@lovable.dev/mcp-js 0.28.0 → 0.29.0-rc.1

package/README.md

@@ -51,7 +51,13 @@ That's the whole authoring surface. No imperative server construction, no route
 
 The table shows the default `path: "/mcp"`. The REST companions co-locate under the parent of the configured `path`, so `mcpPlugin({ path: "/api/public/mcp" })` emits them at `/api/public/.mcp/list-tools` and `/api/public/.mcp/invoke-tool/<tool>` (file: `src/routes/api/public/[.mcp]/...`). Pass `restRoutes: false` to drop them.
 
-MCP (`POST <path>`, `/mcp` by default) is the public wire format clients speak directly. REST (the `.mcp/*` companions, co-located under the `path` parent) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth policy protects them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. CORS and rate limiting still belong at the app host or edge.
+MCP (`POST <path>`, `/mcp` by default) is the public wire format clients speak directly. REST (the `.mcp/*` companions, co-located under the `path` parent) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth and browser-origin policies protect them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. Rate limiting belongs at the app host or edge.
+
+The MCP endpoint supports both protocol eras on one URL. Finalized `2026-07-28` clients send the version, client capabilities, and mirrored HTTP headers on every request; the server returns typed results plus cache metadata on discovery and list responses without initialization or protocol sessions. Initialization-era clients continue through a stateless compatibility path: `initialize`, `tools/list`, and `tools/call` work as independent requests, and the endpoint never mints `Mcp-Session-Id`. `GET` and `DELETE` return `405` because there is no standalone stream or session to manage.
+
+`outputSchema` accepts either the existing object-shape shorthand (`{ value: z.string() }`) or a JSON-Schema-representable Zod schema such as `z.array(z.string())`; `structuredContent` may be any JSON value. The server returns the schema's parsed output, so coercions are reflected in the result; transforms with no truthful JSON Schema are rejected when `defineMcp` runs. Modern clients receive the natural schema and value. The compatibility path wraps non-object schemas and values under `result` for initialization-era clients whose wire format requires an object root.
+
+Browser-origin checks apply to the MCP, REST companion, and OAuth metadata routes before authentication. Omit `allowedOrigins` to allow requests with no `Origin` header (Go, desktop, CLI, and server clients) plus same-origin browser requests. Set `allowedOrigins: ["https://client.example.com"]` for exact additional origins, or `allowedOrigins: "any"` to intentionally restore wildcard CORS. Exact and same origins are reflected with `Vary: Origin`; other browser origins receive `403` without an OAuth challenge. Reverse-proxy adapters compare against the effective public origin after applying only their configured trusted forwarded headers.
 
 The OAuth metadata route is emitted by default and returns `404` until OAuth auth is configured. Disable it with `mcpPlugin({ protectedResourceMetadataRoute: false })` only if the app owns `/.well-known/oauth-protected-resource` itself.
 

package/dist/{authorize-Cs1yyLrq.d.ts → authorize-BjNE3LPr.d.ts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.js";
+import "./types-D1cgsnPu.js";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /**

package/dist/{authorize-BcNuNPtP.d.cts → authorize-BzZFS0zi.d.cts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.cjs";
+import "./types-D1cgsnPu.cjs";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /**

package/dist/{base-CUkmyaXJ.d.cts → base-C8osWdMU.d.cts}

@@ -16,6 +16,9 @@ interface InvocationRecord {
   /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
    *  POST discovery) is distinguishable; absent on tool-call records. */
   httpMethod?: string;
+  /** Wire surface that served the call; absent on records emitted before
+   *  protocol classification (auth gate, transport faults). */
+  protocol?: "2026-07-28" | "legacy" | "rest";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/{base-CUkmyaXJ.d.ts → base-C8osWdMU.d.ts}

