@lovable.dev/mcp-js 0.22.1-rc.9 → 0.22.2-rc.0

package/dist/authorize-CumVyk7p.d.cts

@@ -0,0 +1,27 @@
+import "./types-BYdYYTjk.cjs";
+//#region src/auth/authorize.d.ts
+interface McpRuntimeOptions {
+  /**
+   * Public MCP protocol path. REST companion handlers pass this so OAuth
+   * resource/audience checks bind to `/mcp`, not internal `/.mcp/*` RPC URLs.
+   */
+  resourcePath?: string;
+  /**
+   * Host-relative path of the SDK-served protected-resource metadata document.
+   * The Vite plugin injects it into every emitted handler when it generates the
+   * PRM route, so the 401 challenge advertises the same path the route serves.
+   * Its presence is the signal that the SDK owns the PRM document, so it is
+   * mutually exclusive with `auth.protectedResourceMetadataUrl` (which points at
+   * an externally hosted document). Defaults to the well-known path when absent.
+   */
+  metadataPath?: string;
+  /**
+   * Derive the request origin (and thus the advertised `resource`/metadata URLs)
+   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
+   * this before invoking the handler, so the OAuth runtime never sees it; safe
+   * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+   */
+  trustForwardedHost?: boolean;
+}
+//#endregion
+export { McpRuntimeOptions as t };

package/dist/authorize-D6p4-9_D.d.ts

@@ -0,0 +1,27 @@
+import "./types-BYdYYTjk.js";
+//#region src/auth/authorize.d.ts
+interface McpRuntimeOptions {
+  /**
+   * Public MCP protocol path. REST companion handlers pass this so OAuth
+   * resource/audience checks bind to `/mcp`, not internal `/.mcp/*` RPC URLs.
+   */
+  resourcePath?: string;
+  /**
+   * Host-relative path of the SDK-served protected-resource metadata document.
+   * The Vite plugin injects it into every emitted handler when it generates the
+   * PRM route, so the 401 challenge advertises the same path the route serves.
+   * Its presence is the signal that the SDK owns the PRM document, so it is
+   * mutually exclusive with `auth.protectedResourceMetadataUrl` (which points at
+   * an externally hosted document). Defaults to the well-known path when absent.
+   */
+  metadataPath?: string;
+  /**
+   * Derive the request origin (and thus the advertised `resource`/metadata URLs)
+   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
+   * this before invoking the handler, so the OAuth runtime never sees it; safe
+   * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+   */
+  trustForwardedHost?: boolean;
+}
+//#endregion
+export { McpRuntimeOptions as t };

package/dist/base-DCe0kP79.d.cts

@@ -0,0 +1,29 @@
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** The `tool_error` message (text content of an `isError` result). Local log
+   *  only — never sent to the collector, so it stays on-box for the operator. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
+export { MetricsRecorder as t };

package/dist/base-DCe0kP79.d.ts

@@ -0,0 +1,29 @@
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** The `tool_error` message (text content of an `isError` result). Local log
+   *  only — never sent to the collector, so it stays on-box for the operator. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
+export { MetricsRecorder as t };

