@lovable.dev/mcp-js 0.22.2 → 0.24.0

package/dist/{base-DCe0kP79.d.cts → base-D-dYxK8t.d.cts}

@@ -1,5 +1,5 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and

package/dist/{base-DCe0kP79.d.ts → base-D-dYxK8t.d.ts}

@@ -1,5 +1,5 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_config_error";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and

package/dist/cli/extract-manifest.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_package = require("../package-CFrZxdHL.cjs");
-const require_list_tools = require("../list-tools-YHIrPuuR.cjs");
+const require_package = require("../package-DtnkW7Jc.cjs");
+const require_list_tools = require("../list-tools-BeVzrTT-.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/cli/extract-manifest.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CLHBPGM1.js";
-import { t as buildMcpListing } from "../list-tools--Kx40Dg2.js";
+import { t as version } from "../package-DudvPdrW.js";
+import { t as buildMcpListing } from "../list-tools-BrSIMpBi.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{cors-CJct3BEI.js → cors-Ftb-tw1d.js}

@@ -1,5 +1,5 @@
 import { c as DEFAULT_METRICS_ENDPOINT, i as log, l as resolveMetricsConfig, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR } from "./logger-2OXtfiIW.js";
-import { t as version } from "./package-CLHBPGM1.js";
+import { t as version } from "./package-DudvPdrW.js";
 import "./metadata-path-CAkNcfyY.js";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 //#region src/core/http.ts
@@ -315,11 +315,28 @@ function cachedPromise(load, label) {
 //#endregion
 //#region src/auth/discovery.ts
 var OAuthConfigurationError = class extends Error {
-	constructor(message) {
+	stage;
+	constructor(message, stage) {
 		super(message);
+		this.stage = stage;
 		this.name = "OAuthConfigurationError";
 	}
 };
+/** The AS never answered at the network layer — an upstream outage, not a misconfiguration. */
+var OAuthUpstreamUnreachableError = class extends Error {
+	stage;
+	constructor(message, stage) {
+		super(message);
+		this.stage = stage;
+		this.name = "OAuthUpstreamUnreachableError";
+	}
+};
+var MetadataUnreachableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MetadataUnreachableError";
+	}
+};
 const METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
 	const path = trimTrailingSlash(url.pathname);
@@ -346,25 +363,35 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
 	for (const url of metadataUrls) try {
 		return await fetchOAuthServerMetadata(url, expectedIssuer);
 	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
 		log.debug("oauth.discovery.attempt_failed", {
 			url,
-			...describeError(err)
+			...describeError(error)
 		});
-		errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+		errors.push(error);
 	}
+	const unreachable = errors.some((e) => e instanceof MetadataUnreachableError);
+	const detail = errors.map((e) => e.message).join("; ");
 	log.error("oauth.discovery.exhausted", {
 		expectedIssuer,
 		urlsTried: metadataUrls,
-		errors
+		errors: detail,
+		unreachable
 	});
-	throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
+	const message = `failed to discover OAuth server metadata (${detail})`;
+	throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
 	log.debug("oauth.discovery.fetch", { url });
-	const response = await fetch(url, {
-		signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
-		redirect: "manual"
-	});
+	let response;
+	try {
+		response = await fetch(url, {
+			signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
+			redirect: "manual"
+		});
