@lovable.dev/mcp-js 0.29.0-rc.2 → 0.29.0-rc.4

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { C as MetricsOptions, D as JwtClaims, E as ToolContext, O as McpAuthConfig, S as MetricsConfig, T as ProgressUpdate, _ as ToolDefinition, a as EmbeddedResource, b as ZodRawShape, c as JsonValue, d as McpDefinitionInput, f as ResourceLink, g as ToolContent, h as ToolAnnotations, i as EmbeddedBlobResource, l as McpAllowedOrigins, m as TextContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ResourceLinkIcon, r as ContentBlock, s as ImageContent, t as AudioContent, u as McpDefinition, v as ToolHandlerResult, w as McpClientInfo, x as ZodSchema, y as ZodOutputSchema } from "./types-DnGEKnvI.js";
+import { C as McpAuthConfig, S as JwtClaims, _ as ZodRawShape, a as EmbeddedResource, b as MetricsOptions, c as McpDefinition, d as ResourceLinkIcon, f as TextContent, g as ToolHandlerResult, h as ToolDefinition, i as EmbeddedBlobResource, l as McpDefinitionInput, m as ToolContent, n as ContentAnnotations, o as EmbeddedTextResource, p as ToolAnnotations, r as ContentBlock, s as ImageContent, t as AudioContent, u as ResourceLink, v as ZodSchema, x as ToolContext, y as MetricsConfig } from "./types-C0Wgm9zp.js";
 //#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
@@ -8,7 +8,7 @@ import { C as MetricsOptions, D as JwtClaims, E as ToolContext, O as McpAuthConf
  * full `z.object(...)` — the MCP SDK builds the object wrapper internally
  * and the raw shape is what the JSON-RPC `tools/list` payload exposes.
  */
-declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodRawShape | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
 /**
  * Declare the MCP server. `export default` the result from your MCP
  * entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
@@ -71,4 +71,4 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  */
 declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
-export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpClientInfo, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ProgressUpdate, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };
+export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JwtClaims, type LogLevel, type McpDefinitionInput, type MetricsConfig, type MetricsOptions, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.js

@@ -1,6 +1,5 @@
 import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { i as ToolContext, t as ToolError } from "./errors-Bwd1L0Rf.js";
+import { i as ToolContext, t as ToolError } from "./errors-DSe96Ffd.js";
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {
 	const seen = /* @__PURE__ */ new Set();
@@ -79,39 +78,6 @@ function freezeAuth(auth) {
 	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
 	Object.freeze(auth);
 }
-function assertAllowedOrigins(allowedOrigins) {
-	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
-	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
-	for (const origin of allowedOrigins) {
-		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch {
-			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
-	}
-}
-function assertToolSchemas(mcp) {
-	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
-		"inputSchema",
-		tool.inputSchema,
-		"input"
-	], [
-		"outputSchema",
-		tool.outputSchema,
-		"output"
-	]]) {
-		if (!definition) continue;
-		try {
-			jsonSchemaFromDefinition(definition, strategy);
-		} catch (error) {
-			const detail = error instanceof Error ? `: ${error.message}` : "";
-			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
-		}
-	}
-}
 /**
 * Declare a single MCP tool. Import the result into your MCP definition's
 * `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
@@ -134,11 +100,8 @@ function defineMcp(def) {
 	assertNonEmptyString("version", def.version);
 	assertUniqueNames(def);
 	if (def.auth) assertOAuthConfig(def.auth);
-	assertAllowedOrigins(def.allowedOrigins);
-	assertToolSchemas(def);
 	resolveMetricsConfig(def.metrics);
 	freezeAuth(def.auth);
-	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
 	Object.freeze(def.tools);
 	for (const tool of def.tools) Object.freeze(tool);
 	return def;

package/dist/{io-DrHivYt0.d.ts → io-DP3icuxa.d.ts}

@@ -1,4 +1,4 @@
-import "./types-DnGEKnvI.js";
+import "./types-C0Wgm9zp.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-Bh_WpbxU.d.cts → io-Dx0nPc1-.d.cts}

@@ -1,4 +1,4 @@
-import "./types-DnGEKnvI.cjs";
+import "./types-C0Wgm9zp.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/mcp-BLs6_g8i.js