@@ -16,6 +16,9 @@ interface InvocationRecord {
   /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
    *  POST discovery) is distinguishable; absent on tool-call records. */
   httpMethod?: string;
+  /** Wire surface that served the call; absent on records emitted before
+   *  protocol classification (auth gate, transport faults). */
+  protocol?: "2026-07-28" | "legacy" | "rest";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/cli/extract-manifest.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_package = require("../package-CGLPZwz-.cjs");
-const require_list_tools = require("../list-tools-DCF6G4fn.cjs");
+const require_package = require("../package-ClCIqol1.cjs");
+const require_list_tools = require("../list-tools-DES10avA.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/cli/extract-manifest.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-DgiA0xuY.js";
-import { t as buildMcpListing } from "../list-tools-BLGr7mot.js";
+import { t as version } from "../package-BI5r4uGM.js";
+import { t as buildMcpListing } from "../list-tools-C1OiTDR9.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{authorize--rUeMOGU.js → cors-BDTQQJE2.js}

@@ -1,28 +1,7 @@
 import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as version } from "./package-DgiA0xuY.js";
+import { t as version } from "./package-BI5r4uGM.js";
 import "./metadata-path-CAkNcfyY.js";
 import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -34,7 +13,7 @@ function headResponse(response) {
 	});
 }
 function finalizeWireResponse(request, response) {
-	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+	return request.method === "HEAD" ? headResponse(response) : response;
 }
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
@@ -74,6 +53,7 @@ function toLogRecord(rec) {
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
 	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
+	if (rec.protocol !== void 0) attributes.push(strAttr("mcp.protocol", rec.protocol));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -177,6 +157,7 @@ var BaseMetricRecorder = class {
 			outcome: ev.outcome,
 			durationMs: ev.durationMs,
 			stack: this.stack,
+			...ev.protocol !== void 0 && { protocol: ev.protocol },
 			...ev.errorText !== void 0 && { errorText: ev.errorText }
 		});
 		if (!this.config.enabled) return;
@@ -959,4 +940,67 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
-export { assertResourcePathShape as a, createNoopRecorder as c, finalizeWireResponse as d, methodNotAllowed as f, oauthConfigurationErrorResponse as i, nowMs as l, createRequestAuthorizer as n, resolveProtectedResource as o, corsPreflightResponse as p, getOAuthRuntime as r, createRecorderForRuntime as s, assertRestResourceBinding as t, JSON_HEADERS as u };
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id";
+const ALLOW_HEADERS = "Authorization, Content-Type, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id, Last-Event-ID";
+const MCP_PARAM_HEADER = /^mcp-param-[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function appendVary(headers, value) {
+	const values = new Set((headers.get("Vary") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
+	values.add(value);
+	headers.set("Vary", [...values].join(", "));
+}
+function addCorsHeaders(response, allowedOrigin, variesByOrigin) {
+	if (allowedOrigin !== void 0) {
+		response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	}
+	if (variesByOrigin) appendVary(response.headers, "Origin");
+	return response;
+}
+function allowedRequestHeaders(request) {
+	const allowed = new Map(ALLOW_HEADERS.split(", ").map((header) => [header.toLowerCase(), header]));
+	for (const header of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+		const normalized = header.trim();
+		if (MCP_PARAM_HEADER.test(normalized)) allowed.set(normalized.toLowerCase(), normalized);
+	}
+	return [...allowed.values()].join(", ");
+}
+function evaluateCors(request, allowedOrigins) {
+	const origin = request.headers.get("Origin");
+	const allowAny = allowedOrigins === "any";
+	let allowedOrigin;
+	if (allowAny) allowedOrigin = "*";
+	else if (origin === null) allowedOrigin = void 0;
+	else if (origin === new URL(request.url).origin || allowedOrigins?.includes(origin)) allowedOrigin = origin;
+	else allowedOrigin = null;
+	if (allowedOrigin === null) {
+		const response = Response.json({ error: "origin not allowed" }, {
+			status: 403,
+			headers: { "Cache-Control": "no-store" }
+		});
+		appendVary(response.headers, "Origin");
+		return {
+			ok: false,
+			response
+		};
+	}
+	return {
+		ok: true,
+		withHeaders: (response) => addCorsHeaders(response, allowedOrigin, !allowAny),
+		preflight: (allowMethods) => {
+			const requestedHeaders = request.headers.get("Access-Control-Request-Headers");
+			const response = new Response(null, {
+				status: 204,
+				headers: {
+					"Access-Control-Allow-Methods": allowMethods,
+					"Access-Control-Allow-Headers": allowedRequestHeaders(request),
+					"Access-Control-Max-Age": "86400"
+				}
+			});
+			if (requestedHeaders) appendVary(response.headers, "Access-Control-Request-Headers");
+			return addCorsHeaders(response, allowedOrigin, !allowAny);
+		}
+	};
+}
+//#endregion
+export { oauthConfigurationErrorResponse as a, createRecorderForRuntime as c, JSON_HEADERS as d, finalizeWireResponse as f, getOAuthRuntime as i, createNoopRecorder as l, assertRestResourceBinding as n, assertResourcePathShape as o, methodNotAllowed as p, createRequestAuthorizer as r, resolveProtectedResource as s, evaluateCors as t, nowMs as u };

