@lovable.dev/mcp-js 0.22.1-rc.1 → 0.22.1-rc.10

package/dist/authorize-BMeXd_Sh.d.ts

@@ -0,0 +1,25 @@
+interface McpRuntimeOptions {
+    /**
+     * Public MCP protocol path. REST companion handlers pass this so OAuth
+     * resource/audience checks bind to `/mcp`, not internal `/.mcp/*` RPC URLs.
+     */
+    resourcePath?: string;
+    /**
+     * Host-relative path of the SDK-served protected-resource metadata document.
+     * The Vite plugin injects it into every emitted handler when it generates the
+     * PRM route, so the 401 challenge advertises the same path the route serves.
+     * Its presence is the signal that the SDK owns the PRM document, so it is
+     * mutually exclusive with `auth.protectedResourceMetadataUrl` (which points at
+     * an externally hosted document). Defaults to the well-known path when absent.
+     */
+    metadataPath?: string;
+    /**
+     * Derive the request origin (and thus the advertised `resource`/metadata URLs)
+     * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
+     * this before invoking the handler, so the OAuth runtime never sees it; safe
+     * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+     */
+    trustForwardedHost?: boolean;
+}
+
+export type { McpRuntimeOptions as M };

package/dist/base-CM-KCpp6.d.ts

@@ -0,0 +1,28 @@
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+    /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+    tool: string | null;
+    /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+    method: string;
+    outcome: InvocationOutcome;
+    durationMs: number;
+    reqBytes?: number;
+    resBytes?: number;
+    /** The app end-user that made the call (the access token `sub`), or
+     *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+    endUserId?: string;
+    /** The `tool_error` message (text content of an `isError` result). Local log
+     *  only — never sent to the collector, so it stays on-box for the operator. */
+    errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+    emit(ev: InvocationRecord): Promise<void>;
+}
+
+export type { MetricsRecorder as M };

package/dist/chunk-5QA2Y5GJ.js

@@ -0,0 +1,6 @@
+// package.json
+var version = "0.22.1-rc.10";
+
+export {
+  version
+};