@lovable.dev/mcp-js 0.27.1 → 0.29.0-rc.0

package/README.md

@@ -51,7 +51,13 @@ That's the whole authoring surface. No imperative server construction, no route
 
 The table shows the default `path: "/mcp"`. The REST companions co-locate under the parent of the configured `path`, so `mcpPlugin({ path: "/api/public/mcp" })` emits them at `/api/public/.mcp/list-tools` and `/api/public/.mcp/invoke-tool/<tool>` (file: `src/routes/api/public/[.mcp]/...`). Pass `restRoutes: false` to drop them.
 
-MCP (`POST <path>`, `/mcp` by default) is the public wire format clients speak directly. REST (the `.mcp/*` companions, co-located under the `path` parent) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth policy protects them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. CORS and rate limiting still belong at the app host or edge.
+MCP (`POST <path>`, `/mcp` by default) is the public wire format clients speak directly. REST (the `.mcp/*` companions, co-located under the `path` parent) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth and browser-origin policies protect them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. Rate limiting belongs at the app host or edge.
+
+The MCP endpoint supports both protocol eras on one URL. Finalized `2026-07-28` clients send the version, client capabilities, and mirrored HTTP headers on every request; the server returns typed results plus cache metadata on discovery and list responses without initialization or protocol sessions. Initialization-era clients continue through a stateless compatibility path: `initialize`, `tools/list`, and `tools/call` work as independent requests, and the endpoint never mints `Mcp-Session-Id`. `GET` and `DELETE` return `405` because there is no standalone stream or session to manage.
+
+`outputSchema` accepts either the existing object-shape shorthand (`{ value: z.string() }`) or a JSON-Schema-representable Zod schema such as `z.array(z.string())`; `structuredContent` may be any JSON value. The server returns the schema's parsed output, so coercions are reflected in the result; transforms with no truthful JSON Schema are rejected when `defineMcp` runs. Modern clients receive the natural schema and value. The compatibility path wraps non-object schemas and values under `result` for initialization-era clients whose wire format requires an object root.
+
+Browser-origin checks apply to the MCP, REST companion, and OAuth metadata routes before authentication. Omit `allowedOrigins` to allow requests with no `Origin` header (Go, desktop, CLI, and server clients) plus same-origin browser requests. Set `allowedOrigins: ["https://client.example.com"]` for exact additional origins, or `allowedOrigins: "any"` to intentionally restore wildcard CORS. Exact and same origins are reflected with `Vary: Origin`; other browser origins receive `403` without an OAuth challenge. Reverse-proxy adapters compare against the effective public origin after applying only their configured trusted forwarded headers.
 
 The OAuth metadata route is emitted by default and returns `404` until OAuth auth is configured. Disable it with `mcpPlugin({ protectedResourceMetadataRoute: false })` only if the app owns `/.well-known/oauth-protected-resource` itself.
 
@@ -211,7 +217,7 @@ Use `auth.oauth.issuer(...)`, set `resource` or `acceptedAudiences` to anchor th
 
 ## Debug logging
 
-The runtime is silent by default. Raise the log level to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token, full claims, or PII** — only non-secret fields such as the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, the token `sub`/`client_id`/`scopes`, and `jose` error codes.
+The runtime logs operational events (tool invocations, auth outcomes, warnings, errors) at `info` by default. Raise the level to `debug` to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token, full claims, or PII** — only non-secret fields such as the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, the token `scopes`, and `jose` error codes. End-user identifiers (the token `sub`/`client_id`) appear only at `debug`, as the `oauth.verify.principal` event — the default `info` level never collects them.
 
 Enable it either way:
 
@@ -222,17 +228,17 @@ setLogLevel("debug"); // "silent" | "error" | "warn" | "info" | "debug"
 ```
 