package/dist/{authorize-ChY44o_1.cjs → cors-BRv5KXKQ.cjs}

@@ -1,28 +1,7 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
-const require_package = require("./package-CGLPZwz-.cjs");
+const require_package = require("./package-ClCIqol1.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -34,7 +13,7 @@ function headResponse(response) {
 	});
 }
 function finalizeWireResponse(request, response) {
-	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+	return request.method === "HEAD" ? headResponse(response) : response;
 }
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
@@ -74,6 +53,7 @@ function toLogRecord(rec) {
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
 	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
+	if (rec.protocol !== void 0) attributes.push(strAttr("mcp.protocol", rec.protocol));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -177,6 +157,7 @@ var BaseMetricRecorder = class {
 			outcome: ev.outcome,
 			durationMs: ev.durationMs,
 			stack: this.stack,
+			...ev.protocol !== void 0 && { protocol: ev.protocol },
 			...ev.errorText !== void 0 && { errorText: ev.errorText }
 		});
 		if (!this.config.enabled) return;
@@ -959,6 +940,69 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id";
+const ALLOW_HEADERS = "Authorization, Content-Type, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id, Last-Event-ID";
+const MCP_PARAM_HEADER = /^mcp-param-[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function appendVary(headers, value) {
+	const values = new Set((headers.get("Vary") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
+	values.add(value);
+	headers.set("Vary", [...values].join(", "));
+}
+function addCorsHeaders(response, allowedOrigin, variesByOrigin) {
+	if (allowedOrigin !== void 0) {
+		response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	}
+	if (variesByOrigin) appendVary(response.headers, "Origin");
+	return response;
+}
+function allowedRequestHeaders(request) {
+	const allowed = new Map(ALLOW_HEADERS.split(", ").map((header) => [header.toLowerCase(), header]));
+	for (const header of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+		const normalized = header.trim();
+		if (MCP_PARAM_HEADER.test(normalized)) allowed.set(normalized.toLowerCase(), normalized);
+	}
+	return [...allowed.values()].join(", ");
+}
+function evaluateCors(request, allowedOrigins) {
+	const origin = request.headers.get("Origin");
+	const allowAny = allowedOrigins === "any";
+	let allowedOrigin;
+	if (allowAny) allowedOrigin = "*";
+	else if (origin === null) allowedOrigin = void 0;
+	else if (origin === new URL(request.url).origin || allowedOrigins?.includes(origin)) allowedOrigin = origin;
+	else allowedOrigin = null;
+	if (allowedOrigin === null) {
+		const response = Response.json({ error: "origin not allowed" }, {
+			status: 403,
+			headers: { "Cache-Control": "no-store" }
+		});
+		appendVary(response.headers, "Origin");
+		return {
+			ok: false,
+			response
+		};
+	}
+	return {
+		ok: true,
+		withHeaders: (response) => addCorsHeaders(response, allowedOrigin, !allowAny),
+		preflight: (allowMethods) => {
+			const requestedHeaders = request.headers.get("Access-Control-Request-Headers");
+			const response = new Response(null, {
+				status: 204,
+				headers: {
+					"Access-Control-Allow-Methods": allowMethods,
+					"Access-Control-Allow-Headers": allowedRequestHeaders(request),
+					"Access-Control-Max-Age": "86400"
+				}
+			});
+			if (requestedHeaders) appendVary(response.headers, "Access-Control-Request-Headers");
+			return addCorsHeaders(response, allowedOrigin, !allowAny);
+		}
+	};
+}
+//#endregion
 Object.defineProperty(exports, "JSON_HEADERS", {
 	enumerable: true,
 	get: function() {
@@ -977,12 +1021,6 @@ Object.defineProperty(exports, "assertRestResourceBinding", {
 		return assertRestResourceBinding;
 	}
 });
-Object.defineProperty(exports, "corsPreflightResponse", {
-	enumerable: true,
-	get: function() {
-		return corsPreflightResponse;
-	}
-});
 Object.defineProperty(exports, "createNoopRecorder", {
 	enumerable: true,
 	get: function() {
@@ -1001,6 +1039,12 @@ Object.defineProperty(exports, "createRequestAuthorizer", {
 		return createRequestAuthorizer;
 	}
 });
+Object.defineProperty(exports, "evaluateCors", {
+	enumerable: true,
+	get: function() {
+		return evaluateCors;
+	}
+});
 Object.defineProperty(exports, "finalizeWireResponse", {
 	enumerable: true,
 	get: function() {

