@lovable.dev/mcp-js 0.26.2 → 0.27.0

package/dist/{authorize-D3zzoTAG.d.cts → authorize-BcNuNPtP.d.cts}

@@ -17,11 +17,23 @@ interface McpRuntimeOptions {
   metadataPath?: string;
   /**
    * Derive the request origin (and thus the advertised `resource`/metadata URLs)
-   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
-   * this before invoking the handler, so the OAuth runtime never sees it; safe
-   * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters
+   * apply the URL rewrite before invoking the handler (see `core/forwarded.ts`);
+   * the metadata handler reads the flag only to extend `Vary`.
    */
   trustForwardedHost?: boolean;
+  /**
+   * Same as `trustForwardedHost` for `X-Forwarded-Proto`; the Supabase adapter
+   * always sets it because the gateway stamps that header.
+   */
+  trustForwardedProto?: boolean;
+  /**
+   * @internal Attests that a proxy the deployer controls overwrites
+   * `X-Forwarded-Host`; set by the TanStack Vite plugin's emitted metadata
+   * route. Setting it yourself takes responsibility for that proxy — it
+   * silences the unpinned-resource warning, nothing else.
+   */
+  forwardedHostTrustedByPlatform?: boolean;
 }
 //#endregion
 export { McpRuntimeOptions as t };

package/dist/{authorize-Y6Jm8GhR.d.ts → authorize-Cs1yyLrq.d.ts}

@@ -17,11 +17,23 @@ interface McpRuntimeOptions {
   metadataPath?: string;
   /**
    * Derive the request origin (and thus the advertised `resource`/metadata URLs)
-   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
-   * this before invoking the handler, so the OAuth runtime never sees it; safe
-   * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+   * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters
+   * apply the URL rewrite before invoking the handler (see `core/forwarded.ts`);
+   * the metadata handler reads the flag only to extend `Vary`.
    */
   trustForwardedHost?: boolean;
+  /**
+   * Same as `trustForwardedHost` for `X-Forwarded-Proto`; the Supabase adapter
+   * always sets it because the gateway stamps that header.
+   */
+  trustForwardedProto?: boolean;
+  /**
+   * @internal Attests that a proxy the deployer controls overwrites
+   * `X-Forwarded-Host`; set by the TanStack Vite plugin's emitted metadata
+   * route. Setting it yourself takes responsibility for that proxy — it
+   * silences the unpinned-resource warning, nothing else.
+   */
+  forwardedHostTrustedByPlatform?: boolean;
 }
 //#endregion
 export { McpRuntimeOptions as t };

package/dist/{cors-DPRJFY-U.cjs → authorize-FZydvyMU.cjs}

@@ -1,7 +1,28 @@
-const require_logger = require("./logger-BSKbuM66.cjs");
-const require_package = require("./package-CBvVzH3w.cjs");
+const require_logger = require("./logger-BkMMCFTv.cjs");
+const require_package = require("./package-9XZJumh0.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+/** Add permissive CORS to a built response, preserving its other headers. */
+function withCors(response) {
+	response.headers.set("Access-Control-Allow-Origin", "*");
+	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	return response;
+}
+function corsPreflightResponse(allowMethods) {
+	return new Response(null, {
+		status: 204,
+		headers: {
+			"Access-Control-Allow-Origin": "*",
+			"Access-Control-Allow-Methods": allowMethods,
+			"Access-Control-Allow-Headers": ALLOW_HEADERS,
+			"Access-Control-Max-Age": "86400"
+		}
+	});
+}
+//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -12,12 +33,16 @@ function headResponse(response) {
 		headers: response.headers
 	});
 }
+function finalizeWireResponse(request, response) {
+	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+}
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
 		status: 405,
 		headers: {
 			...JSON_HEADERS,
-			Allow: allow
+			Allow: allow,
+			"Cache-Control": "no-store"
 		}
 	});
 }
@@ -766,7 +791,10 @@ function getOAuthRuntime(mcp, options = {}) {
 	if (options.metadataPath !== void 0) assertResourcePathShape(options.metadataPath, "metadataPath");
 	const stableOptions = {
 		resourcePath: options.resourcePath,
-		metadataPath: options.metadataPath
+		metadataPath: options.metadataPath,
+		trustForwardedHost: options.trustForwardedHost,
+		trustForwardedProto: options.trustForwardedProto,
+		forwardedHostTrustedByPlatform: options.forwardedHostTrustedByPlatform
 	};
 	const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
 	if (!auth) return {
@@ -880,27 +908,6 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 Object.defineProperty(exports, "JSON_HEADERS", {
 	enumerable: true,
 	get: function() {
@@ -943,16 +950,16 @@ Object.defineProperty(exports, "createRequestAuthorizer", {
 		return createRequestAuthorizer;
 	}
 });
-Object.defineProperty(exports, "getOAuthRuntime", {
+Object.defineProperty(exports, "finalizeWireResponse", {
 	enumerable: true,
 	get: function() {
-		return getOAuthRuntime;
+		return finalizeWireResponse;
 	}
 });
-Object.defineProperty(exports, "headResponse", {
+Object.defineProperty(exports, "getOAuthRuntime", {
 	enumerable: true,
 	get: function() {
-		return headResponse;
+		return getOAuthRuntime;
 	}
 });
 Object.defineProperty(exports, "methodNotAllowed", {
@@ -979,9 +986,3 @@ Object.defineProperty(exports, "resolveProtectedResource", {
 		return resolveProtectedResource;
 	}
 });
-Object.defineProperty(exports, "withCors", {
-	enumerable: true,
-	get: function() {
-		return withCors;
-	}
-});

