@lovable.dev/mcp-js 0.7.0 → 0.8.0

package/README.internal.md

@@ -133,7 +133,11 @@ src/
   stacks/
     tanstack/
       handlers.ts                # TanStack route-ctx adapters
-      vite.ts                    # mcpPlugin (route emission + stale-file cleanup)
+      vite.ts                    # mcpPlugin (route emission + stale-file cleanup; no manifest)
+      ssr-loader.ts              # produceViaSsr: load the entry via a throwaway Vite SSR server
+      extract-manifest.ts        # project a defineMcp result to the manifest (types + manifestFromDefinition)
+      manifest-io.ts             # runExtract/syncManifest: write/remove .lovable/mcp/manifest.json
+      cli/extract-manifest.ts    # lovable-mcp-extract-manifest bin (runs runExtract on cwd)
       index.ts                   # barrel
 tests/
   core/{define,promise,url}.test.ts
@@ -143,7 +147,7 @@ tests/
     rest/{list-tools,invoke-tool}.test.ts
     parity.test.ts                   # REST↔MCP equivalence contract
   stacks/
-    tanstack/{handlers,vite}.test.ts
+    tanstack/{handlers,vite,extract-manifest,manifest-io,ssr-loader}.test.ts
   integration/                       # boots an example app, hits live HTTP
     global-setup.ts                  # spawns example/tanstack on :8080
     tools.test.ts                    # non-OAuth example

package/README.md

@@ -53,6 +53,16 @@ MCP (`POST /mcp`) is the public wire format clients speak directly. REST (`/.mcp
 
 The OAuth metadata route is emitted by default and returns `404` until OAuth auth is configured. Disable it with `mcpPlugin({ protectedResourceMetadataRoute: false })` only if the app owns `/.well-known/oauth-protected-resource` itself.
 
+### `.lovable/mcp/manifest.json`
+
+`.lovable/mcp/manifest.json` is a snapshot the Lovable platform reads to register the MCP server. Envelope fields: `version` (manifest schema version), `sdk_version` (the `@lovable.dev/mcp-js` release that wrote the snapshot), `path`, and `auth`. `auth` is the server's auth configuration, lifted into the envelope (not into `mcp`): `{ "type": "none" }`, or `{ "type": "oauth", ... }` mirroring the `defineMcp({ auth })` config (snake_case — `issuer`, `accepted_audiences`, `required_scopes`, `resource`, …). The `mcp` field is **exactly the `GET /.mcp/list-tools` body** — `server` plus the tool catalog (`name`/`title`/`description`/`annotations` and JSON-Schema `inputSchema`/`outputSchema`) — so the committed snapshot can't drift from what the live route serves. It's produced by loading the entry and reading the catalog off the `defineMcp` result, so the manifest reflects exactly what the server exposes, including tools built programmatically (spreads, computed names, tools from npm). **The `lovable-mcp-extract-manifest` CLI writes it** (loading the entry through Vite's SSR module loader, so it works under Node/Bun), and removes it when the entry is deleted. The Lovable platform runs the CLI in its commit pipeline; the Vite plugin only generates routes. Commit it: the platform reads the committed file.
+
+Three caveats:
+
+- **The entry must import cleanly.** Because extraction imports the entry, it must not throw at module load — read env vars and do I/O *inside* tool handlers, not at module top level. A top-level throw also breaks Worker cold-start, so this is correct authoring regardless. An entry that can't be imported (or doesn't `export default defineMcp(...)`) **makes the extract CLI exit non-zero with a clear error** rather than emitting a partial manifest.
+- **Tool `title`/`description` and the `auth` config are serialized verbatim.** They land in a committed file. The `auth` config is whatever the entry resolves at build time — an issuer read from env resolves to its build-time value (e.g. a fallback like `https://supabase.invalid/auth/v1` when the env var is unset), so don't put secrets in it.
+- **The `version` field is a wire-format version, not the package version.** The platform reader must accept a manifest `version` before this package starts emitting it, so bumping it is a coordinated deploy with the Lovable backend — not something an app author changes.
+
 ## OAuth resource-server auth
 