 ```bash
-# Or via env var, read once at startup. Node/Deno only: it reads `process.env`,
-# which is absent on a deployed Cloudflare Worker (env arrives via bindings), so
-# the var is silently ignored there — use `setLogLevel()` on Workers.
+# Or via env var. Node reads it at startup; on Deno and Cloudflare Workers the
+# recorder applies it at the first request's telemetry emit, so logs before that
+# point may not honor it — prefer `setLogLevel()` there.
 LOVABLE_MCP_LOG_LEVEL=debug
 ```
 
-A `500` on an OAuth-protected route is always one of two causes, logged at `error`: an `OAuthConfigurationError` from issuer-metadata discovery or a JWKS *fetch* failure (`oauth.discovery.config_error` / `oauth.jwks.fetch_failed` → `auth.config_error`), or a transport-level fault in the MCP handler (`mcp.transport_error`). Auth outcomes are logged at `info`: a granted request as `oauth.verify.ok`, and a `401`/`403` as `auth.token_rejected` (with the `jose` reason) or `auth.no_bearer_token` — so a request rejected for insufficient scope shows both `oauth.verify.ok` and the `auth.token_rejected` that follows it.
+A `500` on an OAuth-protected route is always one of two causes, logged at `error`: an `OAuthConfigurationError` from issuer-metadata discovery or a JWKS *fetch* failure (`oauth.discovery.config_error` / `oauth.jwks.fetch_failed` → `auth.config_error`), or a transport-level fault in the MCP handler (`mcp.transport_error`). Auth outcomes are logged at `info`: a granted request as `oauth.verify.ok`, a request with no parseable bearer as `auth.no_bearer_token`, and a rejected token as `auth.token_rejected` (a `jose` rejection such as an expired token carries the `jose` error name and code; the full reason appears at `debug` as `oauth.verify.rejected`) — so a request rejected for insufficient scope shows both `oauth.verify.ok` and the `auth.token_rejected` that follows it. A sustained flood of `auth.token_rejected` whose `code` is `ERR_JOSE_NOT_SUPPORTED` or `ERR_JOSE_ALG_NOT_ALLOWED` (rather than `ERR_JWT_EXPIRED`) points at server-side key or algorithm configuration, not client error.
 
 ## Usage metrics
 
-Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome (`ok` / `handler_error` / `transport_error`), and latency — and POSTs it in fire-and-forget batches as **OTLP/HTTP JSON logs**. No tool arguments or response payloads are ever captured. Emission is **on by default**, self-disables at runtime when `LOVABLE_API_KEY` is absent (so a local `vite dev` stays silent), and degrades silently — a failed flush never blocks or fails a tool call.
+Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome, and latency — as **OTLP/HTTP JSON logs**, one awaited POST per record, bounded by a 3-second timeout; a failed or slow POST is logged (`metrics.failed`) and swallowed, never failing the request. Outcomes cover tool results (`ok`, `tool_error`, `handler_error`, `transport_error`) and the authorization gate: `auth_challenge` for an unauthenticated request answered with the `401` challenge (so probe traffic produces records), and the `auth_*` discovery/JWKS failure outcomes. No tool arguments or response payloads are ever captured. Emission is **on by default** and self-disables at runtime when `LOVABLE_API_KEY` is absent: records are dropped and one `metrics.disabled_no_api_key` warning is logged per process, so a local `vite dev` stays quiet. With `metrics: false` the recorder never runs — on Deno and Cloudflare Workers that also means `LOVABLE_MCP_LOG_LEVEL` is never applied (use `setLogLevel()` instead).
 
 Configure it on the MCP definition:
 

package/dist/{authorize-Cs1yyLrq.d.ts → authorize-BjNE3LPr.d.ts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.js";
+import "./types-D1cgsnPu.js";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /**

package/dist/{authorize-BcNuNPtP.d.cts → authorize-BzZFS0zi.d.cts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.cjs";
+import "./types-D1cgsnPu.cjs";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /**

package/dist/{base-CReh7d3E.d.cts → base-DSH8NnPj.d.cts}

@@ -1,18 +1,25 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
  *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
 interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
   tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
   method: string;
   outcome: InvocationOutcome;