package/dist/{cors-DnU41czH.js → authorize-KzrdWb2-.js}

@@ -1,7 +1,28 @@
-import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-3-kwsF-5.js";
-import { t as version } from "./package-Bbg8XwRW.js";
+import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-rGakBvJ1.js";
+import { t as version } from "./package-BmhaKMyb.js";
 import "./metadata-path-CAkNcfyY.js";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+/** Add permissive CORS to a built response, preserving its other headers. */
+function withCors(response) {
+	response.headers.set("Access-Control-Allow-Origin", "*");
+	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	return response;
+}
+function corsPreflightResponse(allowMethods) {
+	return new Response(null, {
+		status: 204,
+		headers: {
+			"Access-Control-Allow-Origin": "*",
+			"Access-Control-Allow-Methods": allowMethods,
+			"Access-Control-Allow-Headers": ALLOW_HEADERS,
+			"Access-Control-Max-Age": "86400"
+		}
+	});
+}
+//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -12,12 +33,16 @@ function headResponse(response) {
 		headers: response.headers
 	});
 }
+function finalizeWireResponse(request, response) {
+	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+}
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
 		status: 405,
 		headers: {
 			...JSON_HEADERS,
-			Allow: allow
+			Allow: allow,
+			"Cache-Control": "no-store"
 		}
 	});
 }
@@ -766,7 +791,10 @@ function getOAuthRuntime(mcp, options = {}) {
 	if (options.metadataPath !== void 0) assertResourcePathShape(options.metadataPath, "metadataPath");
 	const stableOptions = {
 		resourcePath: options.resourcePath,
-		metadataPath: options.metadataPath
+		metadataPath: options.metadataPath,
+		trustForwardedHost: options.trustForwardedHost,
+		trustForwardedProto: options.trustForwardedProto,
+		forwardedHostTrustedByPlatform: options.forwardedHostTrustedByPlatform
 	};
 	const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
 	if (!auth) return {
@@ -880,25 +908,4 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
-export { getOAuthRuntime as a, resolveProtectedResource as c, nowMs as d, JSON_HEADERS as f, createRequestAuthorizer as i, createRecorderForRuntime as l, methodNotAllowed as m, withCors as n, oauthConfigurationErrorResponse as o, headResponse as p, assertRestResourceBinding as r, assertResourcePathShape as s, corsPreflightResponse as t, createNoopRecorder as u };
+export { assertResourcePathShape as a, createNoopRecorder as c, finalizeWireResponse as d, methodNotAllowed as f, oauthConfigurationErrorResponse as i, nowMs as l, createRequestAuthorizer as n, resolveProtectedResource as o, corsPreflightResponse as p, getOAuthRuntime as r, createRecorderForRuntime as s, assertRestResourceBinding as t, JSON_HEADERS as u };