@@ -0,0 +1,174 @@
+import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
+import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
+import { c as nowMs, f as corsPreflightResponse, s as createNoopRecorder, t as createRequestAuthorizer, u as finalizeWireResponse } from "./authorize-b3VqTC_7.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+//#region src/protocols/gate.ts
+function createGatedHandler(gate) {
+	const allow = [...gate.methods, "OPTIONS"].join(", ");
+	const respond = async (request, recorder) => {
+		const authResult = await gate.authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
+		return gate.handle(request, authResult, recorder);
+	};
+	return async (request, recorder = createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse(allow);
+		const final = finalizeWireResponse(request, await respond(request, recorder));
+		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
+		return final;
+	};
+}
+//#endregion
+//#region src/protocols/mcp/protocol.ts
+function statelessMethodNotAllowed(allow) {
+	return Response.json({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32e3,
+			message: "Method not allowed: stateless server offers no standalone SSE stream (GET) or session (DELETE)."
+		}
+	}, {
+		status: 405,
+		headers: { Allow: allow }
+	});
+}
+/**
+* Adapt a Lovable tool to the SDK's tool callback. The boundary cast bridges
+* our SDK-decoupled content-block types to the SDK's; they match structurally.
+*/
+function adaptToolToSdkCallback(tool, auth, recorder) {
+	const endUserId = auth?.principal.sub;
+	return (async (first) => {
+		const args = tool.inputSchema ? first ?? {} : {};
+		const start = nowMs();
+		let result;
+		try {
+			result = await tool.handler(args, new ToolContext(auth));
+		} catch (err) {
+			const callerMessage = resolveToolErrorMessage(err);
+			if (callerMessage === void 0) {
+				await recorder.emit({
+					tool: tool.name,
+					method: "tools/call",
+					outcome: "handler_error",
+					durationMs: nowMs() - start,
+					errorText: errorSummary(err),
+					endUserId
+				});
+				return {
+					content: [{
+						type: "text",
+						text: "tool execution failed"
+					}],
+					isError: true
+				};
+			}
+			result = {
+				content: [{
+					type: "text",
+					text: callerMessage
+				}],
+				isError: true
+			};
+		}
+		if (result == null) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: `tool "${tool.name}" returned no result`
+				}],
+				isError: true
+			};
+		}
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: result.isError ? "tool_error" : "ok",
+			durationMs: nowMs() - start,
+			errorText: result.isError ? extractTextContent(result.content) : void 0,
+			endUserId
+		});
+		return {
+			content: result.content ?? [],
+			structuredContent: result.structuredContent,
+			isError: result.isError
+		};
+	});
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = createRequestAuthorizer(mcp, options);
+	const handle = async (request, authResult, recorder) => {
+		try {
+			const server = new McpServer({
+				name: mcp.name,
+				version: mcp.version,
+				title: mcp.title
+			}, { instructions: mcp.instructions });
+			for (const tool of mcp.tools) server.registerTool(tool.name, {
+				title: tool.title,
+				description: tool.description,
+				inputSchema: tool.inputSchema,
+				outputSchema: tool.outputSchema,
+				annotations: tool.annotations
+			}, adaptToolToSdkCallback(tool, authResult.auth, recorder));
+			const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+			await server.connect(transport);
+			return await transport.handleRequest(request);
+		} catch (err) {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			log.error("mcp.transport_error", {
+				...describeError(err),
+				outcome: "500 internal error"
+			});
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return createGatedHandler({
+		authorizer,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
+}
+//#endregion
+export { createMcpProtocolHandler as t };

