@lovable.dev/mcp-js 0.29.0-rc.2 → 0.29.0-rc.4

package/dist/stacks/supabase/index.d.cts

@@ -1,4 +1,4 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.d.ts

@@ -1,4 +1,4 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.js

@@ -1,9 +1,9 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../cors-C_VffY86.js";
+import { i as assertResourcePathShape, o as createRecorderForRuntime } from "../../authorize-b3VqTC_7.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Bl7pQYdv.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BLs6_g8i.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-DNSwCau1.cjs");
+const require_package = require("../../package-Xk8p8Q_E.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-Bh_WpbxU.cjs";
+import { t as McpPluginApi } from "../../io-Dx0nPc1-.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-DrHivYt0.js";
+import { t as McpPluginApi } from "../../io-DP3icuxa.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-CYA-5C24.js";
+import { t as version } from "../../package-DMs4EVwG.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-DNzLB6qa.cjs");
-const require_mcp = require("../../mcp-CRdT2Fai.cjs");
+const require_authorize = require("../../authorize-CKMlIxm9.cjs");
+const require_mcp = require("../../mcp-DtHM-41c.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**
@@ -11,7 +11,7 @@ const STACK = "tanstack";
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-Cqr7Jps0.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-DIYS7zBP.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { u as McpDefinition } from "../../types-DnGEKnvI.js";
-import { t as McpRuntimeOptions } from "../../authorize-Bpz8oxjF.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../../authorize-CqYsQYfa.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,7 +1,7 @@
-import { s as createRecorderForRuntime } from "../../cors-C_VffY86.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Bl7pQYdv.js";
+import { o as createRecorderForRuntime } from "../../authorize-b3VqTC_7.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BLs6_g8i.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**

package/dist/stacks/tanstack/vite.cjs

@@ -64,16 +64,13 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath((0, node_path.relative)((0, node_path.dirname)(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath((0, node_path.relative)(projectRoot, route.file));
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) {
-		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
-		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
-	} else optionEntries.push("trustForwardedHost: true");
-	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -179,7 +176,6 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
-	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = (0, node_path.resolve)(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath);
@@ -206,7 +202,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-Bh_WpbxU.cjs";
+import { t as McpPluginApi } from "../../io-Dx0nPc1-.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -57,9 +57,6 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
-  /** Derive the public scheme from `X-Forwarded-Proto`; safe only behind an
-   * overwriting proxy. @default true */
-  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-DrHivYt0.js";
+import { t as McpPluginApi } from "../../io-DP3icuxa.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -57,9 +57,6 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
-  /** Derive the public scheme from `X-Forwarded-Proto`; safe only behind an
-   * overwriting proxy. @default true */
-  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.js

@@ -60,16 +60,13 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath(relative(dirname(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath(relative(projectRoot, route.file));
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) {
-		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
-		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
-	} else optionEntries.push("trustForwardedHost: true");
-	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -175,7 +172,6 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
-	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = resolve(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath);
@@ -202,7 +198,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/{types-DnGEKnvI.d.cts → types-C0Wgm9zp.d.cts}