   durationMs: number;
   reqBytes?: number;
   resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** Wire surface that served the call: the modern stateless revision, the
+   *  initialization-era path, or the REST companion. Absent on records emitted
+   *  before protocol classification (auth gate, transport faults). */
+  protocol?: "2026-07-28" | "legacy" | "rest";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/{base-CReh7d3E.d.ts → base-DSH8NnPj.d.ts}

@@ -1,18 +1,25 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
  *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
 interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
   tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
   method: string;
   outcome: InvocationOutcome;
   durationMs: number;
   reqBytes?: number;
   resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** Wire surface that served the call: the modern stateless revision, the
+   *  initialization-era path, or the REST companion. Absent on records emitted
+   *  before protocol classification (auth gate, transport faults). */
+  protocol?: "2026-07-28" | "legacy" | "rest";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/cli/extract-manifest.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_package = require("../package-BdaLbzEh.cjs");
-const require_list_tools = require("../list-tools-DiMCRunS.cjs");
+const require_package = require("../package-C3YVYgxp.cjs");
+const require_list_tools = require("../list-tools-Dkyyje7j.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/cli/extract-manifest.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-dtiombMt.js";
-import { t as buildMcpListing } from "../list-tools-Dt-mhh52.js";
+import { t as version } from "../package-DzB_5Hur.js";
+import { t as buildMcpListing } from "../list-tools-ePP9tXND.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{authorize-CB35c3Wg.cjs → cors-CmKzDN7k.cjs}

@@ -1,28 +1,7 @@
-const require_logger = require("./logger-BkMMCFTv.cjs");
-const require_package = require("./package-BdaLbzEh.cjs");
+const require_logger = require("./logger-CN1q-KNn.cjs");
+const require_package = require("./package-C3YVYgxp.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -34,7 +13,7 @@ function headResponse(response) {
 	});
 }
 function finalizeWireResponse(request, response) {
-	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+	return request.method === "HEAD" ? headResponse(response) : response;
 }
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
@@ -73,6 +52,8 @@ function toLogRecord(rec) {
 	if (rec.tool !== null) attributes.push(strAttr("mcp.tool", rec.tool));
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
+	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
+	if (rec.protocol !== void 0) attributes.push(strAttr("mcp.protocol", rec.protocol));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -120,6 +101,8 @@ function nowUnixNano() {
 function nowMs() {
 	return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
+const METRICS_POST_TIMEOUT_MS = 3e3;
+let warnedNoApiKey = false;
 const NOOP_RECORDER = { async emit() {} };
 function createNoopRecorder() {
 	return NOOP_RECORDER;
@@ -168,12 +151,13 @@ var BaseMetricRecorder = class {
 	}
 	async emit(ev) {
 		await this.applyLazyLogLevel();
-		require_logger.log.info("tool.invoked", {
+		if (ev.outcome !== "auth_challenge") require_logger.log.info("tool.invoked", {
 			tool: ev.tool,
 			method: ev.method,
 			outcome: ev.outcome,
 			durationMs: ev.durationMs,
 			stack: this.stack,
+			...ev.protocol !== void 0 && { protocol: ev.protocol },
 			...ev.errorText !== void 0 && { errorText: ev.errorText }
 		});
 		if (!this.config.enabled) return;
@@ -181,30 +165,34 @@ var BaseMetricRecorder = class {
 			require_logger.log.warn("metrics.disabled_no_fetch", { endpoint: this.config.endpoint });
 			return;
 		}
-		const headers = { ...this.baseHeaders };
-		if (this.usesLovableEndpoint) {
-			const key = await this.resolveApiKey();
-			if (!key) {
-				require_logger.log.warn("metrics.disabled_no_api_key", {
-					envVar: this.config.apiKeyEnvVar,
-					endpoint: this.config.endpoint
-				});
-				return;
-			}
-			headers.authorization = `Bearer ${key}`;
-		}
-		const { errorText: _localOnly, ...wireEvent } = ev;
-		const body = buildLogsPayload([{
-			...wireEvent,
-			timeUnixNano: nowUnixNano(),