package/dist/{forwarded-BlLF3dfc.js → forwarded-B3EBjHnA.js}

@@ -15,9 +15,9 @@
 *   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
 *   bare SDK consumer.
 * - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
-*   Supabase terminates TLS upstream and forwards over http with a
-*   gateway-stamped proto, so that stack always trusts it; the TanStack proxy
-*   does not sanitize proto, so its Vite plugin never emits the flag.
+*   Supabase's gateway stamps it (that stack always trusts it), and Lovable's
+*   preview proxy overwrites it before the TanStack dev server, so the TanStack
+*   Vite plugin emits the flag by default.
 */
 function applyForwardedOrigin(request, options) {
 	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;

package/dist/{forwarded-Bhwcj22u.cjs → forwarded-BC_RHnn5.cjs}

@@ -15,9 +15,9 @@
 *   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
 *   bare SDK consumer.
 * - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
-*   Supabase terminates TLS upstream and forwards over http with a
-*   gateway-stamped proto, so that stack always trusts it; the TanStack proxy
-*   does not sanitize proto, so its Vite plugin never emits the flag.
+*   Supabase's gateway stamps it (that stack always trusts it), and Lovable's
+*   preview proxy overwrites it before the TanStack dev server, so the TanStack
+*   Vite plugin emits the flag by default.
 */
 function applyForwardedOrigin(request, options) {
 	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;

package/dist/{gate-CGZl0gjJ.cjs → gate-CAJSRt_t.cjs}

@@ -1,4 +1,4 @@
-const require_authorize = require("./authorize-ChY44o_1.cjs");
+const require_cors = require("./cors-BRv5KXKQ.cjs");
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");
@@ -8,9 +8,11 @@ function createGatedHandler(gate) {
 		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
 		return gate.handle(request, authResult, recorder, ...extra);
 	};
-	return async (request, recorder = require_authorize.createNoopRecorder(), ...extra) => {
-		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse(allow);
-		const final = require_authorize.finalizeWireResponse(request, await respond(request, recorder, ...extra));
+	return async (request, recorder = require_cors.createNoopRecorder(), ...extra) => {
+		const cors = require_cors.evaluateCors(request, gate.allowedOrigins);
+		if (!cors.ok) return require_cors.finalizeWireResponse(request, cors.response);
+		if (request.method === "OPTIONS") return cors.preflight(allow);
+		const final = require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, ...extra)));
 		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
 		return final;
 	};

package/dist/{gate-BiM6EBeA.js → gate-uCVrbDBb.js}

@@ -1,4 +1,4 @@
-import { c as createNoopRecorder, d as finalizeWireResponse, p as corsPreflightResponse } from "./authorize--rUeMOGU.js";
+import { f as finalizeWireResponse, l as createNoopRecorder, t as evaluateCors } from "./cors-BDTQQJE2.js";
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");
@@ -9,8 +9,10 @@ function createGatedHandler(gate) {
 		return gate.handle(request, authResult, recorder, ...extra);
 	};
 	return async (request, recorder = createNoopRecorder(), ...extra) => {
-		if (request.method === "OPTIONS") return corsPreflightResponse(allow);
-		const final = finalizeWireResponse(request, await respond(request, recorder, ...extra));
+		const cors = evaluateCors(request, gate.allowedOrigins);
+		if (!cors.ok) return finalizeWireResponse(request, cors.response);
+		if (request.method === "OPTIONS") return cors.preflight(allow);
+		const final = finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, ...extra)));
 		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
 		return final;
 	};