+	} catch (err) {
+		throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+	}
 	if (!response.ok) throw new Error(String(response.status));
 	const json = await response.json();
 	if (typeof json.issuer !== "string") throw new Error("missing issuer");
@@ -388,12 +415,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 	try {
 		return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
 	} catch (err) {
+		const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+		if (err instanceof MetadataUnreachableError) {
+			log.error("oauth.discovery.unreachable", {
+				issuer,
+				...describeError(err),
+				outcome: "503 authorization server unreachable"
+			});
+			throw new OAuthUpstreamUnreachableError(message, "discovery");
+		}
 		log.error("oauth.discovery.config_error", {
 			issuer,
 			...describeError(err),
 			outcome: "500 oauth configuration error"
 		});
-		throw new OAuthConfigurationError(`OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`);
+		throw new OAuthConfigurationError(message, "discovery");
 	}
 }
 /** Metadata and token verification share issuer/JWKS discovery, but transient failures must not poison the runtime. */
@@ -507,11 +543,20 @@ function tokenHeaderFields(token) {
 	}
 }
 async function fetchVerificationKeySet(jwksUri) {
+	let response;
 	try {
-		const response = await fetch(jwksUri, {
+		response = await fetch(jwksUri, {
 			signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS),
 			redirect: "manual"
 		});
+	} catch (err) {
+		log.error("oauth.jwks.unreachable", {
+			...describeError(err),
+			outcome: "503 authorization server unreachable"
+		});
+		throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
+	}
+	try {
 		if (!response.ok) throw new Error(`JWKS endpoint returned ${response.status}`);
 		return createLocalJWKSet(await response.json());
 	} catch (err) {
@@ -519,7 +564,7 @@ async function fetchVerificationKeySet(jwksUri) {
 			...describeError(err),
 			outcome: "500 oauth configuration error"
 		});
-		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
 	}
 }
 function assertAccessTokenTyp(token, allowed) {
@@ -695,6 +740,16 @@ function oauthConfigurationErrorResponse() {
 		}
 	});
 }
+function oauthUpstreamUnreachableResponse() {
+	return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+		status: 503,
+		headers: {
+			...JSON_HEADERS,
+			"Cache-Control": "no-store",
+			"Retry-After": "30"
+		}
+	});
+}
 function parseBearerToken(request) {
 	const header = request.headers.get("Authorization");
 	if (!header) return void 0;
@@ -768,15 +823,33 @@ function createRequestAuthorizer(mcp, options = {}) {
 				auth
 			};
 		} catch (err) {
+			if (err instanceof OAuthUpstreamUnreachableError) {
+				log.error("auth.upstream_unreachable", {
+					...describeError(err),
+					stage: err.stage,
+					outcome: "503"
+				});
+				await recorder?.emit({
+					tool: null,
+					method: "authorize",
+					outcome: err.stage === "jwks" ? "auth_jwks_unreachable" : "auth_discovery_unreachable",
+					durationMs: nowMs() - startedAt
+				});
+				return {
+					ok: false,
+					response: oauthUpstreamUnreachableResponse()
+				};
+			}
 			if (err instanceof OAuthConfigurationError) {
 				log.error("auth.config_error", {
 					...describeError(err),
+					stage: err.stage,
 					outcome: "500"
 				});
 				await recorder?.emit({
 					tool: null,
 					method: "authorize",
-					outcome: "auth_config_error",
+					outcome: err.stage === "jwks" ? "auth_jwks_config_error" : "auth_discovery_config_error",
 					durationMs: nowMs() - startedAt
 				});
 				return {

