }
 function assertHttpsUrlField(name, value) {
-  assertNonEmptyString(`auth.${name}`, value);
-  parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
+	assertNonEmptyString(`auth.${name}`, value);
+	require_logger.parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
 }
 function assertScope(scope) {
-  if (scope.trim() === "" || /\s/.test(scope)) {
-    throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
-  }
+	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
 }
 function assertJwtAlgorithm(algorithm) {
-  if (algorithm.trim() === "" || /\s/.test(algorithm)) {
-    throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-  }
-  if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") {
-    throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
-  }
+	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
+	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
 }
-var MAX_CLOCK_TOLERANCE_SECONDS = 300;
+const MAX_CLOCK_TOLERANCE_SECONDS = 300;
 function assertClockToleranceSeconds(value) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) {
-    throw new Error(
-      `@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`
-    );
-  }
-}
-function assertOAuthConfig(auth2) {
-  if (auth2.type !== "oauth") {
-    const authType = String(auth2.type);
-    throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-  }
-  if (auth2.issuer === void 0) {
-    throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-  }
-  assertHttpsUrlField("issuer", auth2.issuer);
-  if (auth2.jwksUri !== void 0) {
-    assertHttpsUrlField("jwksUri", auth2.jwksUri);
-  }
-  if (auth2.resource !== void 0) {
-    assertHttpsUrlField("resource", auth2.resource);
-  }
-  if (auth2.resourceName !== void 0) {
-    assertNonEmptyString("auth.resourceName", auth2.resourceName);
-  }
-  if (auth2.resourceDocumentation !== void 0) {
-    assertHttpsUrlField("resourceDocumentation", auth2.resourceDocumentation);
-  }
-  if (auth2.protectedResourceMetadataUrl !== void 0) {
-    assertHttpsUrlField("protectedResourceMetadataUrl", auth2.protectedResourceMetadataUrl);
-  }
-  if (auth2.acceptedAudiences !== void 0) {
-    if (!Array.isArray(auth2.acceptedAudiences)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-    }
-    if (auth2.acceptedAudiences.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-    }
-    for (const audience of auth2.acceptedAudiences) {
-      if (typeof audience !== "string") {
-        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-      }
-      assertNonEmptyString("auth.acceptedAudiences", audience);
-      if (trimTrailingSlash(audience) === "") {
-        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-      }
-    }
-  }
-  if (auth2.requireOAuthClientClaim !== void 0 && typeof auth2.requireOAuthClientClaim !== "boolean") {
-    throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-  }
-  if (auth2.acceptResourceClaim !== void 0 && typeof auth2.acceptResourceClaim !== "boolean") {
-    throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-  }
-  if (auth2.requiredScopes !== void 0) {
-    if (!Array.isArray(auth2.requiredScopes)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-    }
-    for (const scope of auth2.requiredScopes)
-      assertScope(scope);
-  }
-  if (auth2.algorithms !== void 0) {
-    if (!Array.isArray(auth2.algorithms)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-    }
-    if (auth2.algorithms.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-    }
-    for (const algorithm of auth2.algorithms)
-      assertJwtAlgorithm(algorithm);
-  }
-  if (auth2.accessTokenTyp !== void 0) {
-    if (!Array.isArray(auth2.accessTokenTyp)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-    }
-    if (auth2.accessTokenTyp.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-    }
-    for (const typ of auth2.accessTokenTyp) {
-      if (typeof typ !== "string") {
-        throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-      }
-      assertNonEmptyString("auth.accessTokenTyp", typ);
-    }
-  }
-  if (auth2.clockToleranceSeconds !== void 0)
-    assertClockToleranceSeconds(auth2.clockToleranceSeconds);
-  if (auth2.resource === void 0 && auth2.acceptedAudiences === void 0) {
-    throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
-  }
-}
-function freezeAuth(auth2) {
-  if (!auth2)
-    return;
-  if (auth2.acceptedAudiences)
-    Object.freeze(auth2.acceptedAudiences);
-  if (auth2.requiredScopes)
-    Object.freeze(auth2.requiredScopes);
-  if (auth2.algorithms)
-    Object.freeze(auth2.algorithms);
-  if (auth2.accessTokenTyp)
-    Object.freeze(auth2.accessTokenTyp);
-  Object.freeze(auth2);
-}
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
+}
+function assertOAuthConfig(auth) {
+	if (auth.type !== "oauth") {
+		const authType = String(auth.type);
+		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
+	}
+	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
+	assertHttpsUrlField("issuer", auth.issuer);
+	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
+	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
+	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
+	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
+	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
+	if (auth.acceptedAudiences !== void 0) {
+		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
+		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
+		for (const audience of auth.acceptedAudiences) {
+			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
+			assertNonEmptyString("auth.acceptedAudiences", audience);
+			if (require_logger.trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+		}
+	}
+	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+	if (auth.requiredScopes !== void 0) {
+		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
+		for (const scope of auth.requiredScopes) assertScope(scope);
+	}
+	if (auth.algorithms !== void 0) {
+		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
+		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
+		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
+	}
+	if (auth.accessTokenTyp !== void 0) {
+		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
+		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
+		for (const typ of auth.accessTokenTyp) {
+			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
+			assertNonEmptyString("auth.accessTokenTyp", typ);
+		}
+	}
+	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
+	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
+}
+function freezeAuth(auth) {
+	if (!auth) return;
+	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
+	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
+	if (auth.algorithms) Object.freeze(auth.algorithms);
+	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
+	Object.freeze(auth);
+}
+/**
+* Declare a single MCP tool. Import the result into your MCP definition's
+* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
+*
+* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
+* full `z.object(...)` — the MCP SDK builds the object wrapper internally
+* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
+*/
 function defineTool(def) {
-  return def;
+	return def;
 }
+/**
+* Declare the MCP server. `export default` the result from your MCP
+* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
+* emit the framework-specific route(s) at build time.