package/dist/mcp-DtHM-41c.cjs

@@ -0,0 +1,179 @@
+const require_logger = require("./logger-CN1q-KNn.cjs");
+const require_errors = require("./errors-CN6Da8iz.cjs");
+const require_authorize = require("./authorize-CKMlIxm9.cjs");
+let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
+let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+//#region src/protocols/gate.ts
+function createGatedHandler(gate) {
+	const allow = [...gate.methods, "OPTIONS"].join(", ");
+	const respond = async (request, recorder) => {
+		const authResult = await gate.authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
+		return gate.handle(request, authResult, recorder);
+	};
+	return async (request, recorder = require_authorize.createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse(allow);
+		const final = require_authorize.finalizeWireResponse(request, await respond(request, recorder));
+		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
+		return final;
+	};
+}
+//#endregion
+//#region src/protocols/mcp/protocol.ts
+function statelessMethodNotAllowed(allow) {
+	return Response.json({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32e3,
+			message: "Method not allowed: stateless server offers no standalone SSE stream (GET) or session (DELETE)."
+		}
+	}, {
+		status: 405,
+		headers: { Allow: allow }
+	});
+}
+/**
+* Adapt a Lovable tool to the SDK's tool callback. The boundary cast bridges
+* our SDK-decoupled content-block types to the SDK's; they match structurally.
+*/
+function adaptToolToSdkCallback(tool, auth, recorder) {
+	const endUserId = auth?.principal.sub;
+	return (async (first) => {
+		const args = tool.inputSchema ? first ?? {} : {};
+		const start = require_authorize.nowMs();
+		let result;
+		try {
+			result = await tool.handler(args, new require_errors.ToolContext(auth));
+		} catch (err) {
+			const callerMessage = require_errors.resolveToolErrorMessage(err);
+			if (callerMessage === void 0) {
+				await recorder.emit({
+					tool: tool.name,
+					method: "tools/call",
+					outcome: "handler_error",
+					durationMs: require_authorize.nowMs() - start,
+					errorText: require_errors.errorSummary(err),
+					endUserId
+				});
+				return {
+					content: [{
+						type: "text",
+						text: "tool execution failed"
+					}],
+					isError: true
+				};
+			}
+			result = {
+				content: [{
+					type: "text",
+					text: callerMessage
+				}],
+				isError: true
+			};
+		}
+		if (result == null) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: require_authorize.nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: `tool "${tool.name}" returned no result`
+				}],
+				isError: true
+			};
+		}
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: result.isError ? "tool_error" : "ok",
+			durationMs: require_authorize.nowMs() - start,
+			errorText: result.isError ? extractTextContent(result.content) : void 0,
+			endUserId
+		});
+		return {
+			content: result.content ?? [],
+			structuredContent: result.structuredContent,
+			isError: result.isError
+		};
+	});
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = require_authorize.createRequestAuthorizer(mcp, options);
+	const handle = async (request, authResult, recorder) => {
+		try {
+			const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
+				name: mcp.name,
+				version: mcp.version,
+				title: mcp.title
+			}, { instructions: mcp.instructions });
+			for (const tool of mcp.tools) server.registerTool(tool.name, {
+				title: tool.title,
+				description: tool.description,
+				inputSchema: tool.inputSchema,
+				outputSchema: tool.outputSchema,
+				annotations: tool.annotations
+			}, adaptToolToSdkCallback(tool, authResult.auth, recorder));
+			const transport = new _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js.WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+			await server.connect(transport);
+			return await transport.handleRequest(request);
+		} catch (err) {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			require_logger.log.error("mcp.transport_error", {
+				...require_logger.describeError(err),
+				outcome: "500 internal error"
+			});
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return createGatedHandler({
+		authorizer,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
+}
+//#endregion
+Object.defineProperty(exports, "createMcpProtocolHandler", {
+	enumerable: true,
+	get: function() {
+		return createMcpProtocolHandler;
+	}
+});

package/dist/{package-CYA-5C24.js → package-DMs4EVwG.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.29.0-rc.2";
+var version = "0.29.0-rc.4";
 //#endregion
 export { version as t };

package/dist/{package-DNSwCau1.cjs → package-Xk8p8Q_E.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.29.0-rc.2";
+var version = "0.29.0-rc.4";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-CRdT2Fai.cjs");
+const require_mcp = require("../../mcp-DtHM-41c.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,7 +1,7 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-Cqr7Jps0.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-DIYS7zBP.cjs";
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "origin_rejected" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
@@ -18,9 +18,6 @@ interface InvocationRecord {
   /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
    *  POST discovery) is distinguishable; absent on tool-call records. */
   httpMethod?: string;
-  /** Wire surface that served the call; absent on records emitted before
-   *  protocol classification (auth gate, transport faults). */
-  protocol?: "2026-07-28" | "legacy";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/protocols/mcp/index.d.ts

