@lovable.dev/mcp-js 0.22.1 → 0.22.2-rc.1

package/dist/cli/extract-manifest.js

@@ -1,174 +1,135 @@
 #!/usr/bin/env node
-import {
-  buildMcpListing
-} from "../chunk-6SZOFKGH.js";
-import "../chunk-IFDWUM7L.js";
-import "../chunk-H37EB22A.js";
-import "../chunk-6DXGZZA4.js";
-import {
-  isFileMissing
-} from "../chunk-Y3ZFPEQH.js";
-import {
-  version
-} from "../chunk-ZQXSWTPU.js";
-
-// src/manifest/io.ts
-import { randomUUID } from "crypto";
-import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
-import { dirname, resolve } from "path";
-import { resolveConfig } from "vite";
-
-// src/manifest/extract.ts
-var MANIFEST_VERSION = 1;
-var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+import { t as version } from "../package-xS6mk-b_.js";
+import { t as buildMcpListing } from "../list-tools-I8Hvub9P.js";
+import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
+import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createServer, resolveConfig } from "vite";
+import { randomUUID } from "node:crypto";
+const MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
 function manifestAuth(auth) {
-  if (!auth)
-    return { type: "none" };
-  const oauth = { type: "oauth", issuer: auth.issuer };
-  if (auth.resource !== void 0)
-    oauth.resource = auth.resource;
-  if (auth.resourceName !== void 0)
-    oauth.resource_name = auth.resourceName;
-  if (auth.resourceDocumentation !== void 0)
-    oauth.resource_documentation = auth.resourceDocumentation;
-  if (auth.protectedResourceMetadataUrl !== void 0)
-    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
-  if (auth.requireOAuthClientClaim !== void 0)
-    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
-  if (auth.acceptResourceClaim !== void 0)
-    oauth.accept_resource_claim = auth.acceptResourceClaim;
-  if (auth.acceptedAudiences !== void 0)
-    oauth.accepted_audiences = auth.acceptedAudiences;
-  if (auth.requiredScopes !== void 0)
-    oauth.required_scopes = auth.requiredScopes;
-  if (auth.jwksUri !== void 0)
-    oauth.jwks_uri = auth.jwksUri;
-  if (auth.algorithms !== void 0)
-    oauth.algorithms = auth.algorithms;
-  if (auth.clockToleranceSeconds !== void 0)
-    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
-  return oauth;
+	if (!auth) return { type: "none" };
+	const oauth = {
+		type: "oauth",
+		issuer: auth.issuer
+	};
+	if (auth.resource !== void 0) oauth.resource = auth.resource;
+	if (auth.resourceName !== void 0) oauth.resource_name = auth.resourceName;
+	if (auth.resourceDocumentation !== void 0) oauth.resource_documentation = auth.resourceDocumentation;
+	if (auth.protectedResourceMetadataUrl !== void 0) oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+	if (auth.requireOAuthClientClaim !== void 0) oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+	if (auth.acceptResourceClaim !== void 0) oauth.accept_resource_claim = auth.acceptResourceClaim;
+	if (auth.acceptedAudiences !== void 0) oauth.accepted_audiences = auth.acceptedAudiences;
+	if (auth.requiredScopes !== void 0) oauth.required_scopes = auth.requiredScopes;
+	if (auth.jwksUri !== void 0) oauth.jwks_uri = auth.jwksUri;
+	if (auth.algorithms !== void 0) oauth.algorithms = auth.algorithms;
+	if (auth.clockToleranceSeconds !== void 0) oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+	return oauth;
 }
 function isToolShape(tool) {
-  if (typeof tool !== "object" || tool === null)
-    return false;
-  const t = tool;
-  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+	if (typeof tool !== "object" || tool === null) return false;
+	const t = tool;
+	return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
 }
 function isAuthShape(auth) {
-  if (auth === void 0)
-    return true;
-  if (typeof auth !== "object" || auth === null)
-    return false;
-  const a = auth;
-  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+	if (auth === void 0) return true;
+	if (typeof auth !== "object" || auth === null) return false;
+	const a = auth;
+	return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
 }
 function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
-  const def = definition;
-  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
-  if (!validShape) {
-    const got = definition == null ? "no default export" : typeof definition;
-    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
-  }
-  return {
-    version: MANIFEST_VERSION,
-    sdk_version: version,
-    path: urlPath,
-    auth: manifestAuth(def.auth),
-    mcp: buildMcpListing(def)
-  };
+	const def = definition;
+	if (!(!!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth))) throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${definition == null ? "no default export" : typeof definition}).`);
+	return {
+		version: 1,
+		sdk_version: version,
+		path: urlPath,
+		auth: manifestAuth(def.auth),
+		mcp: buildMcpListing(def)
+	};
 }
-