package/dist/{cors-CTtLtFQR.cjs → cors-Y_FmMkXK.cjs}

@@ -1,5 +1,5 @@
 const require_logger = require("./logger-BqPOa_E1.cjs");
-const require_package = require("./package-CFrZxdHL.cjs");
+const require_package = require("./package-DtnkW7Jc.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
 //#region src/core/http.ts
@@ -315,11 +315,28 @@ function cachedPromise(load, label) {
 //#endregion
 //#region src/auth/discovery.ts
 var OAuthConfigurationError = class extends Error {
-	constructor(message) {
+	stage;
+	constructor(message, stage) {
 		super(message);
+		this.stage = stage;
 		this.name = "OAuthConfigurationError";
 	}
 };
+/** The AS never answered at the network layer — an upstream outage, not a misconfiguration. */
+var OAuthUpstreamUnreachableError = class extends Error {
+	stage;
+	constructor(message, stage) {
+		super(message);
+		this.stage = stage;
+		this.name = "OAuthUpstreamUnreachableError";
+	}
+};
+var MetadataUnreachableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MetadataUnreachableError";
+	}
+};
 const METADATA_FETCH_TIMEOUT_MS = 5e3;
 function issuerPath(url) {
 	const path = require_logger.trimTrailingSlash(url.pathname);
@@ -346,25 +363,35 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
 	for (const url of metadataUrls) try {
 		return await fetchOAuthServerMetadata(url, expectedIssuer);
 	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
 		require_logger.log.debug("oauth.discovery.attempt_failed", {
 			url,
-			...require_logger.describeError(err)
+			...require_logger.describeError(error)
 		});
-		errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+		errors.push(error);
 	}
+	const unreachable = errors.some((e) => e instanceof MetadataUnreachableError);
+	const detail = errors.map((e) => e.message).join("; ");
 	require_logger.log.error("oauth.discovery.exhausted", {
 		expectedIssuer,
 		urlsTried: metadataUrls,
-		errors
+		errors: detail,
+		unreachable
 	});
-	throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
+	const message = `failed to discover OAuth server metadata (${detail})`;
+	throw unreachable ? new MetadataUnreachableError(message) : new Error(message);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
 	require_logger.log.debug("oauth.discovery.fetch", { url });
-	const response = await fetch(url, {
-		signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
-		redirect: "manual"
-	});
+	let response;
+	try {
+		response = await fetch(url, {
+			signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
+			redirect: "manual"
+		});
+	} catch (err) {
+		throw new MetadataUnreachableError(err instanceof Error ? err.message : String(err));
+	}
 	if (!response.ok) throw new Error(String(response.status));
 	const json = await response.json();
 	if (typeof json.issuer !== "string") throw new Error("missing issuer");
@@ -388,12 +415,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 	try {
 		return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
 	} catch (err) {
+		const message = `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`;
+		if (err instanceof MetadataUnreachableError) {
+			require_logger.log.error("oauth.discovery.unreachable", {
+				issuer,
+				...require_logger.describeError(err),
+				outcome: "503 authorization server unreachable"
+			});
+			throw new OAuthUpstreamUnreachableError(message, "discovery");
+		}
 		require_logger.log.error("oauth.discovery.config_error", {
 			issuer,
 			...require_logger.describeError(err),
 			outcome: "500 oauth configuration error"
 		});
-		throw new OAuthConfigurationError(`OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`);
+		throw new OAuthConfigurationError(message, "discovery");
 	}
 }
 /** Metadata and token verification share issuer/JWKS discovery, but transient failures must not poison the runtime. */
@@ -507,11 +543,20 @@ function tokenHeaderFields(token) {
 	}
 }
 async function fetchVerificationKeySet(jwksUri) {
+	let response;
 	try {
-		const response = await fetch(jwksUri, {
+		response = await fetch(jwksUri, {
 			signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS),
 			redirect: "manual"
 		});
+	} catch (err) {
+		require_logger.log.error("oauth.jwks.unreachable", {
+			...require_logger.describeError(err),
+			outcome: "503 authorization server unreachable"
+		});
+		throw new OAuthUpstreamUnreachableError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
+	}
+	try {
 		if (!response.ok) throw new Error(`JWKS endpoint returned ${response.status}`);
 		return (0, jose.createLocalJWKSet)(await response.json());
 	} catch (err) {
@@ -519,7 +564,7 @@ async function fetchVerificationKeySet(jwksUri) {
 			...require_logger.describeError(err),
 			outcome: "500 oauth configuration error"
 		});
-		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
 	}
 }
 function assertAccessTokenTyp(token, allowed) {
@@ -695,6 +740,16 @@ function oauthConfigurationErrorResponse() {
 		}
 	});
 }
+function oauthUpstreamUnreachableResponse() {
+	return new Response(JSON.stringify({ error: "authorization server unreachable" }), {
+		status: 503,
+		headers: {
+			...JSON_HEADERS,
+			"Cache-Control": "no-store",
+			"Retry-After": "30"
+		}
+	});
+}
 function parseBearerToken(request) {
 	const header = request.headers.get("Authorization");
 	if (!header) return void 0;
@@ -768,15 +823,33 @@ function createRequestAuthorizer(mcp, options = {}) {
 				auth
 			};
 		} catch (err) {
+			if (err instanceof OAuthUpstreamUnreachableError) {
+				require_logger.log.error("auth.upstream_unreachable", {
+					...require_logger.describeError(err),
+					stage: err.stage,
+					outcome: "503"
+				});
+				await recorder?.emit({
+					tool: null,
+					method: "authorize",
+					outcome: err.stage === "jwks" ? "auth_jwks_unreachable" : "auth_discovery_unreachable",
+					durationMs: nowMs() - startedAt
+				});
+				return {
+					ok: false,
+					response: oauthUpstreamUnreachableResponse()
+				};
+			}
 			if (err instanceof OAuthConfigurationError) {
 				require_logger.log.error("auth.config_error", {
 					...require_logger.describeError(err),
+					stage: err.stage,
 					outcome: "500"
 				});
 				await recorder?.emit({
 					tool: null,
 					method: "authorize",
-					outcome: "auth_config_error",
+					outcome: err.stage === "jwks" ? "auth_jwks_config_error" : "auth_discovery_config_error",
 					durationMs: nowMs() - startedAt
 				});
 				return {