 `@lovable.dev/mcp-js` can protect an app-hosted MCP server as an OAuth 2.1 resource server. The package does not implement `/authorize`, `/token`, client registration, refresh tokens, or consent UI; those stay with the authorization server (for today's Supabase-backed Lovable Cloud apps, Supabase Auth). The MCP runtime validates bearer JWTs, publishes RFC 9728 protected-resource metadata, returns `WWW-Authenticate: Bearer ... resource_metadata="..."` challenges, and passes verified claims to tools.

package/dist/{chunk-G5GWSV5D.js → chunk-3XPKR4G6.js}

@@ -5,7 +5,7 @@ import {
   corsPreflightResponse,
   createRequestAuthorizer,
   withCors
-} from "./chunk-NTXHOUK6.js";
+} from "./chunk-HRMLGCXV.js";
 import {
   describeError,
   log

package/dist/{chunk-53M2X7FU.js → chunk-4Y72OCPS.js}

@@ -6,55 +6,12 @@ import {
   assertRestResourceBinding,
   corsPreflightResponse,
   createRequestAuthorizer,
-  headResponse,
   methodNotAllowed,
   withCors
-} from "./chunk-NTXHOUK6.js";
-
-// src/protocols/rest/list-tools.ts
-import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
-import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
-function shapeToJsonSchema(shape) {
-  if (!shape)
-    return null;
-  try {
-    return toJsonSchemaCompat(objectFromShape(shape));
-  } catch {
-    return null;
-  }
-}
-function createListToolsHandler(mcp, options = {}) {
-  assertRestResourceBinding(mcp, options);
-  const authorizer = createRequestAuthorizer(mcp, options);
-  const handle = async (request) => {
-    const authResult = await authorizer.authorize(request);
-    if (!authResult.ok)
-      return authResult.response;
-    if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD, OPTIONS");
-    const body = {
-      server: { name: mcp.name, version: mcp.version, title: mcp.title },
-      tools: mcp.tools.map((tool) => ({
-        name: tool.name,
-        title: tool.title,
-        description: tool.description,
-        annotations: tool.annotations,
-        inputSchema: shapeToJsonSchema(tool.inputSchema),
-        outputSchema: shapeToJsonSchema(tool.outputSchema)
-      }))
-    };
-    const response = Response.json(body);
-    return request.method === "HEAD" ? headResponse(response) : response;
-  };
-  return async (request) => {
-    if (request.method === "OPTIONS")
-      return corsPreflightResponse("GET, HEAD, OPTIONS");
-    return withCors(await handle(request));
-  };
-}
+} from "./chunk-HRMLGCXV.js";
 
 // src/protocols/rest/invoke-tool.ts
-import { getParseErrorMessage, objectFromShape as objectFromShape2, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 var MAX_REFLECTED_TOOL_NAME = 256;
 function safeReflectName(name) {
   const text = String(name);
@@ -98,7 +55,7 @@ function createInvokeToolHandler(mcp, options = {}) {
     let args = rawArgs;
     if (tool.inputSchema) {
       try {
-        const schema = objectFromShape2(tool.inputSchema);
+        const schema = objectFromShape(tool.inputSchema);
         const parsed = await safeParseAsync(schema, rawArgs);
         if (!parsed.success) {
           return new Response(
@@ -151,6 +108,5 @@ function createInvokeToolHandler(mcp, options = {}) {
 }
 
 export {
-  createListToolsHandler,
   createInvokeToolHandler
 };

package/dist/chunk-E335BBVM.js

@@ -0,0 +1,57 @@
+import {
+  assertRestResourceBinding,
+  corsPreflightResponse,
+  createRequestAuthorizer,
+  headResponse,
+  methodNotAllowed,
+  withCors
+} from "./chunk-HRMLGCXV.js";
+
+// src/protocols/rest/list-tools.ts
+import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+function shapeToJsonSchema(shape) {
+  if (!shape)
+    return null;
+  try {
+    return toJsonSchemaCompat(objectFromShape(shape));
+  } catch {
+    return null;
+  }
+}
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
+function createListToolsHandler(mcp, options = {}) {
+  assertRestResourceBinding(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options);
+  const handle = async (request) => {
+    const authResult = await authorizer.authorize(request);
+    if (!authResult.ok)
+      return authResult.response;
+    if (request.method !== "GET" && request.method !== "HEAD")
+      return methodNotAllowed("GET, HEAD, OPTIONS");
+    const response = Response.json(buildMcpListing(mcp));
+    return request.method === "HEAD" ? headResponse(response) : response;
+  };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
+}
+
+export {
+  buildMcpListing,
+  createListToolsHandler
+};

