@lovable.dev/mcp-js 0.5.1 → 0.7.0

package/dist/stacks/tanstack/index.cjs

@@ -43,17 +43,71 @@ function methodNotAllowed(allow) {
   });
 }
 
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
 // src/core/promise.ts
-function cachedPromise(load) {
+function cachedPromise(load, label) {
   let settled = false;
   let value;
   return async () => {
-    if (settled)
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
       return value;
-    const loaded = await load();
-    settled = true;
-    value = loaded;
-    return loaded;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
   };
 }
 
@@ -129,13 +183,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
       errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
   throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "error" });
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -145,6 +202,7 @@ async function fetchOAuthServerMetadata(url, expectedIssuer) {
   }
   parseSafeUrl("discovered issuer", json.issuer);
   if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
     throw new Error("issuer mismatch");
   }
   if (typeof json.jwks_uri !== "string") {
@@ -157,6 +215,11 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
     throw new OAuthConfigurationError(
       `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
     );
@@ -164,10 +227,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 }
 function createOAuthDiscoveryResolver(auth) {
   const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(() => fetchIssuerOAuthServerMetadata(configuredIssuer));
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
   return {
     resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => auth.jwksUri ?? (await oauthServerMetadata()).jwks_uri
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
   };
 }
 
@@ -230,6 +304,14 @@ var OAuthTokenError = class extends Error {
 function resolveAcceptedAudiences(auth, resource) {
   return auth.acceptedAudiences ?? [resource];
 }
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
 function isJwksFetchFailure(err) {
   if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
     return true;
@@ -251,19 +333,23 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     return payload;
   } catch (err) {
     if (isJwksFetchFailure(err)) {
+      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
       throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
 }
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
     throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
   }
 }
 function assertOAuthClientClaim(auth, clientId) {
   if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
     throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
   }
 }
@@ -288,17 +374,23 @@ function buildMcpAuthContext(args) {
   };
 }
 function createOAuthTokenVerifier(auth, discovery) {
-  const loadRemoteJwksKeySet = cachedPromise(
-    () => discovery.resolveJwksUri().then((jwksURI) => (0, import_jose.createRemoteJWKSet)(new URL(jwksURI)))
-  );
   return async (token, request, options) => {
     const resource = resolveProtectedResource(auth, request, options);
     const issuer = await discovery.resolveIssuer();
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    const claims = await verifyJwtClaims(token, await loadRemoteJwksKeySet(), issuer, acceptedAudiences, auth);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.keyset_created", { jwksUri });
+    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
     return context;
   };
 }
@@ -398,22 +490,27 @@ function createRequestAuthorizer(mcp, options = {}) {
       if (runtime.kind === "unconfigured")
         return { ok: true };
       const token = parseBearerToken(request);
-      if (!token)
+      if (!token) {
+        log.info("auth.no_bearer_token", { outcome: "401" });
         return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+      }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
         if (err instanceof OAuthConfigurationError) {
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           return { ok: false, response: oauthConfigurationErrorResponse() };
         }
         if (err instanceof OAuthTokenError) {
+          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
             response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
           };
         }
+        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
           response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")
@@ -466,6 +563,26 @@ var ToolContext = class {
   }
 };
 