package/dist/{io-DPYvBqET.d.cts → io-BIvFmJK1.d.cts}

@@ -1,4 +1,4 @@
-import "./list-tools-B4TTPEl1.cjs";
+import "./list-tools--SBVo58Z.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-CfSPxeBN.d.ts → io-Bi7DYgft.d.ts}

@@ -1,4 +1,4 @@
-import "./list-tools-bh6-eqZM.js";
+import "./list-tools-Go45Ib1W.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{list-tools-B4TTPEl1.d.cts → list-tools--SBVo58Z.d.cts}

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "./types-BYdYYTjk.cjs";
-import { t as MetricsRecorder } from "./base-DCe0kP79.cjs";
+import { t as MetricsRecorder } from "./base-D-dYxK8t.cjs";
 import { t as McpRuntimeOptions } from "./authorize-CumVyk7p.cjs";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/{list-tools-YHIrPuuR.cjs → list-tools-BeVzrTT-.cjs}

@@ -1,4 +1,4 @@
-const require_cors = require("./cors-CTtLtFQR.cjs");
+const require_cors = require("./cors-Y_FmMkXK.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
 //#region src/protocols/rest/list-tools.ts

package/dist/{list-tools--Kx40Dg2.js → list-tools-BrSIMpBi.js}

@@ -1,4 +1,4 @@
-import { i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, p as headResponse, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-CJct3BEI.js";
+import { i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, p as headResponse, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-Ftb-tw1d.js";
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
 //#region src/protocols/rest/list-tools.ts

package/dist/{list-tools-bh6-eqZM.d.ts → list-tools-Go45Ib1W.d.ts}

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "./types-BYdYYTjk.js";
-import { t as MetricsRecorder } from "./base-DCe0kP79.js";
+import { t as MetricsRecorder } from "./base-D-dYxK8t.js";
 import { t as McpRuntimeOptions } from "./authorize-D6p4-9_D.js";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/{mcp-DzSswp-q.js → mcp-BarAJ9N0.js}

