@lovable.dev/mcp-js 0.6.0 → 0.7.1

package/dist/protocols/mcp/index.cjs

@@ -31,17 +31,71 @@ var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server
 // src/core/http.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };
 
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
 // src/core/promise.ts
-function cachedPromise(load) {
+function cachedPromise(load, label) {
   let settled = false;
   let value;
   return async () => {
-    if (settled)
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
       return value;
-    const loaded = await load();
-    settled = true;
-    value = loaded;
-    return loaded;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
   };
 }
 
@@ -117,13 +171,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
       errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
   throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "error" });
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -133,6 +190,7 @@ async function fetchOAuthServerMetadata(url, expectedIssuer) {
   }
   parseSafeUrl("discovered issuer", json.issuer);
   if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
     throw new Error("issuer mismatch");
   }
   if (typeof json.jwks_uri !== "string") {
@@ -145,6 +203,11 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
     throw new OAuthConfigurationError(
       `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
     );
@@ -152,10 +215,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 }
 function createOAuthDiscoveryResolver(auth) {
   const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(() => fetchIssuerOAuthServerMetadata(configuredIssuer));
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
   return {
     resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => auth.jwksUri ?? (await oauthServerMetadata()).jwks_uri
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
   };
 }
 
@@ -207,6 +281,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -218,12 +293,25 @@ var OAuthTokenError = class extends Error {
 function resolveAcceptedAudiences(auth, resource) {
   return auth.acceptedAudiences ?? [resource];
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -238,20 +326,20 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
 }
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
     throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
   }
 }
 function assertOAuthClientClaim(auth, clientId) {
   if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
     throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
   }
 }
@@ -276,17 +364,23 @@ function buildMcpAuthContext(args) {
   };
 }
 function createOAuthTokenVerifier(auth, discovery) {
-  const loadRemoteJwksKeySet = cachedPromise(
-    () => discovery.resolveJwksUri().then((jwksURI) => (0, import_jose.createRemoteJWKSet)(new URL(jwksURI)))
-  );
   return async (token, request, options) => {
     const resource = resolveProtectedResource(auth, request, options);
     const issuer = await discovery.resolveIssuer();
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    const claims = await verifyJwtClaims(token, await loadRemoteJwksKeySet(), issuer, acceptedAudiences, auth);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
     return context;
   };
 }
@@ -378,22 +472,27 @@ function createRequestAuthorizer(mcp, options = {}) {
       if (runtime.kind === "unconfigured")
         return { ok: true };
       const token = parseBearerToken(request);
-      if (!token)
+      if (!token) {
+        log.info("auth.no_bearer_token", { outcome: "401" });
         return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+      }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
         assertRequiredScopes(runtime.auth, auth);
         return { ok: true, auth };
       } catch (err) {
         if (err instanceof OAuthConfigurationError) {
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
           return { ok: false, response: oauthConfigurationErrorResponse() };
         }
         if (err instanceof OAuthTokenError) {
+          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
             response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
           };
         }
+        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
           response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")
@@ -511,7 +610,8 @@ function createMcpProtocolHandler(mcp, options = {}) {
       });
       await server.connect(transport);
       return await transport.handleRequest(request);
-    } catch {
+    } catch (err) {
+      log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
       return Response.json(
         { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
         { status: 500 }

package/dist/protocols/mcp/index.js

@@ -1,9 +1,9 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-NJ5WBRYI.js";
+} from "../../chunk-3XPKR4G6.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-ZKKLOL2C.js";
-import "../../chunk-QA3FWDUV.js";
+import "../../chunk-HRMLGCXV.js";
+import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {
   createMcpProtocolHandler

package/dist/protocols/oauth-metadata.cjs

@@ -36,17 +36,71 @@ function methodNotAllowed(allow) {
   });
 }
 
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
 // src/core/promise.ts
-function cachedPromise(load) {
+function cachedPromise(load, label) {
   let settled = false;
   let value;
   return async () => {
-    if (settled)
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
       return value;
-    const loaded = await load();
-    settled = true;
-    value = loaded;
-    return loaded;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
   };
 }
 
@@ -122,13 +176,16 @@ async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer)
     try {
       return await fetchOAuthServerMetadata(url, expectedIssuer);
     } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
       errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
   throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
 }
 async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "error" });
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
   if (!response.ok) {
     throw new Error(String(response.status));
   }
@@ -138,6 +195,7 @@ async function fetchOAuthServerMetadata(url, expectedIssuer) {
   }
   parseSafeUrl("discovered issuer", json.issuer);
   if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
     throw new Error("issuer mismatch");
   }
   if (typeof json.jwks_uri !== "string") {
@@ -150,6 +208,11 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
   try {
     return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
   } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
     throw new OAuthConfigurationError(
       `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
     );
@@ -157,10 +220,21 @@ async function fetchIssuerOAuthServerMetadata(issuer) {
 }
 function createOAuthDiscoveryResolver(auth) {
   const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(() => fetchIssuerOAuthServerMetadata(configuredIssuer));
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
   return {
     resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => auth.jwksUri ?? (await oauthServerMetadata()).jwks_uri
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
   };
 }
 
@@ -209,6 +283,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -220,12 +295,25 @@ var OAuthTokenError = class extends Error {
 function resolveAcceptedAudiences(auth, resource) {
   return auth.acceptedAudiences ?? [resource];
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -240,20 +328,20 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
 }
 function assertNonEmptySubject(claims) {
   const sub = claims["sub"];
   if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
     throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
   }
 }
 function assertOAuthClientClaim(auth, clientId) {
   if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
     throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
   }
 }
@@ -278,17 +366,23 @@ function buildMcpAuthContext(args) {
   };
 }
 function createOAuthTokenVerifier(auth, discovery) {
-  const loadRemoteJwksKeySet = cachedPromise(
-    () => discovery.resolveJwksUri().then((jwksURI) => (0, import_jose.createRemoteJWKSet)(new URL(jwksURI)))
-  );
   return async (token, request, options) => {
     const resource = resolveProtectedResource(auth, request, options);
     const issuer = await discovery.resolveIssuer();
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    const claims = await verifyJwtClaims(token, await loadRemoteJwksKeySet(), issuer, acceptedAudiences, auth);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
     assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
     return context;
   };
 }
@@ -390,7 +484,8 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
       );
       const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
-    } catch {
+    } catch (err) {
+      log.error("oauth.metadata.config_error", { ...describeError(err), outcome: "500 oauth configuration error" });
       const response = withCors(oauthConfigurationErrorResponse());
       return request.method === "HEAD" ? headResponse(response) : response;
     }

package/dist/protocols/oauth-metadata.js

@@ -1,8 +1,8 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-K2T4WTKX.js";
-import "../chunk-ZKKLOL2C.js";
-import "../chunk-QA3FWDUV.js";
+} from "../chunk-W7F6JRDB.js";
+import "../chunk-HRMLGCXV.js";
+import "../chunk-QC3DXQTH.js";
 import "../chunk-6DXGZZA4.js";
 export {
   createOAuthProtectedResourceMetadataHandler