@@ -1,7 +1,7 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.js";
-import { t as McpRuntimeOptions } from "../../authorize-Bpz8oxjF.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../../authorize-CqYsQYfa.js";
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "origin_rejected" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
@@ -18,9 +18,6 @@ interface InvocationRecord {
   /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
    *  POST discovery) is distinguishable; absent on tool-call records. */
   httpMethod?: string;
-  /** Wire surface that served the call; absent on records emitted before
-   *  protocol classification (auth gate, transport faults). */
-  protocol?: "2026-07-28" | "legacy";
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-Bl7pQYdv.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BLs6_g8i.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_cors = require("../cors-DNzLB6qa.cjs");
+const require_authorize = require("../authorize-CKMlIxm9.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
 	});
@@ -14,7 +14,7 @@ function notFound() {
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
 	const body = {
-		resource: require_cors.resolveProtectedResource(auth, request, options),
+		resource: require_authorize.resolveProtectedResource(auth, request, options),
 		authorization_servers: [issuer],
 		bearer_methods_supported: ["header"],
 		resource_name: auth.resourceName ?? mcp.title,
@@ -24,7 +24,7 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 	return body;
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-	const runtime = require_cors.getOAuthRuntime(mcp, options);
+	const runtime = require_authorize.getOAuthRuntime(mcp, options);
 	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
 		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
 		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) require_logger.log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
@@ -35,9 +35,9 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const vary = varyHeaders.join(", ");
 	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
+		if (request.method !== "GET" && request.method !== "HEAD") return require_authorize.methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
 			Vary: vary
 		};
@@ -49,14 +49,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				...require_logger.describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			return require_cors.oauthConfigurationErrorResponse();
+			return require_authorize.oauthConfigurationErrorResponse();
 		}
 	};
 	return async (request) => {
-		const cors = require_cors.evaluateCors(request, mcp.allowedOrigins);
-		if (!cors.ok) return require_cors.finalizeWireResponse(request, cors.response);
-		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
-		return require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request)));
+		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse("GET, HEAD, OPTIONS");
+		return require_authorize.finalizeWireResponse(request, await respond(request));
 	};
 }
 //#endregion

package/dist/protocols/oauth-metadata.d.cts

@@ -1,5 +1,5 @@
-import { u as McpDefinition } from "../types-DnGEKnvI.cjs";
-import { t as McpRuntimeOptions } from "../authorize-Cqr7Jps0.cjs";
+import { c as McpDefinition } from "../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../authorize-DIYS7zBP.cjs";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.ts

@@ -1,5 +1,5 @@
-import { u as McpDefinition } from "../types-DnGEKnvI.js";
-import { t as McpRuntimeOptions } from "../authorize-Bpz8oxjF.js";
+import { c as McpDefinition } from "../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../authorize-CqYsQYfa.js";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { d as finalizeWireResponse, f as methodNotAllowed, i as oauthConfigurationErrorResponse, o as resolveProtectedResource, r as getOAuthRuntime, t as evaluateCors, u as JSON_HEADERS } from "../cors-C_VffY86.js";
+import { a as resolveProtectedResource, d as methodNotAllowed, f as corsPreflightResponse, l as JSON_HEADERS, n as getOAuthRuntime, r as oauthConfigurationErrorResponse, u as finalizeWireResponse } from "../authorize-b3VqTC_7.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -52,10 +52,8 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 		}
 	};
 	return async (request) => {
-		const cors = evaluateCors(request, mcp.allowedOrigins);
-		if (!cors.ok) return finalizeWireResponse(request, cors.response);
-		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
-		return finalizeWireResponse(request, cors.withHeaders(await respond(request)));
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
+		return finalizeWireResponse(request, await respond(request));
 	};
 }
 //#endregion

package/dist/stacks/supabase/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_cors = require("../../cors-DNzLB6qa.cjs");
+const require_authorize = require("../../authorize-CKMlIxm9.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CRdT2Fai.cjs");
+const require_mcp = require("../../mcp-DtHM-41c.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -29,7 +29,7 @@ function isMetadataPath(pathname) {
 */
 function createSupabaseHandler(mcp, options = {}) {
 	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
+	if (resourcePath !== void 0) require_authorize.assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
 	const runtimeOptions = {
@@ -45,7 +45,7 @@ function createSupabaseHandler(mcp, options = {}) {
 	return async (request) => {
 		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
 		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req);
-		return mcpHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }));
+		return mcpHandler(req, require_authorize.createRecorderForRuntime(mcp, { stack: "supabase" }));
 	};
 }
 //#endregion