@lovable.dev/mcp-js 0.22.1 → 0.22.2-rc.0

package/dist/index.d.cts

@@ -1,7 +1,5 @@
-import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-qqrmJ736.js';
-export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-qqrmJ736.js';
-import 'zod';
-
+import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedResource, b as MetricsOptions, c as McpDefinition, d as ResourceLinkIcon, f as TextContent, g as ToolHandlerResult, h as ToolDefinition, i as EmbeddedBlobResource, l as McpDefinitionInput, m as ToolContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ToolAnnotations, r as ContentBlock, s as ImageContent, t as AudioContent, u as ResourceLink, v as ZodSchema, x as ToolContext, y as MetricsConfig } from "./types-BYdYYTjk.cjs";
+//#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
  * `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
@@ -17,27 +15,28 @@ declare function defineTool<TInput extends ZodRawShape | undefined = undefined,
  * emit the framework-specific route(s) at build time.
  */
 declare function defineMcp(def: McpDefinitionInput): McpDefinition;
-
+//#endregion
+//#region src/auth/config.d.ts
 type IssuerAcceptedAudiences = string | readonly string[];
 interface IssuerOAuthOptionsBase {
-    readonly resourceName?: string;
-    readonly resourceDocumentation?: string;
-    readonly protectedResourceMetadataUrl?: string;
-    readonly requireOAuthClientClaim?: boolean;
-    readonly acceptResourceClaim?: boolean;
-    readonly issuer: string;
-    readonly requiredScopes?: readonly string[];
-    readonly jwksUri?: string;
-    readonly algorithms?: readonly string[];
-    readonly clockToleranceSeconds?: number;
-    readonly accessTokenTyp?: readonly string[];
+  readonly resourceName?: string;
+  readonly resourceDocumentation?: string;
+  readonly protectedResourceMetadataUrl?: string;
+  readonly requireOAuthClientClaim?: boolean;
+  readonly acceptResourceClaim?: boolean;
+  readonly issuer: string;
+  readonly requiredScopes?: readonly string[];
+  readonly jwksUri?: string;
+  readonly algorithms?: readonly string[];
+  readonly clockToleranceSeconds?: number;
+  readonly accessTokenTyp?: readonly string[];
 }
 type IssuerOAuthOptions = IssuerOAuthOptionsBase & ({
-    readonly resource: string;
-    readonly acceptedAudiences?: IssuerAcceptedAudiences;
+  readonly resource: string;
+  readonly acceptedAudiences?: IssuerAcceptedAudiences;
 } | {
-    readonly resource?: string;
-    readonly acceptedAudiences: IssuerAcceptedAudiences;
+  readonly resource?: string;
+  readonly acceptedAudiences: IssuerAcceptedAudiences;
 });
 /**
  * Configure OAuth against an issuer. `acceptedAudiences` (or `resource`) is the
@@ -50,11 +49,12 @@ type IssuerOAuthOptions = IssuerOAuthOptionsBase & ({
  */
 declare function issuer(options: IssuerOAuthOptions): McpAuthConfig;
 declare const auth: Readonly<{
-    oauth: Readonly<{
-        issuer: typeof issuer;
-    }>;
+  oauth: Readonly<{
+    issuer: typeof issuer;
+  }>;
 }>;
-
+//#endregion
+//#region src/core/logger.d.ts
 type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
 /**
  * Set the runtime log level programmatically. Use this when the deployment can't
@@ -62,5 +62,5 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
  */
 declare function setLogLevel(level: LogLevel): void;
-
-export { type IssuerOAuthOptions, type LogLevel, McpDefinitionInput, ToolDefinition, ZodRawShape, auth, defineMcp, defineTool, setLogLevel };
+//#endregion
+export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.d.ts