@@ -85,46 +85,16 @@ interface McpAuthConfig {
 }
 //#endregion
 //#region src/auth/context.d.ts
-/** What the client declared about itself on the in-flight request. Unverified
- * client input — a hint, never an authorization signal (use the auth accessors). */
-interface McpClientInfo {
-  /** Protocol era of the in-flight request. */
-  protocol: "2026-07-28" | "legacy";
-  /** Client name/version from the request envelope (`2026-07-28` era only). */
-  info?: {
-    name: string;
-    version: string;
-    title?: string;
-  };
-  /** Client capabilities from the request envelope (`2026-07-28` era only). */
-  capabilities?: Record<string, unknown>;
-  /** Extension declarations (`capabilities.extensions`), keyed by extension id. */
-  extensions?: Record<string, Record<string, unknown>>;
-}
-/** A progress notification payload. `progress` should increase monotonically. */
-interface ProgressUpdate {
-  progress: number;
-  total?: number;
-  message?: string;
-}
-/** Per-request runtime surface threaded into `ToolContext` by the protocol layer. */
-interface ToolRequestContext {
-  signal?: AbortSignal;
-  client?: McpClientInfo;
-  sendProgress?: (update: ProgressUpdate) => Promise<void>;
-}
-/** The per-request context passed to every tool handler as its second argument. The
- * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
+/**
+ * The auth surface passed to every tool handler as its second argument. It wraps
+ * the verified per-request auth context in a private field, so the context — and
+ * the bearer token inside it — can't be read, enumerated, spread, or
+ * `JSON.stringify`'d off the instance; the accessors below are the only way out.
+ * `getToken()` is the single intentional escape hatch for the raw bearer.
+ */
 declare class ToolContext {
   #private;
-  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
-  /** Aborts when the client cancels the request or disconnects. */
-  get signal(): AbortSignal;
-  /** What the client declared about itself on this request. Unverified input. */
-  get client(): McpClientInfo;
-  /** Send a progress notification for this call. A no-op when the client
-   * didn't request progress (no `progressToken` on the request). */
-  progress(update: ProgressUpdate): Promise<void>;
+  constructor(auth: McpAuthContext | undefined);
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -180,11 +150,9 @@ type MetricsConfig = boolean | MetricsOptions;
 type ZodSchema = ZodType;
 /**
  * A raw zod shape (`{ text: z.string(), n: z.number() }`) — the format
- * `defineTool`'s `inputSchema` expects and the object shorthand accepted by
- * `outputSchema`.
+ * `defineTool`'s `inputSchema`/`outputSchema` expects.
  */
 type ZodRawShape$1 = ZodRawShape;
-type ZodOutputSchema = ZodSchema | ZodRawShape$1;
 /**
  * Infer the parsed-output type of a zod raw shape — given
  * `{ text: ZodString, n: ZodNumber }`, produces `{ text: string, n: number }`.
@@ -249,8 +217,8 @@ type EmbeddedResource = EmbeddedTextResource | EmbeddedBlobResource;
 interface ResourceLinkIcon {
   src: string;
   mimeType?: string;
-  /** Array per MCP 2026-07-28; legacy space-separated strings remain accepted. */
-  sizes?: string | string[];
+  /** Space-separated dimension string, HTML `<link sizes>` convention (e.g. `"16x16 32x32"`). */
+  sizes?: string;
   theme?: "light" | "dark";
 }
 interface ResourceLink extends ContentBlockBase {
@@ -273,10 +241,6 @@ type ContentBlock = TextContent | ImageContent | AudioContent | EmbeddedResource
  * the tool returns to the caller.
  */
 type ToolContent = ContentBlock[];
-type JsonValue = null | boolean | number | string | JsonValue[] | {
-  [key: string]: JsonValue;
-};
-type McpAllowedOrigins = "any" | readonly string[];
 /**
  * Per-tool client hints (not enforcement). `annotations.title` is
  * intentionally omitted — use `ToolDefinition.title`, which the MCP
@@ -294,10 +258,10 @@ interface ToolAnnotations {
 }
 interface ToolHandlerResult {
   content?: ToolContent;
-  structuredContent?: JsonValue;
+  structuredContent?: Record<string, unknown>;
   isError?: boolean;
 }
-interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
+interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined> {
   readonly name: string;
   /** Human-readable display name shown to the user in MCP clients. Required. */
   readonly title: string;
@@ -308,27 +272,32 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly annotations?: ToolAnnotations;
   readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/** Type-erased element of `McpDefinition.tools`; per-tool generic typing
- * happens at the `defineTool` call site. */
+/**
+ * Type-erased element of `McpDefinition.tools`. Per-tool generic typing
+ * happens at the `defineTool` call site; see README §6 for the rationale.
+ */
 interface AnyToolDefinition {
   readonly name: string;
   readonly title: string;
   readonly description: string;
   readonly inputSchema?: ZodRawShape$1;
-  readonly outputSchema?: ZodOutputSchema;
+  readonly outputSchema?: ZodRawShape$1;
   readonly annotations?: ToolAnnotations;
   readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
- * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
+/**
+ * Fields a caller supplies when constructing an MCP definition. Pass this
+ * shape to `defineMcp(...)` — its return type is the branded `McpDefinition`,
+ * which is the type every internal factory (`createInvokeToolHandler`,
+ * `createMcpProtocolHandler`, …) consumes. The brand forces consumers
+ * through `defineMcp`'s `assertUniqueNames` + freeze.
+ */
 interface McpDefinitionInput {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
   readonly title: string;
   readonly version: string;
   readonly auth?: McpAuthConfig;
-  /** Cross-origin browser access. Omit to allow only same-origin and non-browser requests. */
-  readonly allowedOrigins?: McpAllowedOrigins;
   /**
    * Server-level prose the LLM reads as context for all tools on this server.
    * Required for the same reason `ToolDefinition.description` is — optional
@@ -349,4 +318,4 @@ type McpDefinition = McpDefinitionInput & {
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { MetricsOptions as C, JwtClaims as D, ToolContext as E, McpAuthConfig as O, MetricsConfig as S, ProgressUpdate as T, ToolDefinition as _, EmbeddedResource as a, ZodRawShape$1 as b, JsonValue as c, McpDefinitionInput as d, ResourceLink as f, ToolContent as g, ToolAnnotations as h, EmbeddedBlobResource as i, McpAllowedOrigins as l, TextContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLinkIcon as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpDefinition as u, ToolHandlerResult as v, McpClientInfo as w, ZodSchema as x, ZodOutputSchema as y };
+export { McpAuthConfig as C, JwtClaims as S, ZodRawShape$1 as _, EmbeddedResource as a, MetricsOptions as b, McpDefinition as c, ResourceLinkIcon as d, TextContent as f, ToolHandlerResult as g, ToolDefinition as h, EmbeddedBlobResource as i, McpDefinitionInput as l, ToolContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ToolAnnotations as p, ContentBlock as r, ImageContent as s, AudioContent as t, ResourceLink as u, ZodSchema as v, ToolContext as x, MetricsConfig as y };