package/dist/{chunk-NTXHOUK6.js → chunk-HRMLGCXV.js}

@@ -170,7 +170,7 @@ function createOAuthDiscoveryResolver(auth) {
 }
 
 // src/auth/verifier.ts
-import { createRemoteJWKSet, decodeProtectedHeader, errors as joseErrors, jwtVerify } from "jose";
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 
 // src/auth/claims.ts
 function readString(value) {
@@ -190,6 +190,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -209,12 +210,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof joseErrors.JWKSTimeout || err instanceof joseErrors.JWKSInvalid)
-    return true;
-  if (!(err instanceof joseErrors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return createLocalJWKSet(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -229,10 +235,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -277,8 +279,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = createRemoteJWKSet(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/chunk-QJ7XEKT3.js

@@ -0,0 +1,8 @@
+// src/stacks/tanstack/fs-errors.ts
+function isFileMissing(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+
+export {
+  isFileMissing
+};

package/dist/{chunk-722HKLIU.js → chunk-W7F6JRDB.js}

@@ -7,7 +7,7 @@ import {
   oauthConfigurationErrorResponse,
   resolveProtectedResource,
   withCors
-} from "./chunk-NTXHOUK6.js";
+} from "./chunk-HRMLGCXV.js";
 import {
   describeError,
   log

package/dist/protocols/mcp/index.cjs

@@ -281,6 +281,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -300,12 +301,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -320,10 +326,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -368,8 +370,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/protocols/mcp/index.js

@@ -1,8 +1,8 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-G5GWSV5D.js";
+} from "../../chunk-3XPKR4G6.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/oauth-metadata.cjs

@@ -283,6 +283,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -302,12 +303,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -322,10 +328,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -370,8 +372,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });

package/dist/protocols/oauth-metadata.js

@@ -1,7 +1,7 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-722HKLIU.js";
-import "../chunk-NTXHOUK6.js";
+} from "../chunk-W7F6JRDB.js";
+import "../chunk-HRMLGCXV.js";
 import "../chunk-QC3DXQTH.js";
 import "../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/rest/index.cjs

@@ -291,6 +291,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -310,12 +311,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -330,10 +336,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -378,8 +380,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
@@ -548,6 +550,19 @@ function shapeToJsonSchema(shape) {
     return null;
   }
 }
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
@@ -557,18 +572,7 @@ function createListToolsHandler(mcp, options = {}) {
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
       return methodNotAllowed("GET, HEAD, OPTIONS");
-    const body = {
-      server: { name: mcp.name, version: mcp.version, title: mcp.title },
-      tools: mcp.tools.map((tool) => ({
-        name: tool.name,
-        title: tool.title,
-        description: tool.description,
-        annotations: tool.annotations,
-        inputSchema: shapeToJsonSchema(tool.inputSchema),
-        outputSchema: shapeToJsonSchema(tool.outputSchema)
-      }))
-    };
-    const response = Response.json(body);
+    const response = Response.json(buildMcpListing(mcp));
     return request.method === "HEAD" ? headResponse(response) : response;
   };
   return async (request) => {

package/dist/protocols/rest/index.js

@@ -1,9 +1,11 @@
 import {
-  createInvokeToolHandler,
-  createListToolsHandler
-} from "../../chunk-53M2X7FU.js";
+  createInvokeToolHandler
+} from "../../chunk-4Y72OCPS.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import {
+  createListToolsHandler
+} from "../../chunk-E335BBVM.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/stacks/tanstack/cli/extract-manifest.cjs