+*/
 function defineMcp(def) {
-  assertNonEmptyString("name", def.name);
-  assertNonEmptyString("title", def.title);
-  assertNonEmptyString("version", def.version);
-  assertUniqueNames(def);
-  if (def.auth)
-    assertOAuthConfig(def.auth);
-  resolveMetricsConfig(def.metrics);
-  freezeAuth(def.auth);
-  Object.freeze(def.tools);
-  for (const tool of def.tools)
-    Object.freeze(tool);
-  return def;
-}
-
-// src/auth/config.ts
+	assertNonEmptyString("name", def.name);
+	assertNonEmptyString("title", def.title);
+	assertNonEmptyString("version", def.version);
+	assertUniqueNames(def);
+	if (def.auth) assertOAuthConfig(def.auth);
+	require_logger.resolveMetricsConfig(def.metrics);
+	freezeAuth(def.auth);
+	Object.freeze(def.tools);
+	for (const tool of def.tools) Object.freeze(tool);
+	return def;
+}
+//#endregion
+//#region src/auth/config.ts
 function frozenArray(value) {
-  return value === void 0 ? void 0 : Object.freeze([...value]);
+	return value === void 0 ? void 0 : Object.freeze([...value]);
 }
 function frozenAudiences(value) {
-  return frozenArray(typeof value === "string" ? [value] : value);
+	return frozenArray(typeof value === "string" ? [value] : value);
 }
+/** Mutates `value` in place; callers pass a fresh literal so deleting keys is safe. */
 function stripUndefined(value) {
-  for (const key of Object.keys(value)) {
-    if (value[key] === void 0)
-      delete value[key];
-  }
-  return value;
-}
+	for (const key of Object.keys(value)) if (value[key] === void 0) delete value[key];
+	return value;
+}
+/**
+* Configure OAuth against an issuer. `acceptedAudiences` (or `resource`) is the
+* token-acceptance policy, not a per-request authorization decision: any token
+* carrying an accepted `aud` passes. When an issuer mints broad project-wide
+* audiences (e.g. Supabase's `aud: "authenticated"`), a token for one resource
+* is structurally accepted by another sharing that audience — so gate per-tool
+* authorization on `ctx.getClaims()` / `ctx.getClientId()`, never on the
+* accepted audience.
+*/
 function issuer(options) {
-  return Object.freeze(
-    stripUndefined({
-      type: "oauth",
-      ...options,
-      acceptedAudiences: frozenAudiences(options.acceptedAudiences),
-      requiredScopes: frozenArray(options.requiredScopes),
-      algorithms: frozenArray(options.algorithms),
-      accessTokenTyp: frozenArray(options.accessTokenTyp)
-    })
-  );
-}
-var oauth = Object.freeze({ issuer });
-var auth = Object.freeze({ oauth });
-
-// src/auth/context.ts
-var ToolContext = class {
-  #auth;
-  constructor(auth2) {
-    this.#auth = auth2;
-  }
-  /** Whether the in-flight tool call carries a verified auth context. */
-  isAuthenticated() {
-    return this.#auth !== void 0;
-  }
-  /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
-  getToken() {
-    return this.#auth?.bearer.token;
-  }
-  /** The verified user id (the token `sub`), or `undefined`. */
-  getUserId() {
-    return this.#auth?.principal.sub;
-  }
-  /** The verified user email, or `undefined` when absent. */
-  getUserEmail() {
-    return this.#auth?.principal.email;
-  }
-  /** The verified OAuth `client_id`, or `undefined`. */
-  getClientId() {
-    return this.#auth?.principal.clientId;
-  }
-  /** The verified OAuth scopes, or `undefined` when unauthenticated. */
-  getScopes() {
-    return this.#auth?.principal.scopes;
-  }
-  /** The verified token issuer, or `undefined`. */
-  getIssuer() {
-    return this.#auth?.principal.issuer;
-  }
-  /**
-   * The full verified JWT claims, or `undefined`. Use this for app/business
-   * authorization on issuer-specific claims that have no dedicated accessor.
-   */
-  getClaims() {
-    return this.#auth?.principal.claims;
-  }
-};
-
-// src/core/logger.ts
-var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
-function isLogLevel(value) {
-  return typeof value === "string" && value in LEVEL_RANK;
-}
-var LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
-function readEnvLevel() {
-  try {
-    const raw = typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0;
-    const normalized = raw?.trim().toLowerCase();
-    return isLogLevel(normalized) ? normalized : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var currentLevel = readEnvLevel() ?? "debug";
-function setLogLevel(level) {
-  currentLevel = level;
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  ToolContext,
-  auth,
-  defineMcp,
-  defineTool,
-  setLogLevel
-});
+	return Object.freeze(stripUndefined({
+		type: "oauth",
+		...options,
+		acceptedAudiences: frozenAudiences(options.acceptedAudiences),
+		requiredScopes: frozenArray(options.requiredScopes),
+		algorithms: frozenArray(options.algorithms),
+		accessTokenTyp: frozenArray(options.accessTokenTyp)
+	}));
+}
+const oauth = Object.freeze({ issuer });
+const auth = Object.freeze({ oauth });
+//#endregion
+exports.ToolContext = require_context.ToolContext;
+exports.auth = auth;
+exports.defineMcp = defineMcp;
+exports.defineTool = defineTool;
+exports.setLogLevel = require_logger.setLogLevel;