package/dist/{types-DnGEKnvI.d.ts → types-C0Wgm9zp.d.ts}

@@ -85,46 +85,16 @@ interface McpAuthConfig {
 }
 //#endregion
 //#region src/auth/context.d.ts
-/** What the client declared about itself on the in-flight request. Unverified
- * client input — a hint, never an authorization signal (use the auth accessors). */
-interface McpClientInfo {
-  /** Protocol era of the in-flight request. */
-  protocol: "2026-07-28" | "legacy";
-  /** Client name/version from the request envelope (`2026-07-28` era only). */
-  info?: {
-    name: string;
-    version: string;
-    title?: string;
-  };
-  /** Client capabilities from the request envelope (`2026-07-28` era only). */
-  capabilities?: Record<string, unknown>;
-  /** Extension declarations (`capabilities.extensions`), keyed by extension id. */
-  extensions?: Record<string, Record<string, unknown>>;
-}
-/** A progress notification payload. `progress` should increase monotonically. */
-interface ProgressUpdate {
-  progress: number;
-  total?: number;
-  message?: string;
-}
-/** Per-request runtime surface threaded into `ToolContext` by the protocol layer. */
-interface ToolRequestContext {
-  signal?: AbortSignal;
-  client?: McpClientInfo;
-  sendProgress?: (update: ProgressUpdate) => Promise<void>;
-}
-/** The per-request context passed to every tool handler as its second argument. The
- * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
+/**
+ * The auth surface passed to every tool handler as its second argument. It wraps
+ * the verified per-request auth context in a private field, so the context — and
+ * the bearer token inside it — can't be read, enumerated, spread, or
+ * `JSON.stringify`'d off the instance; the accessors below are the only way out.
+ * `getToken()` is the single intentional escape hatch for the raw bearer.
+ */
 declare class ToolContext {
   #private;
-  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
-  /** Aborts when the client cancels the request or disconnects. */
-  get signal(): AbortSignal;
-  /** What the client declared about itself on this request. Unverified input. */
-  get client(): McpClientInfo;
-  /** Send a progress notification for this call. A no-op when the client
-   * didn't request progress (no `progressToken` on the request). */
-  progress(update: ProgressUpdate): Promise<void>;
+  constructor(auth: McpAuthContext | undefined);
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -180,11 +150,9 @@ type MetricsConfig = boolean | MetricsOptions;
 type ZodSchema = ZodType;
 /**
  * A raw zod shape (`{ text: z.string(), n: z.number() }`) — the format
- * `defineTool`'s `inputSchema` expects and the object shorthand accepted by
- * `outputSchema`.
+ * `defineTool`'s `inputSchema`/`outputSchema` expects.
  */
 type ZodRawShape$1 = ZodRawShape;
-type ZodOutputSchema = ZodSchema | ZodRawShape$1;
 /**
  * Infer the parsed-output type of a zod raw shape — given
  * `{ text: ZodString, n: ZodNumber }`, produces `{ text: string, n: number }`.
@@ -249,8 +217,8 @@ type EmbeddedResource = EmbeddedTextResource | EmbeddedBlobResource;
 interface ResourceLinkIcon {
   src: string;
   mimeType?: string;
-  /** Array per MCP 2026-07-28; legacy space-separated strings remain accepted. */
-  sizes?: string | string[];
+  /** Space-separated dimension string, HTML `<link sizes>` convention (e.g. `"16x16 32x32"`). */
+  sizes?: string;
   theme?: "light" | "dark";
 }
 interface ResourceLink extends ContentBlockBase {
@@ -273,10 +241,6 @@ type ContentBlock = TextContent | ImageContent | AudioContent | EmbeddedResource
  * the tool returns to the caller.
  */
 type ToolContent = ContentBlock[];
-type JsonValue = null | boolean | number | string | JsonValue[] | {
-  [key: string]: JsonValue;
-};
-type McpAllowedOrigins = "any" | readonly string[];
 /**
  * Per-tool client hints (not enforcement). `annotations.title` is