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/stacks/tanstack/manifest-io.ts
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_vite2 = require("vite");
+
+// package.json
+var version = "0.8.0";
+
+// src/protocols/rest/list-tools.ts
+var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+var import_zod_json_schema_compat = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+
+// src/auth/verifier.ts
+var import_jose = require("jose");
+
+// src/protocols/rest/list-tools.ts
+function shapeToJsonSchema(shape) {
+  if (!shape)
+    return null;
+  try {
+    return (0, import_zod_json_schema_compat.toJsonSchemaCompat)((0, import_zod_compat.objectFromShape)(shape));
+  } catch {
+    return null;
+  }
+}
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
+
+// src/stacks/tanstack/extract-manifest.ts
+var MANIFEST_VERSION = 1;
+var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+function manifestAuth(auth) {
+  if (!auth)
+    return { type: "none" };
+  const oauth = { type: "oauth", issuer: auth.issuer };
+  if (auth.resource !== void 0)
+    oauth.resource = auth.resource;
+  if (auth.resourceName !== void 0)
+    oauth.resource_name = auth.resourceName;
+  if (auth.resourceDocumentation !== void 0)
+    oauth.resource_documentation = auth.resourceDocumentation;
+  if (auth.protectedResourceMetadataUrl !== void 0)
+    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+  if (auth.requireOAuthClientClaim !== void 0)
+    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptedAudiences !== void 0)
+    oauth.accepted_audiences = auth.acceptedAudiences;
+  if (auth.requiredScopes !== void 0)
+    oauth.required_scopes = auth.requiredScopes;
+  if (auth.jwksUri !== void 0)
+    oauth.jwks_uri = auth.jwksUri;
+  if (auth.algorithms !== void 0)
+    oauth.algorithms = auth.algorithms;
+  if (auth.clockToleranceSeconds !== void 0)
+    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+  return oauth;
+}
+function isToolShape(tool) {
+  if (typeof tool !== "object" || tool === null)
+    return false;
+  const t = tool;
+  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+}
+function isAuthShape(auth) {
+  if (auth === void 0)
+    return true;
+  if (typeof auth !== "object" || auth === null)
+    return false;
+  const a = auth;
+  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+}
+function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
+  const def = definition;
+  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
+  if (!validShape) {
+    const got = definition == null ? "no default export" : typeof definition;
+    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
+  }
+  return {
+    version: MANIFEST_VERSION,
+    sdk_version: version,
+    path: urlPath,
+    auth: manifestAuth(def.auth),
+    mcp: buildMcpListing(def)
+  };
+}
+
+// src/stacks/tanstack/fs-errors.ts
+function isFileMissing(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+
+// src/stacks/tanstack/ssr-loader.ts
+var import_vite = require("vite");
+async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
+  const server = await (0, import_vite.createServer)({
+    configFile: false,
+    root: projectRoot2,
+    logLevel: "silent",
+    server: { middlewareMode: true, hmr: false, watch: null },
+    optimizeDeps: { noDiscovery: true },
+    resolve: { alias }
+  });
+  try {
+    const mod = await server.ssrLoadModule(entryAbs);
+    return manifestFromDefinition(mod.default, urlPath, entryAbs);
+  } finally {
+    await server.close();
+  }
+}
+
+// src/stacks/tanstack/manifest-io.ts
+var MCP_PLUGIN_NAME = "@lovable.dev/mcp-js";
+var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
+var DEFAULT_MCP_PATH = "/mcp";
+function writeManifestIfChanged(file, manifest) {
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  let existing;
+  try {
+    existing = (0, import_node_fs.readFileSync)(file, "utf8");
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+  if (existing === content)
+    return;
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(file), { recursive: true });
+  const tmp = `${file}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs.writeFileSync)(tmp, content, "utf8");
+    (0, import_node_fs.renameSync)(tmp, file);
+  } catch (err) {
+    try {
+      (0, import_node_fs.unlinkSync)(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function removeManifest(file) {
+  try {
+    (0, import_node_fs.unlinkSync)(file);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+}
+async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
+  let entryExists = true;
+  try {
+    (0, import_node_fs.lstatSync)(entryAbs);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+    entryExists = false;
+  }
+  if (!entryExists) {
+    removeManifest(manifestFile);
+    return;
+  }
+  const manifest = await produce(entryAbs, urlPath);
+  writeManifestIfChanged(manifestFile, manifest);
+}
+async function runExtract(projectRoot2) {
+  const resolved = await (0, import_vite2.resolveConfig)({ root: projectRoot2, logLevel: "silent" }, "serve");
+  const alias = resolved.resolve?.alias ?? [];
+  const pluginApi = resolved.plugins.find((p) => p.name === MCP_PLUGIN_NAME)?.api;
+  const entryAbs = pluginApi?.mcpEntry ?? (0, import_node_path.resolve)(projectRoot2, DEFAULT_MCP_ENTRY);
+  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
+  await syncManifest(
+    (0, import_node_path.resolve)(projectRoot2, MANIFEST_RELATIVE_PATH),
+    entryAbs,
+    urlPath,