@@ -1,7 +1,5 @@
-import { e as McpDefinitionInput, d as McpDefinition, Z as ZodRawShape, l as ToolDefinition, M as McpAuthConfig } from './types-qqrmJ736.js';
-export { A as AudioContent, C as ContentAnnotations, a as ContentBlock, E as EmbeddedBlobResource, b as EmbeddedResource, c as EmbeddedTextResource, I as ImageContent, J as JwtClaims, f as MetricsConfig, g as MetricsOptions, R as ResourceLink, h as ResourceLinkIcon, T as TextContent, i as ToolAnnotations, j as ToolContent, k as ToolContext, m as ToolHandlerResult, n as ZodSchema } from './types-qqrmJ736.js';
-import 'zod';
-
+import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedResource, b as MetricsOptions, c as McpDefinition, d as ResourceLinkIcon, f as TextContent, g as ToolHandlerResult, h as ToolDefinition, i as EmbeddedBlobResource, l as McpDefinitionInput, m as ToolContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ToolAnnotations, r as ContentBlock, s as ImageContent, t as AudioContent, u as ResourceLink, v as ZodSchema, x as ToolContext, y as MetricsConfig } from "./types-BYdYYTjk.js";
+//#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
  * `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
@@ -17,27 +15,28 @@ declare function defineTool<TInput extends ZodRawShape | undefined = undefined,
  * emit the framework-specific route(s) at build time.
  */
 declare function defineMcp(def: McpDefinitionInput): McpDefinition;
-
+//#endregion
+//#region src/auth/config.d.ts
 type IssuerAcceptedAudiences = string | readonly string[];
 interface IssuerOAuthOptionsBase {
-    readonly resourceName?: string;
-    readonly resourceDocumentation?: string;
-    readonly protectedResourceMetadataUrl?: string;
-    readonly requireOAuthClientClaim?: boolean;
-    readonly acceptResourceClaim?: boolean;
-    readonly issuer: string;
-    readonly requiredScopes?: readonly string[];
-    readonly jwksUri?: string;
-    readonly algorithms?: readonly string[];
-    readonly clockToleranceSeconds?: number;
-    readonly accessTokenTyp?: readonly string[];
+  readonly resourceName?: string;
+  readonly resourceDocumentation?: string;
+  readonly protectedResourceMetadataUrl?: string;
+  readonly requireOAuthClientClaim?: boolean;
+  readonly acceptResourceClaim?: boolean;
+  readonly issuer: string;
+  readonly requiredScopes?: readonly string[];
+  readonly jwksUri?: string;
+  readonly algorithms?: readonly string[];
+  readonly clockToleranceSeconds?: number;
+  readonly accessTokenTyp?: readonly string[];
 }
 type IssuerOAuthOptions = IssuerOAuthOptionsBase & ({
-    readonly resource: string;
-    readonly acceptedAudiences?: IssuerAcceptedAudiences;
+  readonly resource: string;
+  readonly acceptedAudiences?: IssuerAcceptedAudiences;
 } | {
-    readonly resource?: string;
-    readonly acceptedAudiences: IssuerAcceptedAudiences;
+  readonly resource?: string;
+  readonly acceptedAudiences: IssuerAcceptedAudiences;
 });
 /**
  * Configure OAuth against an issuer. `acceptedAudiences` (or `resource`) is the
@@ -50,11 +49,12 @@ type IssuerOAuthOptions = IssuerOAuthOptionsBase & ({
  */
 declare function issuer(options: IssuerOAuthOptions): McpAuthConfig;
 declare const auth: Readonly<{
-    oauth: Readonly<{
-        issuer: typeof issuer;
-    }>;
+  oauth: Readonly<{
+    issuer: typeof issuer;
+  }>;
 }>;
-
+//#endregion
+//#region src/core/logger.d.ts
 type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
 /**
  * Set the runtime log level programmatically. Use this when the deployment can't
@@ -62,5 +62,5 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
  */
 declare function setLogLevel(level: LogLevel): void;
-
-export { type IssuerOAuthOptions, type LogLevel, McpDefinitionInput, ToolDefinition, ZodRawShape, auth, defineMcp, defineTool, setLogLevel };
+//#endregion
+export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.js