-			stack: this.stack
-		}], this.server);
 		try {
+			const headers = { ...this.baseHeaders };
+			if (this.usesLovableEndpoint) {
+				const key = await this.resolveApiKey();
+				if (!key) {
+					if (!warnedNoApiKey) {
+						warnedNoApiKey = true;
+						require_logger.log.warn("metrics.disabled_no_api_key", {
+							envVar: this.config.apiKeyEnvVar,
+							endpoint: this.config.endpoint
+						});
+					}
+					return;
+				}
+				headers.authorization = `Bearer ${key}`;
+			}
+			const { errorText: _localOnly, ...wireEvent } = ev;
+			const body = buildLogsPayload([{
+				...wireEvent,
+				timeUnixNano: nowUnixNano(),
+				stack: this.stack
+			}], this.server);
 			const res = await this.doFetch(this.config.endpoint, {
 				method: "POST",
 				headers,
 				body,
-				keepalive: true
+				keepalive: true,
+				signal: AbortSignal.timeout(METRICS_POST_TIMEOUT_MS)
 			});
 			if (!res.ok) require_logger.log.warn("metrics.rejected", {
 				status: res.status,
@@ -295,8 +283,8 @@ var SupabaseMetricRecorder = class extends BaseMetricRecorder {
 //#endregion
 //#region src/metrics/recorder.ts
 /** Vend the recorder for a stack, in-flight per request. Returns a no-op when
-*  metrics are disabled (`metrics: false`); otherwise the stack-specific class,
-*  which still logs `tool.invoked` even if the key or endpoint is unavailable. */
+*  metrics are disabled (`metrics: false`); otherwise the stack-specific class, which
+*  logs `tool.invoked` for tool invocations even if the key or endpoint is unavailable. */
 function createRecorderForRuntime(mcp, opts) {
 	const config = require_logger.resolveMetricsConfig(mcp.metrics);
 	const server = {
@@ -593,6 +581,16 @@ async function fetchVerificationKeySet(jwksUri) {
 		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
 	}
 }
+function assertCompactJwsShape(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+		require_logger.log.debug("oauth.verify.bad_shape", {
+			tokenLength: token.length,
+			outcome: "401 invalid_token"
+		});
+		throw new OAuthTokenError(401, "invalid_token", "Access token is not a JWT");
+	}
+}
 function assertAccessTokenTyp(token, allowed) {
 	let header;
 	try {
@@ -694,6 +692,8 @@ function buildMcpAuthContext(args) {
 function createOAuthTokenVerifier(auth, discovery) {
 	const allowedTyps = auth.accessTokenTyp ?? DEFAULT_ACCESS_TOKEN_TYPS;
 	return async (token, request, options) => {
+		assertCompactJwsShape(token);
+		assertAccessTokenTyp(token, allowedTyps);
 		const resource = resolveProtectedResource(auth, request, options);
 		const issuer = await discovery.resolveIssuer();
 		const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
@@ -705,9 +705,7 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		const jwksUri = await discovery.resolveJwksUri();
 		require_logger.log.debug("oauth.jwks.fetch", { jwksUri });
-		const keySet = await fetchVerificationKeySet(jwksUri);
-		assertAccessTokenTyp(token, allowedTyps);
-		const claims = await verifyJwtClaims(token, keySet, issuer, auth);
+		const claims = await verifyJwtClaims(token, await fetchVerificationKeySet(jwksUri), issuer, auth);
 		const audienceVia = checkAcceptedAudience(claims, acceptedAudiences, auth);
 		assertNonEmptySubject(claims);
 		const context = buildMcpAuthContext({
@@ -719,11 +717,13 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		assertOAuthClientClaim(auth, context.principal.clientId);
 		require_logger.log.info("oauth.verify.ok", {
-			sub: context.principal.sub,
-			clientId: context.principal.clientId,
 			scopes: context.principal.scopes,
 			audienceVia
 		});
+		require_logger.log.debug("oauth.verify.principal", {
+			sub: context.principal.sub,
+			clientId: context.principal.clientId
+		});
 		return context;
 	};
 }
@@ -776,6 +776,22 @@ function oauthUpstreamUnreachableResponse() {
 		}
 	});
 }
+const KNOWN_HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"DELETE",
+	"PATCH",
+	"OPTIONS",
+	"TRACE",
+	"CONNECT",
+	"QUERY"
+]);
+function normalizeHttpMethod(method) {
+	const upper = method.toUpperCase();
+	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
+}
 function parseBearerToken(request) {
 	const header = request.headers.get("Authorization");
 	if (!header) return void 0;
@@ -838,7 +854,18 @@ function createRequestAuthorizer(mcp, options = {}) {
 		const startedAt = nowMs();
 		const token = parseBearerToken(request);