package/dist/cli/extract-manifest.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_package = require("../package-CBvVzH3w.cjs");
-const require_list_tools = require("../list-tools-ka32VIXt.cjs");
+const require_package = require("../package-9XZJumh0.cjs");
+const require_list_tools = require("../list-tools-DDhzQZRL.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/cli/extract-manifest.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-Bbg8XwRW.js";
-import { t as buildMcpListing } from "../list-tools-DCs034XG.js";
+import { t as version } from "../package-BmhaKMyb.js";
+import { t as buildMcpListing } from "../list-tools-CCGzOMpC.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{forwarded-Pi8Hs5Ps.cjs → forwarded-Bhwcj22u.cjs}

@@ -16,8 +16,8 @@
 *   bare SDK consumer.
 * - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
 *   Supabase terminates TLS upstream and forwards over http with a
-*   gateway-stamped proto, so that stack trusts it; the TanStack proxy does not
-*   sanitize proto, so that stack leaves it alone.
+*   gateway-stamped proto, so that stack always trusts it; the TanStack proxy
+*   does not sanitize proto, so its Vite plugin never emits the flag.
 */
 function applyForwardedOrigin(request, options) {
 	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;

package/dist/{forwarded--h4efJy-.js → forwarded-BlLF3dfc.js}

@@ -16,8 +16,8 @@
 *   bare SDK consumer.
 * - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
 *   Supabase terminates TLS upstream and forwards over http with a
-*   gateway-stamped proto, so that stack trusts it; the TanStack proxy does not
-*   sanitize proto, so that stack leaves it alone.
+*   gateway-stamped proto, so that stack always trusts it; the TanStack proxy
+*   does not sanitize proto, so its Vite plugin never emits the flag.
 */
 function applyForwardedOrigin(request, options) {
 	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;

package/dist/gate-Blmxv8t2.cjs

@@ -0,0 +1,24 @@
+const require_authorize = require("./authorize-FZydvyMU.cjs");
+//#region src/protocols/gate.ts
+function createGatedHandler(gate) {
+	const allow = [...gate.methods, "OPTIONS"].join(", ");
+	const respond = async (request, recorder, ...extra) => {
+		const authResult = await gate.authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
+		return gate.handle(request, authResult, recorder, ...extra);
+	};
+	return async (request, recorder = require_authorize.createNoopRecorder(), ...extra) => {
+		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse(allow);
+		const final = require_authorize.finalizeWireResponse(request, await respond(request, recorder, ...extra));
+		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
+		return final;
+	};
+}
+//#endregion
+Object.defineProperty(exports, "createGatedHandler", {
+	enumerable: true,
+	get: function() {
+		return createGatedHandler;
+	}
+});

package/dist/gate-Cclvf6xn.js

@@ -0,0 +1,19 @@
+import { c as createNoopRecorder, d as finalizeWireResponse, p as corsPreflightResponse } from "./authorize-KzrdWb2-.js";
+//#region src/protocols/gate.ts
+function createGatedHandler(gate) {
+	const allow = [...gate.methods, "OPTIONS"].join(", ");
+	const respond = async (request, recorder, ...extra) => {
+		const authResult = await gate.authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
+		return gate.handle(request, authResult, recorder, ...extra);
+	};
+	return async (request, recorder = createNoopRecorder(), ...extra) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse(allow);
+		const final = finalizeWireResponse(request, await respond(request, recorder, ...extra));
+		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
+		return final;
+	};
+}
+//#endregion
+export { createGatedHandler as t };

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("./logger-BSKbuM66.cjs");
+const require_logger = require("./logger-BkMMCFTv.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {

package/dist/index.d.cts

@@ -67,7 +67,8 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  * Set the runtime log level programmatically. Use this when the deployment can't
  * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
  * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+ * @returns the previous level, so a scoped override can restore it.
  */
-declare function setLogLevel(level: LogLevel): void;
+declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
 export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.d.ts