@@ -1,203 +1,144 @@
-import {
-  ToolContext
-} from "./chunk-MA5H6PSF.js";
-import {
-  parseSafeUrl,
-  resolveMetricsConfig,
-  setLogLevel,
-  trimTrailingSlash
-} from "./chunk-H37EB22A.js";
-
-// src/core/define.ts
+import { a as setLogLevel, l as resolveMetricsConfig, o as parseSafeUrl, s as trimTrailingSlash } from "./logger-2OXtfiIW.js";
+import { t as ToolContext } from "./context-CIpPzN7P.js";
+//#region src/core/define.ts
 function assertUniqueNames(mcp) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const tool of mcp.tools) {
-    if (seen.has(tool.name)) {
-      throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-    }
-    seen.add(tool.name);
-  }
+	const seen = /* @__PURE__ */ new Set();
+	for (const tool of mcp.tools) {
+		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
+		seen.add(tool.name);
+	}
 }
 function assertNonEmptyString(label, value) {
-  if (value.trim() === "") {
-    throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-  }
-  if (value !== value.trim()) {
-    throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
-  }
+	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
+	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
 }
 function assertHttpsUrlField(name, value) {
-  assertNonEmptyString(`auth.${name}`, value);
-  parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
+	assertNonEmptyString(`auth.${name}`, value);
+	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
 }
 function assertScope(scope) {
-  if (scope.trim() === "" || /\s/.test(scope)) {
-    throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
-  }
+	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
 }
 function assertJwtAlgorithm(algorithm) {
-  if (algorithm.trim() === "" || /\s/.test(algorithm)) {
-    throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-  }
-  if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") {
-    throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
-  }
+	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
+	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
 }
-var MAX_CLOCK_TOLERANCE_SECONDS = 300;
+const MAX_CLOCK_TOLERANCE_SECONDS = 300;
 function assertClockToleranceSeconds(value) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) {
-    throw new Error(
-      `@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`
-    );
-  }
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
 }
-function assertOAuthConfig(auth2) {
-  if (auth2.type !== "oauth") {
-    const authType = String(auth2.type);
-    throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-  }
-  if (auth2.issuer === void 0) {
-    throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-  }
-  assertHttpsUrlField("issuer", auth2.issuer);
-  if (auth2.jwksUri !== void 0) {
-    assertHttpsUrlField("jwksUri", auth2.jwksUri);
-  }
-  if (auth2.resource !== void 0) {
-    assertHttpsUrlField("resource", auth2.resource);
-  }
-  if (auth2.resourceName !== void 0) {
-    assertNonEmptyString("auth.resourceName", auth2.resourceName);
-  }
-  if (auth2.resourceDocumentation !== void 0) {
-    assertHttpsUrlField("resourceDocumentation", auth2.resourceDocumentation);
-  }
-  if (auth2.protectedResourceMetadataUrl !== void 0) {
-    assertHttpsUrlField("protectedResourceMetadataUrl", auth2.protectedResourceMetadataUrl);
-  }
-  if (auth2.acceptedAudiences !== void 0) {
-    if (!Array.isArray(auth2.acceptedAudiences)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-    }
-    if (auth2.acceptedAudiences.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-    }
-    for (const audience of auth2.acceptedAudiences) {
-      if (typeof audience !== "string") {
-        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-      }
-      assertNonEmptyString("auth.acceptedAudiences", audience);
-      if (trimTrailingSlash(audience) === "") {
-        throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-      }
-    }
-  }
-  if (auth2.requireOAuthClientClaim !== void 0 && typeof auth2.requireOAuthClientClaim !== "boolean") {
-    throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-  }
-  if (auth2.acceptResourceClaim !== void 0 && typeof auth2.acceptResourceClaim !== "boolean") {
-    throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-  }
-  if (auth2.requiredScopes !== void 0) {
-    if (!Array.isArray(auth2.requiredScopes)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-    }
-    for (const scope of auth2.requiredScopes)
-      assertScope(scope);
-  }
-  if (auth2.algorithms !== void 0) {
-    if (!Array.isArray(auth2.algorithms)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-    }
-    if (auth2.algorithms.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-    }
-    for (const algorithm of auth2.algorithms)
-      assertJwtAlgorithm(algorithm);
-  }
-  if (auth2.accessTokenTyp !== void 0) {
-    if (!Array.isArray(auth2.accessTokenTyp)) {
-      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-    }
-    if (auth2.accessTokenTyp.length === 0) {
-      throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-    }
-    for (const typ of auth2.accessTokenTyp) {
-      if (typeof typ !== "string") {
-        throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-      }
-      assertNonEmptyString("auth.accessTokenTyp", typ);
-    }
-  }
-  if (auth2.clockToleranceSeconds !== void 0)
-    assertClockToleranceSeconds(auth2.clockToleranceSeconds);
-  if (auth2.resource === void 0 && auth2.acceptedAudiences === void 0) {
-    throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
-  }
+function assertOAuthConfig(auth) {
+	if (auth.type !== "oauth") {
+		const authType = String(auth.type);
+		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
+	}
+	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
+	assertHttpsUrlField("issuer", auth.issuer);