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth) {
   return async (first) => {
@@ -484,7 +601,7 @@ function adaptToolToSdkCallback(tool, auth) {
 }
 function createMcpProtocolHandler(mcp, options = {}) {
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
@@ -511,28 +628,31 @@ function createMcpProtocolHandler(mcp, options = {}) {
       });
       await server.connect(transport);
       return await transport.handleRequest(request);
-    } catch {
+    } catch (err) {
+      log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
         { status: 500 }
       );
     }
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/oauth-metadata.ts
-var CORS_ORIGIN = { "Access-Control-Allow-Origin": "*" };
-function withCors(response) {
-  response.headers.set("Access-Control-Allow-Origin", "*");
-  return response;
-}
 function notFound() {
-  return new Response(JSON.stringify({ error: "not found" }), {
-    status: 404,
-    // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
-    // then served past a later deploy that enables OAuth and starts returning 200.
-    headers: { ...JSON_HEADERS, ...CORS_ORIGIN, "Cache-Control": "no-store" }
-  });
+  return withCors(
+    new Response(JSON.stringify({ error: "not found" }), {
+      status: 404,
+      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
+      // then served past a later deploy that enables OAuth and starts returning 200.
+      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+    })
+  );
 }
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
   const issuer = await discovery.resolveIssuer();
@@ -557,17 +677,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   return async (request) => {
     if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
       return notFound();
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: { ...CORS_ORIGIN, "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS" }
-      });
-    }
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
     if (request.method !== "GET" && request.method !== "HEAD")
       return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
     const headers = {
       ...JSON_HEADERS,
-      ...CORS_ORIGIN,
       "Cache-Control": "public, max-age=300",
       Vary: "Host"
     };
@@ -579,9 +694,10 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
         runtime.options,
         runtime.discovery
       );
-      const response = Response.json(metadata, { headers });
+      const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
-    } catch {
+    } catch (err) {
+      log.error("oauth.metadata.config_error", { ...describeError(err), outcome: "500 oauth configuration error" });
       const response = withCors(oauthConfigurationErrorResponse());
       return request.method === "HEAD" ? headResponse(response) : response;
     }
@@ -603,12 +719,12 @@ function shapeToJsonSchema(shape) {
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD");
+      return methodNotAllowed("GET, HEAD, OPTIONS");
     const body = {
       server: { name: mcp.name, version: mcp.version, title: mcp.title },
       tools: mcp.tools.map((tool) => ({
@@ -623,6 +739,11 @@ function createListToolsHandler(mcp, options = {}) {
     const response = Response.json(body);
     return request.method === "HEAD" ? headResponse(response) : response;
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/rest/invoke-tool.ts
@@ -642,12 +763,12 @@ function isEmptyArgs(value) {
 function createInvokeToolHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request, toolName) => {
+  const handle = async (request, toolName) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "POST")
-      return methodNotAllowed("POST");
+      return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
     if (!tool) {
       return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
@@ -715,6 +836,11 @@ function createInvokeToolHandler(mcp, options = {}) {
       isError: result.isError
     });
   };
+  return async (request, toolName) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName));
+  };
 }
 
 // src/stacks/tanstack/handlers.ts

package/dist/stacks/tanstack/index.js

@@ -1,16 +1,16 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-GLG5RZGE.js";
+} from "../../chunk-G5GWSV5D.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-DDF63QWG.js";
+} from "../../chunk-722HKLIU.js";
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-VD6CS7Y6.js";
+} from "../../chunk-53M2X7FU.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-XEDRJFAR.js";
-import "../../chunk-QA3FWDUV.js";
+import "../../chunk-NTXHOUK6.js";
+import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 
 // src/stacks/tanstack/handlers.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and the framework adapter (TanStack today, Supabase Edge Functions next) emits the route(s) at build time.",
   "type": "module",
   "repository": {

package/dist/chunk-QA3FWDUV.js

@@ -1,40 +0,0 @@
-// src/core/url.ts
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function isLocalHTTPHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function urlSafetyProblem(url) {
-  const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
-  if (url.protocol !== "https:" && !isAllowedHTTP) {
-    return "must use https://, except localhost development URLs";
-  }
-  if (url.username || url.password) {
-    return "must not include credentials";
-  }
-  if (url.search || url.hash) {
-    return "must not include query or fragment";
-  }
-  return void 0;
-}
-
-// src/core/validation.ts
-function parseSafeUrl(subject, raw, ErrorClass = Error) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new ErrorClass(`${subject} must be an absolute URL`);
-  }
-  const problem = urlSafetyProblem(url);
-  if (problem) {
-    throw new ErrorClass(`${subject} ${problem}`);
-  }
-  return url;
-}
-
-export {
-  trimTrailingSlash,
-  parseSafeUrl
-};