@lovable.dev/mcp-js 0.6.0 → 0.7.0

package/dist/protocols/rest/index.cjs

@@ -41,17 +41,71 @@ function methodNotAllowed(allow) {
   });
 }
 
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
 // src/core/promise.ts
-function cachedPromise(load) {
+function cachedPromise(load, label) {
   let settled = false;
   let value;
   return async () => {
-    if (settled)
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
       return value;
-    const loaded = await load();
-    settled = true;
-    value = loaded;
-    return loaded;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
   };
 }
 
@@ -127,13 +181,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
       errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
   throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "error" });
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -143,6 +200,7 @@ async function fetchOAuthServerMetadata(url, expectedIssuer) {
   }
   parseSafeUrl("discovered issuer", json.issuer);
   if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
     throw new Error("issuer mismatch");
   }
   if (typeof json.jwks_uri !== "string") {
@@ -155,6 +213,11 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
     throw new OAuthConfigurationError(
       `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
     );
@@ -162,10 +225,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 }
 function createOAuthDiscoveryResolver(auth) {
   const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(() => fetchIssuerOAuthServerMetadata(configuredIssuer));
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
   return {
     resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => auth.jwksUri ?? (await oauthServerMetadata()).jwks_uri
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
   };
 }
 
@@ -228,6 +302,14 @@ var OAuthTokenError = class extends Error {
 function resolveAcceptedAudiences(auth, resource) {
   return auth.acceptedAudiences ?? [resource];
 }
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
 function isJwksFetchFailure(err) {
   if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
     return true;
@@ -249,19 +331,23 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     return payload;
   } catch (err) {
     if (isJwksFetchFailure(err)) {
+      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
       throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
 }
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
     throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
   }
 }
 function assertOAuthClientClaim(auth, clientId) {
   if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
     throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
   }
 }
@@ -286,17 +372,23 @@ function buildMcpAuthContext(args) {
   };
 }
 function createOAuthTokenVerifier(auth, discovery) {
-  const loadRemoteJwksKeySet = cachedPromise(
-    () => discovery.resolveJwksUri().then((jwksURI) => (0, import_jose.createRemoteJWKSet)(new URL(jwksURI)))
-  );
   return async (token, request, options) => {
     const resource = resolveProtectedResource(auth, request, options);
     const issuer = await discovery.resolveIssuer();
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    const claims = await verifyJwtClaims(token, await loadRemoteJwksKeySet(), issuer, acceptedAudiences, auth);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.keyset_created", { jwksUri });
+    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
     return context;
   };
 }
@@ -396,22 +488,27 @@ function createRequestAuthorizer(mcp, options = {}) {
       if (runtime.kind === "unconfigured")
         return { ok: true };
       const token = parseBearerToken(request);
-      if (!token)
+      if (!token) {
+        log.info("auth.no_bearer_token", { outcome: "401" });
         return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+      }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
         if (err instanceof OAuthConfigurationError) {
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           return { ok: false, response: oauthConfigurationErrorResponse() };
         }
         if (err instanceof OAuthTokenError) {
+          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
             response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
           };
         }
+        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
           response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")

package/dist/protocols/rest/index.js

@@ -1,10 +1,10 @@
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-SYI32IRK.js";
+} from "../../chunk-53M2X7FU.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-ZKKLOL2C.js";
-import "../../chunk-QA3FWDUV.js";
+import "../../chunk-NTXHOUK6.js";
+import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {
   createInvokeToolHandler,

package/dist/stacks/tanstack/index.cjs

@@ -43,17 +43,71 @@ function methodNotAllowed(allow) {
   });
 }
 
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
 // src/core/promise.ts
-function cachedPromise(load) {
+function cachedPromise(load, label) {
   let settled = false;
   let value;
   return async () => {
-    if (settled)
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
       return value;
-    const loaded = await load();
-    settled = true;
-    value = loaded;
-    return loaded;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
   };
 }
 
@@ -129,13 +183,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
       errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
   throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "error" });
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -145,6 +202,7 @@ async function fetchOAuthServerMetadata(url, expectedIssuer) {
   }
   parseSafeUrl("discovered issuer", json.issuer);
   if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
     throw new Error("issuer mismatch");
   }
   if (typeof json.jwks_uri !== "string") {
@@ -157,6 +215,11 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
     throw new OAuthConfigurationError(
       `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
     );
@@ -164,10 +227,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 }
 function createOAuthDiscoveryResolver(auth) {
   const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(() => fetchIssuerOAuthServerMetadata(configuredIssuer));
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
   return {
     resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => auth.jwksUri ?? (await oauthServerMetadata()).jwks_uri
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
   };
 }
 