 		if (!token) {
-			require_logger.log.info("auth.no_bearer_token", { outcome: "401" });
+			const httpMethod = normalizeHttpMethod(request.method);
+			require_logger.log.info("auth.no_bearer_token", {
+				httpMethod,
+				outcome: "401"
+			});
+			await recorder?.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "auth_challenge",
+				httpMethod,
+				durationMs: nowMs() - startedAt
+			});
 			return {
 				ok: false,
 				response: challengeResponse(runtime.auth, request, runtime.options, 401)
@@ -896,7 +923,12 @@ function createRequestAuthorizer(mcp, options = {}) {
 					response: challengeResponse(runtime.auth, request, runtime.options, err.status, err.oauthError, err.message)
 				};
 			}
-			require_logger.log.error("auth.unexpected_error", {
+			if (err instanceof jose.errors.JOSEError) require_logger.log.info("auth.token_rejected", {
+				...require_logger.describeError(err),
+				status: 401,
+				oauthError: "invalid_token"
+			});
+			else require_logger.log.error("auth.unexpected_error", {
 				...require_logger.describeError(err),
 				outcome: "401"
 			});
@@ -908,6 +940,69 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id";
+const ALLOW_HEADERS = "Authorization, Content-Type, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id, Last-Event-ID";
+const MCP_PARAM_HEADER = /^mcp-param-[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function appendVary(headers, value) {
+	const values = new Set((headers.get("Vary") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
+	values.add(value);
+	headers.set("Vary", [...values].join(", "));
+}
+function addCorsHeaders(response, allowedOrigin, variesByOrigin) {
+	if (allowedOrigin !== void 0) {
+		response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	}
+	if (variesByOrigin) appendVary(response.headers, "Origin");
+	return response;
+}
+function allowedRequestHeaders(request) {
+	const allowed = new Map(ALLOW_HEADERS.split(", ").map((header) => [header.toLowerCase(), header]));
+	for (const header of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+		const normalized = header.trim();
+		if (MCP_PARAM_HEADER.test(normalized)) allowed.set(normalized.toLowerCase(), normalized);
+	}
+	return [...allowed.values()].join(", ");
+}
+function evaluateCors(request, allowedOrigins) {
+	const origin = request.headers.get("Origin");
+	const allowAny = allowedOrigins === "any";
+	let allowedOrigin;
+	if (allowAny) allowedOrigin = "*";
+	else if (origin === null) allowedOrigin = void 0;
+	else if (origin === new URL(request.url).origin || allowedOrigins?.includes(origin)) allowedOrigin = origin;
+	else allowedOrigin = null;
+	if (allowedOrigin === null) {
+		const response = Response.json({ error: "origin not allowed" }, {
+			status: 403,
+			headers: { "Cache-Control": "no-store" }
+		});
+		appendVary(response.headers, "Origin");
+		return {
+			ok: false,
+			response
+		};
+	}
+	return {
+		ok: true,
+		withHeaders: (response) => addCorsHeaders(response, allowedOrigin, !allowAny),
+		preflight: (allowMethods) => {
+			const requestedHeaders = request.headers.get("Access-Control-Request-Headers");
+			const response = new Response(null, {
+				status: 204,
+				headers: {
+					"Access-Control-Allow-Methods": allowMethods,
+					"Access-Control-Allow-Headers": allowedRequestHeaders(request),
+					"Access-Control-Max-Age": "86400"
+				}
+			});
+			if (requestedHeaders) appendVary(response.headers, "Access-Control-Request-Headers");
+			return addCorsHeaders(response, allowedOrigin, !allowAny);
+		}
+	};
+}
+//#endregion
 Object.defineProperty(exports, "JSON_HEADERS", {
 	enumerable: true,
 	get: function() {
@@ -926,12 +1021,6 @@ Object.defineProperty(exports, "assertRestResourceBinding", {
 		return assertRestResourceBinding;
 	}
 });
-Object.defineProperty(exports, "corsPreflightResponse", {
-	enumerable: true,
-	get: function() {
-		return corsPreflightResponse;
-	}
-});
 Object.defineProperty(exports, "createNoopRecorder", {
 	enumerable: true,
 	get: function() {
@@ -950,6 +1039,12 @@ Object.defineProperty(exports, "createRequestAuthorizer", {
 		return createRequestAuthorizer;
 	}
 });
+Object.defineProperty(exports, "evaluateCors", {
+	enumerable: true,
+	get: function() {
+		return evaluateCors;
+	}
+});
 Object.defineProperty(exports, "finalizeWireResponse", {
 	enumerable: true,
 	get: function() {