-// src/manifest/ssr-loader.ts
-import { createServer } from "vite";
-async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
-  const server = await createServer({
-    configFile: false,
-    root: projectRoot2,
-    logLevel: "silent",
-    server: { middlewareMode: true, hmr: false, watch: null },
-    optimizeDeps: { noDiscovery: true },
-    resolve: { alias }
-  });
-  try {
-    const mod = await server.ssrLoadModule(entryAbs);
-    return manifestFromDefinition(mod.default, urlPath, entryAbs);
-  } finally {
-    await server.close();
-  }
+//#endregion
+//#region src/manifest/ssr-loader.ts
+async function produceViaSsr(projectRoot, alias, entryAbs, urlPath) {
+	const server = await createServer({
+		configFile: false,
+		root: projectRoot,
+		logLevel: "silent",
+		server: {
+			middlewareMode: true,
+			hmr: false,
+			watch: null
+		},
+		optimizeDeps: { noDiscovery: true },
+		resolve: { alias }
+	});
+	try {
+		return manifestFromDefinition((await server.ssrLoadModule(entryAbs)).default, urlPath, entryAbs);
+	} finally {
+		await server.close();
+	}
 }
-
-// src/manifest/io.ts
-var MCP_PLUGIN_NAME_PREFIX = "@lovable.dev/mcp-js";
-var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
-var DEFAULT_MCP_PATH = "/mcp";
+//#endregion
+//#region src/manifest/io.ts
+const MCP_PLUGIN_NAME_PREFIX = "@lovable.dev/mcp-js";
 function writeManifestIfChanged(file, manifest) {
-  const content = JSON.stringify(manifest, null, 2) + "\n";
-  let existing;
-  try {
-    existing = readFileSync(file, "utf8");
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-  }
-  if (existing === content)
-    return;
-  mkdirSync(dirname(file), { recursive: true });
-  const tmp = `${file}.${randomUUID()}.tmp`;
-  try {
-    writeFileSync(tmp, content, "utf8");
-    renameSync(tmp, file);
-  } catch (err) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
+	const content = JSON.stringify(manifest, null, 2) + "\n";
+	let existing;
+	try {
+		existing = readFileSync(file, "utf8");
+	} catch (err) {
+		if (!isFileMissing(err)) throw err;
+	}
+	if (existing === content) return;
+	mkdirSync(dirname(file), { recursive: true });
+	const tmp = `${file}.${randomUUID()}.tmp`;
+	try {
+		writeFileSync(tmp, content, "utf8");
+		renameSync(tmp, file);
+	} catch (err) {
+		try {
+			unlinkSync(tmp);
+		} catch {}
+		throw err;
+	}
 }
 function removeManifest(file) {
-  try {
-    unlinkSync(file);
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-  }
+	try {
+		unlinkSync(file);
+	} catch (err) {
+		if (!isFileMissing(err)) throw err;
+	}
 }
 async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
-  let entryExists = true;
-  try {
-    lstatSync(entryAbs);
-  } catch (err) {
-    if (!isFileMissing(err))
-      throw err;
-    entryExists = false;
-  }
-  if (!entryExists) {
-    removeManifest(manifestFile);
-    return;
-  }
-  const manifest = await produce(entryAbs, urlPath);
-  writeManifestIfChanged(manifestFile, manifest);
+	let entryExists = true;
+	try {
+		lstatSync(entryAbs);
+	} catch (err) {
+		if (!isFileMissing(err)) throw err;
+		entryExists = false;
+	}
+	if (!entryExists) {
+		removeManifest(manifestFile);
+		return;
+	}
+	writeManifestIfChanged(manifestFile, await produce(entryAbs, urlPath));
 }
-async function runExtract(projectRoot2) {
-  const resolved = await resolveConfig({ root: projectRoot2, logLevel: "silent" }, "serve");
-  const alias = resolved.resolve?.alias ?? [];
-  const pluginApi = resolved.plugins.find(
-    (p) => typeof p.name === "string" && p.name.startsWith(MCP_PLUGIN_NAME_PREFIX)
-  )?.api;
-  const entryAbs = pluginApi?.mcpEntry ?? resolve(projectRoot2, DEFAULT_MCP_ENTRY);
-  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
-  await syncManifest(
-    resolve(projectRoot2, MANIFEST_RELATIVE_PATH),
-    entryAbs,
-    urlPath,
-    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
-  );
+async function runExtract(projectRoot) {
+	const resolved = await resolveConfig({
+		root: projectRoot,
+		logLevel: "silent"
+	}, "serve");
+	const alias = resolved.resolve?.alias ?? [];
+	const pluginApi = resolved.plugins.find((p) => typeof p.name === "string" && p.name.startsWith(MCP_PLUGIN_NAME_PREFIX))?.api;
+	const entryAbs = pluginApi?.mcpEntry ?? resolve(projectRoot, "src/lib/mcp/index.ts");
+	const urlPath = pluginApi?.urlPath ?? "/mcp";
+	await syncManifest(resolve(projectRoot, MANIFEST_RELATIVE_PATH), entryAbs, urlPath, (entry, path) => produceViaSsr(projectRoot, alias, entry, path));
 }
-
-// src/cli/extract-manifest.ts
-var projectRoot = process.argv[2] ?? process.cwd();
-runExtract(projectRoot).catch((err) => {
-  console.error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
+//#endregion
+//#region src/cli/extract-manifest.ts
+runExtract(process.argv[2] ?? process.cwd()).catch((err) => {
+	console.error(err instanceof Error ? err.message : String(err));
+	process.exit(1);
 });
+//#endregion
+export {};