package/dist/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("./logger-CN1q-KNn.cjs");
+const require_schema = require("./schema-D3vClxb7.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {
@@ -79,6 +80,39 @@ function freezeAuth(auth) {
 	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
 	Object.freeze(auth);
 }
+function assertAllowedOrigins(allowedOrigins) {
+	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
+	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
+	for (const origin of allowedOrigins) {
+		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
+	}
+}
+function assertToolSchemas(mcp) {
+	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
+		"inputSchema",
+		tool.inputSchema,
+		"input"
+	], [
+		"outputSchema",
+		tool.outputSchema,
+		"output"
+	]]) {
+		if (!definition) continue;
+		try {
+			require_schema.jsonSchemaFromDefinition(definition, strategy);
+		} catch (error) {
+			const detail = error instanceof Error ? `: ${error.message}` : "";
+			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
+		}
+	}
+}
 /**
 * Declare a single MCP tool. Import the result into your MCP definition's
 * `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
@@ -101,8 +135,11 @@ function defineMcp(def) {
 	assertNonEmptyString("version", def.version);
 	assertUniqueNames(def);
 	if (def.auth) assertOAuthConfig(def.auth);
+	assertAllowedOrigins(def.allowedOrigins);
+	assertToolSchemas(def);
 	require_logger.resolveMetricsConfig(def.metrics);
 	freezeAuth(def.auth);
+	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
 	Object.freeze(def.tools);
 	for (const tool of def.tools) Object.freeze(tool);
 	return def;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedResource, b as MetricsOptions, c as McpDefinition, d as ResourceLinkIcon, f as TextContent, g as ToolHandlerResult, h as ToolDefinition, i as EmbeddedBlobResource, l as McpDefinitionInput, m as ToolContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ToolAnnotations, r as ContentBlock, s as ImageContent, t as AudioContent, u as ResourceLink, v as ZodSchema, x as ToolContext, y as MetricsConfig } from "./types-C0Wgm9zp.cjs";
+import { C as MetricsOptions, E as McpAuthConfig, S as MetricsConfig, T as JwtClaims, _ as ToolDefinition, a as EmbeddedResource, b as ZodRawShape, c as JsonValue, d as McpDefinitionInput, f as ResourceLink, g as ToolContent, h as ToolAnnotations, i as EmbeddedBlobResource, l as McpAllowedOrigins, m as TextContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ResourceLinkIcon, r as ContentBlock, s as ImageContent, t as AudioContent, u as McpDefinition, v as ToolHandlerResult, w as ToolContext, x as ZodSchema, y as ZodOutputSchema } from "./types-D1cgsnPu.cjs";
 //#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
@@ -8,7 +8,7 @@ import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedReso
  * full `z.object(...)` — the MCP SDK builds the object wrapper internally
  * and the raw shape is what the JSON-RPC `tools/list` payload exposes.
  */
-declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodRawShape | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
 /**
  * Declare the MCP server. `export default` the result from your MCP
  * entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
@@ -71,4 +71,4 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  */
 declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
-export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };
+export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedResource, b as MetricsOptions, c as McpDefinition, d as ResourceLinkIcon, f as TextContent, g as ToolHandlerResult, h as ToolDefinition, i as EmbeddedBlobResource, l as McpDefinitionInput, m as ToolContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ToolAnnotations, r as ContentBlock, s as ImageContent, t as AudioContent, u as ResourceLink, v as ZodSchema, x as ToolContext, y as MetricsConfig } from "./types-C0Wgm9zp.js";
+import { C as MetricsOptions, E as McpAuthConfig, S as MetricsConfig, T as JwtClaims, _ as ToolDefinition, a as EmbeddedResource, b as ZodRawShape, c as JsonValue, d as McpDefinitionInput, f as ResourceLink, g as ToolContent, h as ToolAnnotations, i as EmbeddedBlobResource, l as McpAllowedOrigins, m as TextContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ResourceLinkIcon, r as ContentBlock, s as ImageContent, t as AudioContent, u as McpDefinition, v as ToolHandlerResult, w as ToolContext, x as ZodSchema, y as ZodOutputSchema } from "./types-D1cgsnPu.js";
 //#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
@@ -8,7 +8,7 @@ import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedReso
  * full `z.object(...)` — the MCP SDK builds the object wrapper internally
  * and the raw shape is what the JSON-RPC `tools/list` payload exposes.
  */
-declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodRawShape | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
 /**
  * Declare the MCP server. `export default` the result from your MCP
  * entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
@@ -71,4 +71,4 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  */
 declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
-export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };
+export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
+import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
 import { i as ToolContext, t as ToolError } from "./errors-DSe96Ffd.js";
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {
@@ -78,6 +79,39 @@ function freezeAuth(auth) {
 	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
 	Object.freeze(auth);
 }
+function assertAllowedOrigins(allowedOrigins) {
+	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
+	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
+	for (const origin of allowedOrigins) {
+		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
+	}
+}
+function assertToolSchemas(mcp) {
+	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
+		"inputSchema",
+		tool.inputSchema,
+		"input"
+	], [
+		"outputSchema",
+		tool.outputSchema,
+		"output"
+	]]) {
+		if (!definition) continue;
+		try {
+			jsonSchemaFromDefinition(definition, strategy);
+		} catch (error) {
+			const detail = error instanceof Error ? `: ${error.message}` : "";
+			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
+		}
+	}
+}
 /**
 * Declare a single MCP tool. Import the result into your MCP definition's
 * `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
@@ -100,8 +134,11 @@ function defineMcp(def) {
 	assertNonEmptyString("version", def.version);
 	assertUniqueNames(def);
 	if (def.auth) assertOAuthConfig(def.auth);
+	assertAllowedOrigins(def.allowedOrigins);
+	assertToolSchemas(def);
 	resolveMetricsConfig(def.metrics);
 	freezeAuth(def.auth);
+	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
 	Object.freeze(def.tools);
 	for (const tool of def.tools) Object.freeze(tool);
 	return def;