@@ -1,6 +1,6 @@
 import { i as log, r as describeError } from "./logger-2OXtfiIW.js";
 import { t as ToolContext } from "./context-CIpPzN7P.js";
-import { d as nowMs, i as createRequestAuthorizer, n as withCors, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-CJct3BEI.js";
+import { d as nowMs, i as createRequestAuthorizer, n as withCors, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-Ftb-tw1d.js";
 import { t as extractTextContent } from "./content-D5LJAHyM.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";

package/dist/{mcp-CQGMfpLc.cjs → mcp-_a39WlhN.cjs}

@@ -1,6 +1,6 @@
 const require_logger = require("./logger-BqPOa_E1.cjs");
 const require_context = require("./context-BweeEcoA.cjs");
-const require_cors = require("./cors-CTtLtFQR.cjs");
+const require_cors = require("./cors-Y_FmMkXK.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
 let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");

package/dist/{package-CFrZxdHL.cjs → package-DtnkW7Jc.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.22.2";
+var version = "0.24.0";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/{package-CLHBPGM1.js → package-DudvPdrW.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.22.2";
+var version = "0.24.0";
 //#endregion
 export { version as t };

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-CQGMfpLc.cjs");
+const require_mcp = require("../../mcp-_a39WlhN.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-BYdYYTjk.cjs";
-import { t as MetricsRecorder } from "../../base-DCe0kP79.cjs";
+import { t as MetricsRecorder } from "../../base-D-dYxK8t.cjs";
 import { t as McpRuntimeOptions } from "../../authorize-CumVyk7p.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.d.ts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-BYdYYTjk.js";
-import { t as MetricsRecorder } from "../../base-DCe0kP79.js";
+import { t as MetricsRecorder } from "../../base-D-dYxK8t.js";
 import { t as McpRuntimeOptions } from "../../authorize-D6p4-9_D.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-DzSswp-q.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BarAJ9N0.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-BqPOa_E1.cjs");
-const require_cors = require("../cors-CTtLtFQR.cjs");
+const require_cors = require("../cors-Y_FmMkXK.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return require_cors.withCors(new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-2OXtfiIW.js";
-import { a as getOAuthRuntime, c as resolveProtectedResource, f as JSON_HEADERS, m as methodNotAllowed, n as withCors, o as oauthConfigurationErrorResponse, p as headResponse, t as corsPreflightResponse } from "../cors-CJct3BEI.js";
+import { a as getOAuthRuntime, c as resolveProtectedResource, f as JSON_HEADERS, m as methodNotAllowed, n as withCors, o as oauthConfigurationErrorResponse, p as headResponse, t as corsPreflightResponse } from "../cors-Ftb-tw1d.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return withCors(new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/rest/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_list_tools = require("../../list-tools-YHIrPuuR.cjs");
-const require_rest = require("../../rest-Cp3jPs0S.cjs");
+const require_list_tools = require("../../list-tools-BeVzrTT-.cjs");
+const require_rest = require("../../rest-C9kWgxK5.cjs");
 exports.createInvokeToolHandler = require_rest.createInvokeToolHandler;
 exports.createListToolsHandler = require_list_tools.createListToolsHandler;

package/dist/protocols/rest/index.d.cts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-BYdYYTjk.cjs";
-import { t as MetricsRecorder } from "../../base-DCe0kP79.cjs";
+import { t as MetricsRecorder } from "../../base-D-dYxK8t.cjs";
 import { t as McpRuntimeOptions } from "../../authorize-CumVyk7p.cjs";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-B4TTPEl1.cjs";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools--SBVo58Z.cjs";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.d.ts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-BYdYYTjk.js";
-import { t as MetricsRecorder } from "../../base-DCe0kP79.js";
+import { t as MetricsRecorder } from "../../base-D-dYxK8t.js";
 import { t as McpRuntimeOptions } from "../../authorize-D6p4-9_D.js";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-bh6-eqZM.js";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-Go45Ib1W.js";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.js