@@ -67,7 +67,8 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  * Set the runtime log level programmatically. Use this when the deployment can't
  * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
  * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+ * @returns the previous level, so a scoped override can restore it.
  */
-declare function setLogLevel(level: LogLevel): void;
+declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
 export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-3-kwsF-5.js";
+import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-rGakBvJ1.js";
 import { i as ToolContext, t as ToolError } from "./errors-DSe96Ffd.js";
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {

package/dist/{io-B-fV6rsM.d.ts → io--MeYrWG7.d.ts}

@@ -1,4 +1,4 @@
-import "./list-tools-C6u8G4iq.js";
+import "./list-tools-Bku6XkVc.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-Bd58IeVb.d.cts → io-BzTGjG_c.d.cts}

@@ -1,4 +1,4 @@
-import "./list-tools-DOBMd4AE.cjs";
+import "./list-tools-Cn7tpE0V.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{list-tools-C6u8G4iq.d.ts → list-tools-Bku6XkVc.d.ts}

@@ -1,6 +1,6 @@
 import { c as McpDefinition } from "./types-C0Wgm9zp.js";
 import { t as MetricsRecorder } from "./base-CReh7d3E.js";
-import { t as McpRuntimeOptions } from "./authorize-Y6Jm8GhR.js";
+import { t as McpRuntimeOptions } from "./authorize-Cs1yyLrq.js";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;

package/dist/{list-tools-DCs034XG.js → list-tools-CCGzOMpC.js}

@@ -1,4 +1,5 @@
-import { i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, p as headResponse, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-DnU41czH.js";
+import { f as methodNotAllowed, n as createRequestAuthorizer, t as assertRestResourceBinding } from "./authorize-KzrdWb2-.js";
+import { t as createGatedHandler } from "./gate-Cclvf6xn.js";
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
 //#region src/protocols/rest/list-tools.ts
@@ -29,18 +30,12 @@ function buildMcpListing(mcp) {
 }
 function createListToolsHandler(mcp, options = {}) {
 	assertRestResourceBinding(mcp, options);
-	const authorizer = createRequestAuthorizer(mcp, options);
-	const handle = async (request, recorder) => {
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
-		if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed("GET, HEAD, OPTIONS");
-		const response = Response.json(buildMcpListing(mcp));
-		return request.method === "HEAD" ? headResponse(response) : response;
-	};
-	return async (request, recorder = createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
-		return withCors(await handle(request, recorder));
-	};
+	return createGatedHandler({
+		authorizer: createRequestAuthorizer(mcp, options),
+		methods: ["GET", "HEAD"],
+		methodNotAllowed,
+		handle: async () => Response.json(buildMcpListing(mcp))
+	});
 }
 //#endregion
 export { createListToolsHandler as n, buildMcpListing as t };

package/dist/{list-tools-DOBMd4AE.d.cts → list-tools-Cn7tpE0V.d.cts}

@@ -1,6 +1,6 @@
 import { c as McpDefinition } from "./types-C0Wgm9zp.cjs";
 import { t as MetricsRecorder } from "./base-CReh7d3E.cjs";
-import { t as McpRuntimeOptions } from "./authorize-D3zzoTAG.cjs";
+import { t as McpRuntimeOptions } from "./authorize-BcNuNPtP.cjs";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;

package/dist/{list-tools-ka32VIXt.cjs → list-tools-DDhzQZRL.cjs}

@@ -1,4 +1,5 @@
-const require_cors = require("./cors-DPRJFY-U.cjs");
+const require_authorize = require("./authorize-FZydvyMU.cjs");
+const require_gate = require("./gate-Blmxv8t2.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
 //#region src/protocols/rest/list-tools.ts
@@ -28,19 +29,13 @@ function buildMcpListing(mcp) {
 	};
 }
 function createListToolsHandler(mcp, options = {}) {
-	require_cors.assertRestResourceBinding(mcp, options);
-	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
-	const handle = async (request, recorder) => {
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
-		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
-		const response = Response.json(buildMcpListing(mcp));
-		return request.method === "HEAD" ? require_cors.headResponse(response) : response;
-	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse("GET, HEAD, OPTIONS");
-		return require_cors.withCors(await handle(request, recorder));
-	};
+	require_authorize.assertRestResourceBinding(mcp, options);
+	return require_gate.createGatedHandler({
+		authorizer: require_authorize.createRequestAuthorizer(mcp, options),
+		methods: ["GET", "HEAD"],
+		methodNotAllowed: require_authorize.methodNotAllowed,
+		handle: async () => Response.json(buildMcpListing(mcp))
+	});
 }
 //#endregion
 Object.defineProperty(exports, "buildMcpListing", {