package/dist/cli/extract-manifest.cjs

@@ -1,219 +1,134 @@
 #!/usr/bin/env node
-"use strict";
-
-// src/manifest/io.ts
-var import_node_crypto = require("crypto");
-var import_node_fs = require("fs");
-var import_node_path = require("path");
-var import_vite2 = require("vite");
-
-// src/core/fs-errors.ts
-function isFileMissing(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
-
-// package.json
-var version = "0.22.1-rc.9";
-
-// src/protocols/rest/list-tools.ts
-var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
-var import_zod_json_schema_compat = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
-
-// src/core/logger.ts
-var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
-function isLogLevel(value) {
-  return typeof value === "string" && value in LEVEL_RANK;
-}
-var LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
-function readEnvLevel() {
-  try {
-    const raw = typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0;
-    const normalized = raw?.trim().toLowerCase();
-    return isLogLevel(normalized) ? normalized : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var currentLevel = readEnvLevel() ?? "debug";
-
-// src/auth/verifier.ts
-var import_jose = require("jose");
-
-// src/protocols/rest/list-tools.ts
-function shapeToJsonSchema(shape) {
-  if (!shape)
-    return null;
-  try {
-    return (0, import_zod_json_schema_compat.toJsonSchemaCompat)((0, import_zod_compat.objectFromShape)(shape));
-  } catch {
-    return null;
-  }
-}
-function buildMcpListing(mcp) {
-  return {
-    server: { name: mcp.name, version: mcp.version, title: mcp.title },
-    tools: mcp.tools.map((tool) => ({
-      name: tool.name,
-      title: tool.title,
-      description: tool.description,
-      annotations: tool.annotations,
-      inputSchema: shapeToJsonSchema(tool.inputSchema),
-      outputSchema: shapeToJsonSchema(tool.outputSchema)
-    }))
-  };
-}
-
-// src/manifest/extract.ts
-var MANIFEST_VERSION = 1;
-var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+const require_package = require("../package-DzstF8Ih.cjs");
+const require_list_tools = require("../list-tools-CFUX-uo-.cjs");
+const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+let vite = require("vite");
+let node_crypto = require("node:crypto");
+const MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
 function manifestAuth(auth) {
-  if (!auth)
-    return { type: "none" };
-  const oauth = { type: "oauth", issuer: auth.issuer };
-  if (auth.resource !== void 0)
-    oauth.resource = auth.resource;
-  if (auth.resourceName !== void 0)
-    oauth.resource_name = auth.resourceName;
-  if (auth.resourceDocumentation !== void 0)
-    oauth.resource_documentation = auth.resourceDocumentation;
-  if (auth.protectedResourceMetadataUrl !== void 0)
-    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
-  if (auth.requireOAuthClientClaim !== void 0)
-    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
-  if (auth.acceptResourceClaim !== void 0)
-    oauth.accept_resource_claim = auth.acceptResourceClaim;
-  if (auth.acceptedAudiences !== void 0)
-    oauth.accepted_audiences = auth.acceptedAudiences;
-  if (auth.requiredScopes !== void 0)
-    oauth.required_scopes = auth.requiredScopes;
-  if (auth.jwksUri !== void 0)
-    oauth.jwks_uri = auth.jwksUri;
-  if (auth.algorithms !== void 0)
-    oauth.algorithms = auth.algorithms;
-  if (auth.clockToleranceSeconds !== void 0)
-    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
-  return oauth;
+	if (!auth) return { type: "none" };
+	const oauth = {
+		type: "oauth",
+		issuer: auth.issuer
+	};
+	if (auth.resource !== void 0) oauth.resource = auth.resource;
+	if (auth.resourceName !== void 0) oauth.resource_name = auth.resourceName;
+	if (auth.resourceDocumentation !== void 0) oauth.resource_documentation = auth.resourceDocumentation;
+	if (auth.protectedResourceMetadataUrl !== void 0) oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+	if (auth.requireOAuthClientClaim !== void 0) oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+	if (auth.acceptResourceClaim !== void 0) oauth.accept_resource_claim = auth.acceptResourceClaim;
+	if (auth.acceptedAudiences !== void 0) oauth.accepted_audiences = auth.acceptedAudiences;
+	if (auth.requiredScopes !== void 0) oauth.required_scopes = auth.requiredScopes;
+	if (auth.jwksUri !== void 0) oauth.jwks_uri = auth.jwksUri;
+	if (auth.algorithms !== void 0) oauth.algorithms = auth.algorithms;
+	if (auth.clockToleranceSeconds !== void 0) oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+	return oauth;
 }
 function isToolShape(tool) {
-  if (typeof tool !== "object" || tool === null)
-    return false;
-  const t = tool;
-  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+	if (typeof tool !== "object" || tool === null) return false;
+	const t = tool;
+	return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
 }
 function isAuthShape(auth) {
-  if (auth === void 0)
-    return true;
-  if (typeof auth !== "object" || auth === null)
-    return false;
-  const a = auth;
-  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+	if (auth === void 0) return true;
+	if (typeof auth !== "object" || auth === null) return false;
+	const a = auth;
+	return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
 }
 function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
-  const def = definition;
-  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
-  if (!validShape) {
-    const got = definition == null ? "no default export" : typeof definition;
-    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
-  }
-  return {
-    version: MANIFEST_VERSION,
-    sdk_version: version,
-    path: urlPath,
-    auth: manifestAuth(def.auth),
-    mcp: buildMcpListing(def)
-  };
+	const def = definition;