@@ -1,3 +1,3 @@
-import { n as createListToolsHandler } from "../../list-tools--Kx40Dg2.js";
-import { t as createInvokeToolHandler } from "../../rest-BVBQmkWy.js";
+import { n as createListToolsHandler } from "../../list-tools-BrSIMpBi.js";
+import { t as createInvokeToolHandler } from "../../rest-Be8uOb6r.js";
 export { createInvokeToolHandler, createListToolsHandler };

package/dist/{rest-BVBQmkWy.js → rest-Be8uOb6r.js}

@@ -1,7 +1,7 @@
 import { t as ToolContext } from "./context-CIpPzN7P.js";
-import { d as nowMs, f as JSON_HEADERS, i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-CJct3BEI.js";
+import { d as nowMs, f as JSON_HEADERS, i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-Ftb-tw1d.js";
 import { t as extractTextContent } from "./content-D5LJAHyM.js";
-import "./list-tools--Kx40Dg2.js";
+import "./list-tools-BrSIMpBi.js";
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;

package/dist/{rest-Cp3jPs0S.cjs → rest-C9kWgxK5.cjs}

@@ -1,7 +1,7 @@
 const require_context = require("./context-BweeEcoA.cjs");
-const require_cors = require("./cors-CTtLtFQR.cjs");
+const require_cors = require("./cors-Y_FmMkXK.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
-require("./list-tools-YHIrPuuR.cjs");
+require("./list-tools-BeVzrTT-.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;

package/dist/stacks/supabase/index.cjs

@@ -1,11 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-BqPOa_E1.cjs");
-const require_cors = require("../../cors-CTtLtFQR.cjs");
+const require_cors = require("../../cors-Y_FmMkXK.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CQGMfpLc.cjs");
+const require_mcp = require("../../mcp-_a39WlhN.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-YHIrPuuR.cjs");
-const require_rest = require("../../rest-Cp3jPs0S.cjs");
+const require_list_tools = require("../../list-tools-BeVzrTT-.cjs");
+const require_rest = require("../../rest-C9kWgxK5.cjs");
 const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts

package/dist/stacks/supabase/index.js

@@ -1,10 +1,10 @@
 import { s as trimTrailingSlash } from "../../logger-2OXtfiIW.js";
-import { l as createRecorderForRuntime, s as assertResourcePathShape } from "../../cors-CJct3BEI.js";
+import { l as createRecorderForRuntime, s as assertResourcePathShape } from "../../cors-Ftb-tw1d.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DzSswp-q.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BarAJ9N0.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools--Kx40Dg2.js";
-import { t as createInvokeToolHandler } from "../../rest-BVBQmkWy.js";
+import { n as createListToolsHandler } from "../../list-tools-BrSIMpBi.js";
+import { t as createInvokeToolHandler } from "../../rest-Be8uOb6r.js";
 import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts

package/dist/stacks/supabase/vite.cjs

@@ -2,8 +2,9 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-CFrZxdHL.cjs");
+const require_package = require("../../package-DtnkW7Jc.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
+const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -195,7 +196,7 @@ function normalizePath(p) {
 	return p.split(node_path.sep).join("/");
 }
 function productionImportMetaEnv(config) {
-	return {
+	const env = {
 		...(0, vite.loadEnv)("production", config.envDir, config.envPrefix),
 		MODE: "production",
 		BASE_URL: config.base ?? "/",
@@ -203,6 +204,11 @@ function productionImportMetaEnv(config) {
 		PROD: true,
 		SSR: false
 	};
+	if (!env.VITE_SUPABASE_PROJECT_ID) {
+		const ref = require_supabase_config.readSupabaseProjectRef(config.root);
+		if (ref) env.VITE_SUPABASE_PROJECT_ID = ref;
+	}
+	return env;
 }
 /**
 * Vite plugin that emits the Supabase Edge Function entry (and its