  * intentionally omitted — use `ToolDefinition.title`, which the MCP
@@ -294,10 +258,10 @@ interface ToolAnnotations {
 }
 interface ToolHandlerResult {
   content?: ToolContent;
-  structuredContent?: JsonValue;
+  structuredContent?: Record<string, unknown>;
   isError?: boolean;
 }
-interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
+interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined> {
   readonly name: string;
   /** Human-readable display name shown to the user in MCP clients. Required. */
   readonly title: string;
@@ -308,27 +272,32 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly annotations?: ToolAnnotations;
   readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/** Type-erased element of `McpDefinition.tools`; per-tool generic typing
- * happens at the `defineTool` call site. */
+/**
+ * Type-erased element of `McpDefinition.tools`. Per-tool generic typing
+ * happens at the `defineTool` call site; see README §6 for the rationale.
+ */
 interface AnyToolDefinition {
   readonly name: string;
   readonly title: string;
   readonly description: string;
   readonly inputSchema?: ZodRawShape$1;
-  readonly outputSchema?: ZodOutputSchema;
+  readonly outputSchema?: ZodRawShape$1;
   readonly annotations?: ToolAnnotations;
   readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
- * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
+/**
+ * Fields a caller supplies when constructing an MCP definition. Pass this
+ * shape to `defineMcp(...)` — its return type is the branded `McpDefinition`,
+ * which is the type every internal factory (`createInvokeToolHandler`,
+ * `createMcpProtocolHandler`, …) consumes. The brand forces consumers
+ * through `defineMcp`'s `assertUniqueNames` + freeze.
+ */
 interface McpDefinitionInput {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
   readonly title: string;
   readonly version: string;
   readonly auth?: McpAuthConfig;
-  /** Cross-origin browser access. Omit to allow only same-origin and non-browser requests. */
-  readonly allowedOrigins?: McpAllowedOrigins;
   /**
    * Server-level prose the LLM reads as context for all tools on this server.
    * Required for the same reason `ToolDefinition.description` is — optional
@@ -349,4 +318,4 @@ type McpDefinition = McpDefinitionInput & {
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { MetricsOptions as C, JwtClaims as D, ToolContext as E, McpAuthConfig as O, MetricsConfig as S, ProgressUpdate as T, ToolDefinition as _, EmbeddedResource as a, ZodRawShape$1 as b, JsonValue as c, McpDefinitionInput as d, ResourceLink as f, ToolContent as g, ToolAnnotations as h, EmbeddedBlobResource as i, McpAllowedOrigins as l, TextContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLinkIcon as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpDefinition as u, ToolHandlerResult as v, McpClientInfo as w, ZodSchema as x, ZodOutputSchema as y };
+export { McpAuthConfig as C, JwtClaims as S, ZodRawShape$1 as _, EmbeddedResource as a, MetricsOptions as b, McpDefinition as c, ResourceLinkIcon as d, TextContent as f, ToolHandlerResult as g, ToolDefinition as h, EmbeddedBlobResource as i, McpDefinitionInput as l, ToolContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ToolAnnotations as p, ContentBlock as r, ImageContent as s, AudioContent as t, ResourceLink as u, ZodSchema as v, ToolContext as x, MetricsConfig as y };

package/package.json

@@ -1,9 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.29.0-rc.2",
-  "engines": {
-    "node": ">=20"
-  },
+  "version": "0.29.0-rc.4",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {
@@ -109,7 +106,6 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.28.0",
-    "@modelcontextprotocol/server": "2.0.0",
     "esbuild": "^0.27.0",
     "jose": "^6.2.2"
   },