+	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
+	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
+	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
+	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
+	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
+	if (auth.acceptedAudiences !== void 0) {
+		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
+		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
+		for (const audience of auth.acceptedAudiences) {
+			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
+			assertNonEmptyString("auth.acceptedAudiences", audience);
+			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+		}
+	}
+	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+	if (auth.requiredScopes !== void 0) {
+		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
+		for (const scope of auth.requiredScopes) assertScope(scope);
+	}
+	if (auth.algorithms !== void 0) {
+		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
+		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
+		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
+	}
+	if (auth.accessTokenTyp !== void 0) {
+		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
+		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
+		for (const typ of auth.accessTokenTyp) {
+			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
+			assertNonEmptyString("auth.accessTokenTyp", typ);
+		}
+	}
+	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
+	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
 }
-function freezeAuth(auth2) {
-  if (!auth2)
-    return;
-  if (auth2.acceptedAudiences)
-    Object.freeze(auth2.acceptedAudiences);
-  if (auth2.requiredScopes)
-    Object.freeze(auth2.requiredScopes);
-  if (auth2.algorithms)
-    Object.freeze(auth2.algorithms);
-  if (auth2.accessTokenTyp)
-    Object.freeze(auth2.accessTokenTyp);
-  Object.freeze(auth2);
+function freezeAuth(auth) {
+	if (!auth) return;
+	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
+	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
+	if (auth.algorithms) Object.freeze(auth.algorithms);
+	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
+	Object.freeze(auth);
 }
+/**
+* Declare a single MCP tool. Import the result into your MCP definition's
+* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
+*
+* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
+* full `z.object(...)` — the MCP SDK builds the object wrapper internally
+* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
+*/
 function defineTool(def) {
-  return def;
+	return def;
 }
+/**
+* Declare the MCP server. `export default` the result from your MCP
+* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
+* emit the framework-specific route(s) at build time.
+*/
 function defineMcp(def) {
-  assertNonEmptyString("name", def.name);
-  assertNonEmptyString("title", def.title);
-  assertNonEmptyString("version", def.version);
-  assertUniqueNames(def);
-  if (def.auth)
-    assertOAuthConfig(def.auth);
-  resolveMetricsConfig(def.metrics);
-  freezeAuth(def.auth);
-  Object.freeze(def.tools);
-  for (const tool of def.tools)
-    Object.freeze(tool);
-  return def;
+	assertNonEmptyString("name", def.name);
+	assertNonEmptyString("title", def.title);
+	assertNonEmptyString("version", def.version);
+	assertUniqueNames(def);
+	if (def.auth) assertOAuthConfig(def.auth);
+	resolveMetricsConfig(def.metrics);
+	freezeAuth(def.auth);
+	Object.freeze(def.tools);
+	for (const tool of def.tools) Object.freeze(tool);
+	return def;
 }
-
-// src/auth/config.ts
+//#endregion
+//#region src/auth/config.ts
 function frozenArray(value) {
-  return value === void 0 ? void 0 : Object.freeze([...value]);
+	return value === void 0 ? void 0 : Object.freeze([...value]);
 }
 function frozenAudiences(value) {
-  return frozenArray(typeof value === "string" ? [value] : value);
+	return frozenArray(typeof value === "string" ? [value] : value);
 }
+/** Mutates `value` in place; callers pass a fresh literal so deleting keys is safe. */
 function stripUndefined(value) {
-  for (const key of Object.keys(value)) {
-    if (value[key] === void 0)
-      delete value[key];
-  }
-  return value;
+	for (const key of Object.keys(value)) if (value[key] === void 0) delete value[key];
+	return value;
 }
+/**
+* Configure OAuth against an issuer. `acceptedAudiences` (or `resource`) is the
+* token-acceptance policy, not a per-request authorization decision: any token
+* carrying an accepted `aud` passes. When an issuer mints broad project-wide
+* audiences (e.g. Supabase's `aud: "authenticated"`), a token for one resource
+* is structurally accepted by another sharing that audience — so gate per-tool
+* authorization on `ctx.getClaims()` / `ctx.getClientId()`, never on the
+* accepted audience.
+*/
 function issuer(options) {
-  return Object.freeze(
-    stripUndefined({
-      type: "oauth",
-      ...options,
-      acceptedAudiences: frozenAudiences(options.acceptedAudiences),
-      requiredScopes: frozenArray(options.requiredScopes),
-      algorithms: frozenArray(options.algorithms),
-      accessTokenTyp: frozenArray(options.accessTokenTyp)
-    })
-  );
+	return Object.freeze(stripUndefined({
+		type: "oauth",
+		...options,
+		acceptedAudiences: frozenAudiences(options.acceptedAudiences),
+		requiredScopes: frozenArray(options.requiredScopes),
+		algorithms: frozenArray(options.algorithms),
+		accessTokenTyp: frozenArray(options.accessTokenTyp)
+	}));
 }
-var oauth = Object.freeze({ issuer });
-var auth = Object.freeze({ oauth });
-export {
-  ToolContext,
-  auth,
-  defineMcp,
-  defineTool,
-  setLogLevel
-};
+const oauth = Object.freeze({ issuer });
+const auth = Object.freeze({ oauth });
+//#endregion
+export { ToolContext, auth, defineMcp, defineTool, setLogLevel };