+	if (!(!!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth))) throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${definition == null ? "no default export" : typeof definition}).`);
+	return {
+		version: 1,
+		sdk_version: require_package.version,
+		path: urlPath,
+		auth: manifestAuth(def.auth),
+		mcp: require_list_tools.buildMcpListing(def)
+	};
 }
-
-// src/manifest/ssr-loader.ts
-var import_vite = require("vite");
-async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
-  const server = await (0, import_vite.createServer)({
-    configFile: false,
-    root: projectRoot2,
-    logLevel: "silent",
-    server: { middlewareMode: true, hmr: false, watch: null },
-    optimizeDeps: { noDiscovery: true },
-    resolve: { alias }
-  });
-  try {
-    const mod = await server.ssrLoadModule(entryAbs);
-    return manifestFromDefinition(mod.default, urlPath, entryAbs);
-  } finally {
-    await server.close();
-  }
+//#endregion
+//#region src/manifest/ssr-loader.ts
+async function produceViaSsr(projectRoot, alias, entryAbs, urlPath) {
+	const server = await (0, vite.createServer)({
+		configFile: false,
+		root: projectRoot,
+		logLevel: "silent",
+		server: {
+			middlewareMode: true,
+			hmr: false,
+			watch: null
+		},
+		optimizeDeps: { noDiscovery: true },
+		resolve: { alias }
+	});
+	try {
+		return manifestFromDefinition((await server.ssrLoadModule(entryAbs)).default, urlPath, entryAbs);
+	} finally {
+		await server.close();
+	}
 }
-
-// src/manifest/io.ts
-var MCP_PLUGIN_NAME_PREFIX = "@lovable.dev/mcp-js";
-var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
-var DEFAULT_MCP_PATH = "/mcp";
+//#endregion
+//#region src/manifest/io.ts
+const MCP_PLUGIN_NAME_PREFIX = "@lovable.dev/mcp-js";
 function writeManifestIfChanged(file, manifest) {
-  const content = JSON.stringify(manifest, null, 2) + "\n";
-  let existing;
-  try {
-    existing = (0, import_node_fs.readFileSync)(file, "utf8");
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-  }
-  if (existing === content)
-    return;
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(file), { recursive: true });
-  const tmp = `${file}.${(0, import_node_crypto.randomUUID)()}.tmp`;
-  try {
-    (0, import_node_fs.writeFileSync)(tmp, content, "utf8");
-    (0, import_node_fs.renameSync)(tmp, file);
-  } catch (err) {
-    try {
-      (0, import_node_fs.unlinkSync)(tmp);
-    } catch {
-    }
-    throw err;
-  }
+	const content = JSON.stringify(manifest, null, 2) + "\n";
+	let existing;
+	try {
+		existing = (0, node_fs.readFileSync)(file, "utf8");
+	} catch (err) {
+		if (!require_fs_errors.isFileMissing(err)) throw err;
+	}
+	if (existing === content) return;
+	(0, node_fs.mkdirSync)((0, node_path.dirname)(file), { recursive: true });
+	const tmp = `${file}.${(0, node_crypto.randomUUID)()}.tmp`;
+	try {
+		(0, node_fs.writeFileSync)(tmp, content, "utf8");
+		(0, node_fs.renameSync)(tmp, file);
+	} catch (err) {
+		try {
+			(0, node_fs.unlinkSync)(tmp);
+		} catch {}
+		throw err;
+	}
 }
 function removeManifest(file) {
-  try {
-    (0, import_node_fs.unlinkSync)(file);
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-  }
+	try {
+		(0, node_fs.unlinkSync)(file);
+	} catch (err) {
+		if (!require_fs_errors.isFileMissing(err)) throw err;
+	}
 }
 async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
-  let entryExists = true;
-  try {
-    (0, import_node_fs.lstatSync)(entryAbs);
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-    entryExists = false;
-  }
-  if (!entryExists) {
-    removeManifest(manifestFile);
-    return;
-  }
-  const manifest = await produce(entryAbs, urlPath);
-  writeManifestIfChanged(manifestFile, manifest);
+	let entryExists = true;
+	try {
+		(0, node_fs.lstatSync)(entryAbs);
+	} catch (err) {
+		if (!require_fs_errors.isFileMissing(err)) throw err;
+		entryExists = false;
+	}
+	if (!entryExists) {
+		removeManifest(manifestFile);
+		return;
+	}
+	writeManifestIfChanged(manifestFile, await produce(entryAbs, urlPath));
 }
-async function runExtract(projectRoot2) {
-  const resolved = await (0, import_vite2.resolveConfig)({ root: projectRoot2, logLevel: "silent" }, "serve");
-  const alias = resolved.resolve?.alias ?? [];
-  const pluginApi = resolved.plugins.find(
-    (p) => typeof p.name === "string" && p.name.startsWith(MCP_PLUGIN_NAME_PREFIX)
-  )?.api;
-  const entryAbs = pluginApi?.mcpEntry ?? (0, import_node_path.resolve)(projectRoot2, DEFAULT_MCP_ENTRY);
-  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
-  await syncManifest(
-    (0, import_node_path.resolve)(projectRoot2, MANIFEST_RELATIVE_PATH),
-    entryAbs,
-    urlPath,
-    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
-  );
+async function runExtract(projectRoot) {
+	const resolved = await (0, vite.resolveConfig)({
+		root: projectRoot,
+		logLevel: "silent"
+	}, "serve");
+	const alias = resolved.resolve?.alias ?? [];
+	const pluginApi = resolved.plugins.find((p) => typeof p.name === "string" && p.name.startsWith(MCP_PLUGIN_NAME_PREFIX))?.api;
+	const entryAbs = pluginApi?.mcpEntry ?? (0, node_path.resolve)(projectRoot, "src/lib/mcp/index.ts");
+	const urlPath = pluginApi?.urlPath ?? "/mcp";
+	await syncManifest((0, node_path.resolve)(projectRoot, MANIFEST_RELATIVE_PATH), entryAbs, urlPath, (entry, path) => produceViaSsr(projectRoot, alias, entry, path));
 }
-
-// src/cli/extract-manifest.ts
-var projectRoot = process.argv[2] ?? process.cwd();
-runExtract(projectRoot).catch((err) => {
-  console.error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
+//#endregion
+//#region src/cli/extract-manifest.ts
+runExtract(process.argv[2] ?? process.cwd()).catch((err) => {
+	console.error(err instanceof Error ? err.message : String(err));
+	process.exit(1);
 });
+//#endregion

package/dist/cli/extract-manifest.d.cts

@@ -1 +1 @@
-#!/usr/bin/env node
+export { };

package/dist/cli/extract-manifest.d.ts

@@ -1 +1 @@
-#!/usr/bin/env node
+export { };