@@ -230,6 +304,14 @@ var OAuthTokenError = class extends Error {
 function resolveAcceptedAudiences(auth, resource) {
   return auth.acceptedAudiences ?? [resource];
 }
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
 function isJwksFetchFailure(err) {
   if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
     return true;
@@ -251,19 +333,23 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     return payload;
   } catch (err) {
     if (isJwksFetchFailure(err)) {
+      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
       throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
 }
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
     throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
   }
 }
 function assertOAuthClientClaim(auth, clientId) {
   if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
     throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
   }
 }
@@ -288,17 +374,23 @@ function buildMcpAuthContext(args) {
   };
 }
 function createOAuthTokenVerifier(auth, discovery) {
-  const loadRemoteJwksKeySet = cachedPromise(
-    () => discovery.resolveJwksUri().then((jwksURI) => (0, import_jose.createRemoteJWKSet)(new URL(jwksURI)))
-  );
   return async (token, request, options) => {
     const resource = resolveProtectedResource(auth, request, options);
     const issuer = await discovery.resolveIssuer();
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    const claims = await verifyJwtClaims(token, await loadRemoteJwksKeySet(), issuer, acceptedAudiences, auth);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.keyset_created", { jwksUri });
+    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
     return context;
   };
 }
@@ -398,22 +490,27 @@ function createRequestAuthorizer(mcp, options = {}) {
       if (runtime.kind === "unconfigured")
         return { ok: true };
       const token = parseBearerToken(request);
-      if (!token)
+      if (!token) {
+        log.info("auth.no_bearer_token", { outcome: "401" });
         return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+      }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
         if (err instanceof OAuthConfigurationError) {
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           return { ok: false, response: oauthConfigurationErrorResponse() };
         }
         if (err instanceof OAuthTokenError) {
+          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
             response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
           };
         }
+        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
           response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")
@@ -531,7 +628,8 @@ function createMcpProtocolHandler(mcp, options = {}) {
       });
       await server.connect(transport);
       return await transport.handleRequest(request);
-    } catch {
+    } catch (err) {
+      log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
         { status: 500 }
@@ -598,7 +696,8 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
       );
       const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
-    } catch {
+    } catch (err) {
+      log.error("oauth.metadata.config_error", { ...describeError(err), outcome: "500 oauth configuration error" });
       const response = withCors(oauthConfigurationErrorResponse());
       return request.method === "HEAD" ? headResponse(response) : response;
     }

package/dist/stacks/tanstack/index.js

@@ -1,16 +1,16 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-NJ5WBRYI.js";
+} from "../../chunk-G5GWSV5D.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-K2T4WTKX.js";
+} from "../../chunk-722HKLIU.js";
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-SYI32IRK.js";
+} from "../../chunk-53M2X7FU.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-ZKKLOL2C.js";
-import "../../chunk-QA3FWDUV.js";
+import "../../chunk-NTXHOUK6.js";
+import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 
 // src/stacks/tanstack/handlers.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and the framework adapter (TanStack today, Supabase Edge Functions next) emits the route(s) at build time.",
   "type": "module",
   "repository": {

package/dist/chunk-QA3FWDUV.js

@@ -1,40 +0,0 @@
-// src/core/url.ts
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function isLocalHTTPHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function urlSafetyProblem(url) {
-  const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
-  if (url.protocol !== "https:" && !isAllowedHTTP) {
-    return "must use https://, except localhost development URLs";
-  }
-  if (url.username || url.password) {
-    return "must not include credentials";
-  }
-  if (url.search || url.hash) {
-    return "must not include query or fragment";
-  }
-  return void 0;
-}
-
-// src/core/validation.ts
-function parseSafeUrl(subject, raw, ErrorClass = Error) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new ErrorClass(`${subject} must be an absolute URL`);
-  }
-  const problem = urlSafetyProblem(url);
-  if (problem) {
-    throw new ErrorClass(`${subject} ${problem}`);
-  }
-  return url;
-}
-
-export {
-  trimTrailingSlash,
-  parseSafeUrl
-};