+    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
+  );
+}
+
+// src/stacks/tanstack/cli/extract-manifest.ts
+var projectRoot = process.argv[2] ?? process.cwd();
+runExtract(projectRoot).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/dist/stacks/tanstack/cli/extract-manifest.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/stacks/tanstack/cli/extract-manifest.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/stacks/tanstack/cli/extract-manifest.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+import {
+  buildMcpListing
+} from "../../../chunk-E335BBVM.js";
+import "../../../chunk-HRMLGCXV.js";
+import "../../../chunk-QC3DXQTH.js";
+import {
+  isFileMissing
+} from "../../../chunk-QJ7XEKT3.js";
+import "../../../chunk-6DXGZZA4.js";
+
+// src/stacks/tanstack/manifest-io.ts
+import { randomUUID } from "crypto";
+import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { resolveConfig } from "vite";
+
+// package.json
+var version = "0.8.0";
+
+// src/stacks/tanstack/extract-manifest.ts
+var MANIFEST_VERSION = 1;
+var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+function manifestAuth(auth) {
+  if (!auth)
+    return { type: "none" };
+  const oauth = { type: "oauth", issuer: auth.issuer };
+  if (auth.resource !== void 0)
+    oauth.resource = auth.resource;
+  if (auth.resourceName !== void 0)
+    oauth.resource_name = auth.resourceName;
+  if (auth.resourceDocumentation !== void 0)
+    oauth.resource_documentation = auth.resourceDocumentation;
+  if (auth.protectedResourceMetadataUrl !== void 0)
+    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+  if (auth.requireOAuthClientClaim !== void 0)
+    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptedAudiences !== void 0)
+    oauth.accepted_audiences = auth.acceptedAudiences;
+  if (auth.requiredScopes !== void 0)
+    oauth.required_scopes = auth.requiredScopes;
+  if (auth.jwksUri !== void 0)
+    oauth.jwks_uri = auth.jwksUri;
+  if (auth.algorithms !== void 0)
+    oauth.algorithms = auth.algorithms;
+  if (auth.clockToleranceSeconds !== void 0)
+    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+  return oauth;
+}
+function isToolShape(tool) {
+  if (typeof tool !== "object" || tool === null)
+    return false;
+  const t = tool;
+  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+}
+function isAuthShape(auth) {
+  if (auth === void 0)
+    return true;
+  if (typeof auth !== "object" || auth === null)
+    return false;
+  const a = auth;
+  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+}
+function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
+  const def = definition;
+  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
+  if (!validShape) {
+    const got = definition == null ? "no default export" : typeof definition;
+    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
+  }
+  return {
+    version: MANIFEST_VERSION,
+    sdk_version: version,
+    path: urlPath,
+    auth: manifestAuth(def.auth),
+    mcp: buildMcpListing(def)
+  };
+}
+
+// src/stacks/tanstack/ssr-loader.ts
+import { createServer } from "vite";
+async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
+  const server = await createServer({
+    configFile: false,
+    root: projectRoot2,
+    logLevel: "silent",
+    server: { middlewareMode: true, hmr: false, watch: null },
+    optimizeDeps: { noDiscovery: true },
+    resolve: { alias }
+  });
+  try {
+    const mod = await server.ssrLoadModule(entryAbs);
+    return manifestFromDefinition(mod.default, urlPath, entryAbs);
+  } finally {
+    await server.close();
+  }
+}
+
+// src/stacks/tanstack/manifest-io.ts
+var MCP_PLUGIN_NAME = "@lovable.dev/mcp-js";
+var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
+var DEFAULT_MCP_PATH = "/mcp";
+function writeManifestIfChanged(file, manifest) {
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  let existing;
+  try {
+    existing = readFileSync(file, "utf8");
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+  if (existing === content)
+    return;
+  mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tmp, content, "utf8");
+    renameSync(tmp, file);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function removeManifest(file) {
+  try {
+    unlinkSync(file);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+}
+async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
+  let entryExists = true;
+  try {
+    lstatSync(entryAbs);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+    entryExists = false;
+  }
+  if (!entryExists) {
+    removeManifest(manifestFile);
+    return;
+  }
+  const manifest = await produce(entryAbs, urlPath);
+  writeManifestIfChanged(manifestFile, manifest);
+}
+async function runExtract(projectRoot2) {
+  const resolved = await resolveConfig({ root: projectRoot2, logLevel: "silent" }, "serve");
+  const alias = resolved.resolve?.alias ?? [];
+  const pluginApi = resolved.plugins.find((p) => p.name === MCP_PLUGIN_NAME)?.api;
+  const entryAbs = pluginApi?.mcpEntry ?? resolve(projectRoot2, DEFAULT_MCP_ENTRY);
+  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
+  await syncManifest(
+    resolve(projectRoot2, MANIFEST_RELATIVE_PATH),
+    entryAbs,
+    urlPath,
+    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
+  );
+}
+
+// src/stacks/tanstack/cli/extract-manifest.ts
+var projectRoot = process.argv[2] ?? process.cwd();
+runExtract(projectRoot).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/dist/stacks/tanstack/index.cjs