package/dist/{io-D4srzRKc.d.ts → io-CfSPxeBN.d.ts}

@@ -1,3 +1,5 @@
+import "./list-tools-bh6-eqZM.js";
+//#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read
  * back the resolved entry path and the URL the stack mounts the MCP server at.
@@ -6,8 +8,8 @@
  * which the function and its companion routes live).
  */
 interface McpPluginApi {
-    readonly mcpEntry: string;
-    readonly urlPath: string;
+  readonly mcpEntry: string;
+  readonly urlPath: string;
 }
-
-export type { McpPluginApi as M };
+//#endregion
+export { McpPluginApi as t };

package/dist/io-DPYvBqET.d.cts

@@ -0,0 +1,15 @@
+import "./list-tools-B4TTPEl1.cjs";
+//#region src/manifest/io.d.ts
+/**
+ * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read
+ * back the resolved entry path and the URL the stack mounts the MCP server at.
+ * TanStack sets `urlPath` to the configured route path (default `/mcp`);
+ * Supabase sets it to `/functions/v1/<functionName>` (the public mount under
+ * which the function and its companion routes live).
+ */
+interface McpPluginApi {
+  readonly mcpEntry: string;
+  readonly urlPath: string;
+}
+//#endregion
+export { McpPluginApi as t };

package/dist/list-tools-B4TTPEl1.d.cts

@@ -0,0 +1,8 @@
+import { c as McpDefinition } from "./types-BYdYYTjk.cjs";
+import { t as MetricsRecorder } from "./base-DCe0kP79.cjs";
+import { t as McpRuntimeOptions } from "./authorize-CumVyk7p.cjs";
+//#region src/protocols/rest/list-tools.d.ts
+type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;
+//#endregion
+export { createListToolsHandler as n, RestListToolsHandler as t };