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-DPYvBqET.cjs";
+import { t as McpPluginApi } from "../../io-BIvFmJK1.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-CfSPxeBN.js";
+import { t as McpPluginApi } from "../../io-Bi7DYgft.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,5 +1,6 @@
-import { t as version } from "../../package-CLHBPGM1.js";
+import { t as version } from "../../package-DudvPdrW.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
+import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 import { lstatSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
@@ -191,7 +192,7 @@ function normalizePath(p) {
 	return p.split(sep).join("/");
 }
 function productionImportMetaEnv(config) {
-	return {
+	const env = {
 		...loadEnv("production", config.envDir, config.envPrefix),
 		MODE: "production",
 		BASE_URL: config.base ?? "/",
@@ -199,6 +200,11 @@ function productionImportMetaEnv(config) {
 		PROD: true,
 		SSR: false
 	};
+	if (!env.VITE_SUPABASE_PROJECT_ID) {
+		const ref = readSupabaseProjectRef(config.root);
+		if (ref) env.VITE_SUPABASE_PROJECT_ID = ref;
+	}
+	return env;
 }
 /**
 * Vite plugin that emits the Supabase Edge Function entry (and its

package/dist/stacks/tanstack/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-CTtLtFQR.cjs");
-const require_mcp = require("../../mcp-CQGMfpLc.cjs");
+const require_cors = require("../../cors-Y_FmMkXK.cjs");
+const require_mcp = require("../../mcp-_a39WlhN.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-YHIrPuuR.cjs");
-const require_rest = require("../../rest-Cp3jPs0S.cjs");
+const require_list_tools = require("../../list-tools-BeVzrTT-.cjs");
+const require_rest = require("../../rest-C9kWgxK5.cjs");
 const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";

package/dist/stacks/tanstack/index.js

@@ -1,8 +1,8 @@
-import { l as createRecorderForRuntime } from "../../cors-CJct3BEI.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DzSswp-q.js";
+import { l as createRecorderForRuntime } from "../../cors-Ftb-tw1d.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BarAJ9N0.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools--Kx40Dg2.js";
-import { t as createInvokeToolHandler } from "../../rest-BVBQmkWy.js";
+import { n as createListToolsHandler } from "../../list-tools-BrSIMpBi.js";
+import { t as createInvokeToolHandler } from "../../rest-Be8uOb6r.js";
 import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";

package/dist/stacks/tanstack/vite.cjs

@@ -4,9 +4,12 @@ Object.defineProperties(exports, {
 });
 require("../../metadata-path-zd7NSNoa.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
+const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
+let vite = require("vite");
 //#region src/stacks/tanstack/vite.ts
+const SUPABASE_PROJECT_REF_ENV = "VITE_SUPABASE_PROJECT_ID";
 const GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js — do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
 function normalizePath(p) {
 	return p.split(node_path.sep).join("/");
@@ -241,6 +244,13 @@ function mcpPlugin(options = {}) {
 				return urlPath;
 			}
 		},
+		config(userConfig, { mode }) {
+			const root = userConfig.root ? (0, node_path.resolve)(userConfig.root) : process.cwd();
+			if ((0, vite.loadEnv)(mode, typeof userConfig.envDir === "string" ? (0, node_path.resolve)(root, userConfig.envDir) : root, userConfig.envPrefix ?? "VITE_")[SUPABASE_PROJECT_REF_ENV]) return;
+			const ref = require_supabase_config.readSupabaseProjectRef(root);
+			if (!ref) return;
+			return { define: { [`import.meta.env.${SUPABASE_PROJECT_REF_ENV}`]: JSON.stringify(ref) } };
+		},
 		configResolved(config) {
 			projectRoot = config.root;
 			mcpEntry = (0, node_path.resolve)(projectRoot, mcpEntryOption);

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-DPYvBqET.cjs";
+import { t as McpPluginApi } from "../../io-BIvFmJK1.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-CfSPxeBN.js";
+import { t as McpPluginApi } from "../../io-Bi7DYgft.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.js