package/dist/{io-SMlD5WeX.d.ts → io-BYUyNFdn.d.ts}

@@ -1,4 +1,4 @@
-import "./list-tools-BAqQVIHk.js";
+import "./list-tools-DXqSPvNY.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-VBHO8YH_.d.cts → io-B_YLNWDL.d.cts}

@@ -1,4 +1,4 @@
-import "./list-tools-BN97L2Yv.cjs";
+import "./list-tools-C3AoI2Zw.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{list-tools-BLGr7mot.js → list-tools-C1OiTDR9.js}

@@ -1,15 +1,10 @@
-import { f as methodNotAllowed, n as createRequestAuthorizer, t as assertRestResourceBinding } from "./authorize--rUeMOGU.js";
-import { t as createGatedHandler } from "./gate-BiM6EBeA.js";
-import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
-import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
+import { n as assertRestResourceBinding, p as methodNotAllowed, r as createRequestAuthorizer } from "./cors-BDTQQJE2.js";
+import { t as createGatedHandler } from "./gate-uCVrbDBb.js";
 //#region src/protocols/rest/list-tools.ts
-function shapeToJsonSchema(shape) {
-	if (!shape) return null;
-	try {
-		return toJsonSchemaCompat(objectFromShape(shape));
-	} catch {
-		return null;
-	}
+function schemaToJsonSchema(definition, pipeStrategy) {
+	if (!definition) return null;
+	return jsonSchemaFromDefinition(definition, pipeStrategy);
 }
 function buildMcpListing(mcp) {
 	return {
@@ -23,8 +18,8 @@ function buildMcpListing(mcp) {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
-			inputSchema: shapeToJsonSchema(tool.inputSchema),
-			outputSchema: shapeToJsonSchema(tool.outputSchema)
+			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
 		}))
 	};
 }
@@ -32,6 +27,7 @@ function createListToolsHandler(mcp, options = {}) {
 	assertRestResourceBinding(mcp, options);
 	return createGatedHandler({
 		authorizer: createRequestAuthorizer(mcp, options),
+		allowedOrigins: mcp.allowedOrigins,
 		methods: ["GET", "HEAD"],
 		methodNotAllowed,
 		handle: async () => Response.json(buildMcpListing(mcp))