package/dist/{logger-BSKbuM66.cjs → logger-BkMMCFTv.cjs}

@@ -95,9 +95,12 @@ let currentLevel = readEnvLevel() ?? "debug";
 * Set the runtime log level programmatically. Use this when the deployment can't
 * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
 * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+* @returns the previous level, so a scoped override can restore it.
 */
 function setLogLevel(level) {
+	const previous = currentLevel;
 	currentLevel = level;
+	return previous;
 }
 /** Parse an env value into a LogLevel, or undefined if it names no valid level. */
 function parseLogLevel(raw) {

package/dist/{logger-3-kwsF-5.js → logger-rGakBvJ1.js}

@@ -95,9 +95,12 @@ let currentLevel = readEnvLevel() ?? "debug";
 * Set the runtime log level programmatically. Use this when the deployment can't
 * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
 * passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+* @returns the previous level, so a scoped override can restore it.
 */
 function setLogLevel(level) {
+	const previous = currentLevel;
 	currentLevel = level;
+	return previous;
 }
 /** Parse an env value into a LogLevel, or undefined if it names no valid level. */
 function parseLogLevel(raw) {

package/dist/{mcp-C9fh9I8u.cjs → mcp-BLYbUCO5.cjs}

@@ -1,12 +1,12 @@
-const require_logger = require("./logger-BSKbuM66.cjs");
+const require_logger = require("./logger-BkMMCFTv.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_cors = require("./cors-DPRJFY-U.cjs");
+const require_authorize = require("./authorize-FZydvyMU.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
+const require_gate = require("./gate-Blmxv8t2.cjs");
 let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
 //#region src/protocols/mcp/protocol.ts
-const STATELESS_ALLOW_METHODS = "POST, OPTIONS";
-function statelessMethodNotAllowed() {
+function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
 		id: null,
@@ -16,7 +16,7 @@ function statelessMethodNotAllowed() {
 		}
 	}, {
 		status: 405,
-		headers: { Allow: STATELESS_ALLOW_METHODS }
+		headers: { Allow: allow }
 	});
 }
 /**
@@ -27,7 +27,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 	const endUserId = auth?.principal.sub;
 	return (async (first) => {
 		const args = tool.inputSchema ? first ?? {} : {};
-		const start = require_cors.nowMs();
+		const start = require_authorize.nowMs();
 		let result;
 		try {
 			result = await tool.handler(args, new require_errors.ToolContext(auth));
@@ -38,7 +38,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 					tool: tool.name,
 					method: "tools/call",
 					outcome: "handler_error",
-					durationMs: require_cors.nowMs() - start,
+					durationMs: require_authorize.nowMs() - start,
 					errorText: require_errors.errorSummary(err),
 					endUserId
 				});
@@ -63,7 +63,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 				tool: tool.name,
 				method: "tools/call",
 				outcome: "handler_error",
-				durationMs: require_cors.nowMs() - start,
+				durationMs: require_authorize.nowMs() - start,
 				endUserId
 			});
 			return {
@@ -78,7 +78,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
-			durationMs: require_cors.nowMs() - start,
+			durationMs: require_authorize.nowMs() - start,
 			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
 			endUserId
 		});
@@ -97,10 +97,8 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 * caller (the stack handler) so telemetry reads the runtime env in-flight.
 */
 function createMcpProtocolHandler(mcp, options = {}) {
-	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
-	const handle = async (request, recorder) => {
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
+	const authorizer = require_authorize.createRequestAuthorizer(mcp, options);
+	const handle = async (request, authResult, recorder) => {
 		try {
 			const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
 				name: mcp.name,
@@ -139,11 +137,12 @@ function createMcpProtocolHandler(mcp, options = {}) {
 			}, { status: 500 });
 		}
 	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse(STATELESS_ALLOW_METHODS);
-		if (request.method !== "POST") return require_cors.withCors(statelessMethodNotAllowed());
-		return require_cors.withCors(await handle(request, recorder));
-	};
+	return require_gate.createGatedHandler({
+		authorizer,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
 }
 //#endregion
 Object.defineProperty(exports, "createMcpProtocolHandler", {