@@ -1,8 +1,11 @@
 import "../../metadata-path-CAkNcfyY.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
+import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { lstatSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
+import { loadEnv } from "vite";
 //#region src/stacks/tanstack/vite.ts
+const SUPABASE_PROJECT_REF_ENV = "VITE_SUPABASE_PROJECT_ID";
 const GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js — do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
 function normalizePath(p) {
 	return p.split(sep).join("/");
@@ -237,6 +240,13 @@ function mcpPlugin(options = {}) {
 				return urlPath;
 			}
 		},
+		config(userConfig, { mode }) {
+			const root = userConfig.root ? resolve(userConfig.root) : process.cwd();
+			if (loadEnv(mode, typeof userConfig.envDir === "string" ? resolve(root, userConfig.envDir) : root, userConfig.envPrefix ?? "VITE_")[SUPABASE_PROJECT_REF_ENV]) return;
+			const ref = readSupabaseProjectRef(root);
+			if (!ref) return;
+			return { define: { [`import.meta.env.${SUPABASE_PROJECT_REF_ENV}`]: JSON.stringify(ref) } };
+		},
 		configResolved(config) {
 			projectRoot = config.root;
 			mcpEntry = resolve(projectRoot, mcpEntryOption);

package/dist/supabase-config-CakTU8YF.js

@@ -0,0 +1,26 @@
+import { t as isFileMissing } from "./fs-errors-PA2t1TIp.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/core/supabase-config.ts
+const SUPABASE_CONFIG_RELATIVE_PATH = "supabase/config.toml";
+function readSupabaseProjectRef(projectRoot) {
+	let content;
+	try {
+		content = readFileSync(join(projectRoot, SUPABASE_CONFIG_RELATIVE_PATH), "utf8");
+	} catch (err) {
+		if (isFileMissing(err)) return void 0;
+		throw err;
+	}
+	for (const raw of content.split(/\r?\n/)) {
+		const line = raw.trim();
+		if (line.length === 0 || line.startsWith("#")) continue;
+		if (line.startsWith("[")) break;
+		const match = /^project_id\s*=\s*(?:"([^"]*)"|'([^']*)')/.exec(line);
+		if (match) {
+			const value = match[1] ?? match[2] ?? "";
+			return value.length > 0 ? value : void 0;
+		}
+	}
+}
+//#endregion
+export { readSupabaseProjectRef as t };

package/dist/supabase-config-Dz7dnUv0.cjs

@@ -0,0 +1,31 @@
+const require_fs_errors = require("./fs-errors-CWNzOV75.cjs");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+//#region src/core/supabase-config.ts
+const SUPABASE_CONFIG_RELATIVE_PATH = "supabase/config.toml";
+function readSupabaseProjectRef(projectRoot) {
+	let content;
+	try {
+		content = (0, node_fs.readFileSync)((0, node_path.join)(projectRoot, SUPABASE_CONFIG_RELATIVE_PATH), "utf8");
+	} catch (err) {
+		if (require_fs_errors.isFileMissing(err)) return void 0;
+		throw err;
+	}
+	for (const raw of content.split(/\r?\n/)) {
+		const line = raw.trim();
+		if (line.length === 0 || line.startsWith("#")) continue;
+		if (line.startsWith("[")) break;
+		const match = /^project_id\s*=\s*(?:"([^"]*)"|'([^']*)')/.exec(line);
+		if (match) {
+			const value = match[1] ?? match[2] ?? "";
+			return value.length > 0 ? value : void 0;
+		}
+	}
+}
+//#endregion
+Object.defineProperty(exports, "readSupabaseProjectRef", {
+	enumerable: true,
+	get: function() {
+		return readSupabaseProjectRef;
+	}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.22.2",
+  "version": "0.24.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {
@@ -127,7 +127,7 @@
     "@types/node": "22.13.13",
     "rimraf": "^5.0.0",
     "tsdown": "^0.22.5",
-    "typescript": "^5.9.3",
+    "typescript": "7.0.2",
     "vite": "^7.3.1",
     "vitest": "^4.1.5",
     "zod": "^4.1.13"