package/dist/content-D5LJAHyM.js

@@ -0,0 +1,12 @@
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+export { extractTextContent as t };

package/dist/content-NCYIGgOb.cjs

@@ -0,0 +1,17 @@
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+Object.defineProperty(exports, "extractTextContent", {
+	enumerable: true,
+	get: function() {
+		return extractTextContent;
+	}
+});

package/dist/context-BweeEcoA.cjs

@@ -0,0 +1,56 @@
+//#region src/auth/context.ts
+/**
+* The auth surface passed to every tool handler as its second argument. It wraps
+* the verified per-request auth context in a private field, so the context — and
+* the bearer token inside it — can't be read, enumerated, spread, or
+* `JSON.stringify`'d off the instance; the accessors below are the only way out.
+* `getToken()` is the single intentional escape hatch for the raw bearer.
+*/
+var ToolContext = class {
+	#auth;
+	constructor(auth) {
+		this.#auth = auth;
+	}
+	/** Whether the in-flight tool call carries a verified auth context. */
+	isAuthenticated() {
+		return this.#auth !== void 0;
+	}
+	/** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
+	getToken() {
+		return this.#auth?.bearer.token;
+	}
+	/** The verified user id (the token `sub`), or `undefined`. */
+	getUserId() {
+		return this.#auth?.principal.sub;
+	}
+	/** The verified user email, or `undefined` when absent. */
+	getUserEmail() {
+		return this.#auth?.principal.email;
+	}
+	/** The verified OAuth `client_id`, or `undefined`. */
+	getClientId() {
+		return this.#auth?.principal.clientId;
+	}
+	/** The verified OAuth scopes, or `undefined` when unauthenticated. */
+	getScopes() {
+		return this.#auth?.principal.scopes;
+	}
+	/** The verified token issuer, or `undefined`. */
+	getIssuer() {
+		return this.#auth?.principal.issuer;
+	}
+	/**
+	* The full verified JWT claims, or `undefined`. Use this for app/business
+	* authorization on issuer-specific claims that have no dedicated accessor.
+	*/
+	getClaims() {
+		return this.#auth?.principal.claims;
+	}
+};
+//#endregion
+Object.defineProperty(exports, "ToolContext", {
+	enumerable: true,
+	get: function() {
+		return ToolContext;
+	}
+});

package/dist/context-CIpPzN7P.js

@@ -0,0 +1,51 @@
+//#region src/auth/context.ts
+/**
+* The auth surface passed to every tool handler as its second argument. It wraps
+* the verified per-request auth context in a private field, so the context — and
+* the bearer token inside it — can't be read, enumerated, spread, or
+* `JSON.stringify`'d off the instance; the accessors below are the only way out.
+* `getToken()` is the single intentional escape hatch for the raw bearer.
+*/
+var ToolContext = class {
+	#auth;
+	constructor(auth) {
+		this.#auth = auth;
+	}
+	/** Whether the in-flight tool call carries a verified auth context. */
+	isAuthenticated() {
+		return this.#auth !== void 0;
+	}
+	/** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
+	getToken() {
+		return this.#auth?.bearer.token;
+	}
+	/** The verified user id (the token `sub`), or `undefined`. */
+	getUserId() {
+		return this.#auth?.principal.sub;
+	}
+	/** The verified user email, or `undefined` when absent. */
+	getUserEmail() {
+		return this.#auth?.principal.email;
+	}
+	/** The verified OAuth `client_id`, or `undefined`. */
+	getClientId() {
+		return this.#auth?.principal.clientId;
+	}
+	/** The verified OAuth scopes, or `undefined` when unauthenticated. */
+	getScopes() {
+		return this.#auth?.principal.scopes;
+	}
+	/** The verified token issuer, or `undefined`. */
+	getIssuer() {
+		return this.#auth?.principal.issuer;
+	}
+	/**
+	* The full verified JWT claims, or `undefined`. Use this for app/business
+	* authorization on issuer-specific claims that have no dedicated accessor.
+	*/
+	getClaims() {
+		return this.#auth?.principal.claims;
+	}
+};
+//#endregion
+export { ToolContext as t };