package/dist/list-tools-CFUX-uo-.cjs

@@ -0,0 +1,57 @@
+const require_cors = require("./cors-CSDhBjFd.cjs");
+let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+//#region src/protocols/rest/list-tools.ts
+function shapeToJsonSchema(shape) {
+	if (!shape) return null;
+	try {
+		return (0, _modelcontextprotocol_sdk_server_zod_json_schema_compat_js.toJsonSchemaCompat)((0, _modelcontextprotocol_sdk_server_zod_compat_js.objectFromShape)(shape));
+	} catch {
+		return null;
+	}
+}
+function buildMcpListing(mcp) {
+	return {
+		server: {
+			name: mcp.name,
+			version: mcp.version,
+			title: mcp.title
+		},
+		tools: mcp.tools.map((tool) => ({
+			name: tool.name,
+			title: tool.title,
+			description: tool.description,
+			annotations: tool.annotations,
+			inputSchema: shapeToJsonSchema(tool.inputSchema),
+			outputSchema: shapeToJsonSchema(tool.outputSchema)
+		}))
+	};
+}
+function createListToolsHandler(mcp, options = {}) {
+	require_cors.assertRestResourceBinding(mcp, options);
+	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
+	const handle = async (request, recorder) => {
+		const authResult = await authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
+		const response = Response.json(buildMcpListing(mcp));
+		return request.method === "HEAD" ? require_cors.headResponse(response) : response;
+	};
+	return async (request, recorder = require_cors.createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse("GET, HEAD, OPTIONS");
+		return require_cors.withCors(await handle(request, recorder));
+	};
+}
+//#endregion
+Object.defineProperty(exports, "buildMcpListing", {
+	enumerable: true,
+	get: function() {
+		return buildMcpListing;
+	}
+});
+Object.defineProperty(exports, "createListToolsHandler", {
+	enumerable: true,
+	get: function() {
+		return createListToolsHandler;
+	}
+});

package/dist/list-tools-DVJrjtmH.js

@@ -0,0 +1,46 @@
+import { i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, p as headResponse, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-rWp_tbLZ.js";
+import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+//#region src/protocols/rest/list-tools.ts
+function shapeToJsonSchema(shape) {
+	if (!shape) return null;
+	try {
+		return toJsonSchemaCompat(objectFromShape(shape));
+	} catch {
+		return null;
+	}
+}
+function buildMcpListing(mcp) {
+	return {
+		server: {
+			name: mcp.name,
+			version: mcp.version,
+			title: mcp.title
+		},
+		tools: mcp.tools.map((tool) => ({
+			name: tool.name,
+			title: tool.title,
+			description: tool.description,
+			annotations: tool.annotations,
+			inputSchema: shapeToJsonSchema(tool.inputSchema),
+			outputSchema: shapeToJsonSchema(tool.outputSchema)
+		}))
+	};
+}
+function createListToolsHandler(mcp, options = {}) {
+	assertRestResourceBinding(mcp, options);
+	const authorizer = createRequestAuthorizer(mcp, options);
+	const handle = async (request, recorder) => {
+		const authResult = await authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed("GET, HEAD, OPTIONS");
+		const response = Response.json(buildMcpListing(mcp));
+		return request.method === "HEAD" ? headResponse(response) : response;
+	};
+	return async (request, recorder = createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
+		return withCors(await handle(request, recorder));
+	};
+}
+//#endregion
+export { createListToolsHandler as n, buildMcpListing as t };

package/dist/list-tools-bh6-eqZM.d.ts

@@ -0,0 +1,8 @@
+import { c as McpDefinition } from "./types-BYdYYTjk.js";
+import { t as MetricsRecorder } from "./base-DCe0kP79.js";
+import { t as McpRuntimeOptions } from "./authorize-D6p4-9_D.js";
+//#region src/protocols/rest/list-tools.d.ts
+type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;
+//#endregion
+export { createListToolsHandler as n, RestListToolsHandler as t };