@@ -293,6 +293,7 @@ function stringClaim(claims, name) {
 // src/auth/verifier.ts
 var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
 var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
 var OAuthTokenError = class extends Error {
   constructor(status, oauthError, message) {
     super(message);
@@ -312,12 +313,17 @@ function tokenHeaderFields(token) {
     return { tokenLength: token.length };
   }
 }
-function isJwksFetchFailure(err) {
-  if (err instanceof import_jose.errors.JWKSTimeout || err instanceof import_jose.errors.JWKSInvalid)
-    return true;
-  if (!(err instanceof import_jose.errors.JOSEError))
-    return err instanceof Error;
-  return err.code === "ERR_JOSE_GENERIC";
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
 }
 async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
   try {
@@ -332,10 +338,6 @@ async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
     });
     return payload;
   } catch (err) {
-    if (isJwksFetchFailure(err)) {
-      log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-      throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
     throw err;
   }
@@ -380,8 +382,8 @@ function createOAuthTokenVerifier(auth, discovery) {
     const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
     log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
     const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.keyset_created", { jwksUri });
-    const keySet = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
     const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
     assertNonEmptySubject(claims);
     const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
@@ -716,6 +718,19 @@ function shapeToJsonSchema(shape) {
     return null;
   }
 }
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
@@ -725,18 +740,7 @@ function createListToolsHandler(mcp, options = {}) {
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
       return methodNotAllowed("GET, HEAD, OPTIONS");
-    const body = {
-      server: { name: mcp.name, version: mcp.version, title: mcp.title },
-      tools: mcp.tools.map((tool) => ({
-        name: tool.name,
-        title: tool.title,
-        description: tool.description,
-        annotations: tool.annotations,
-        inputSchema: shapeToJsonSchema(tool.inputSchema),
-        outputSchema: shapeToJsonSchema(tool.outputSchema)
-      }))
-    };
-    const response = Response.json(body);
+    const response = Response.json(buildMcpListing(mcp));
     return request.method === "HEAD" ? headResponse(response) : response;
   };
   return async (request) => {

package/dist/stacks/tanstack/index.js

@@ -1,15 +1,17 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-G5GWSV5D.js";
+} from "../../chunk-3XPKR4G6.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-722HKLIU.js";
+} from "../../chunk-W7F6JRDB.js";
 import {
-  createInvokeToolHandler,
-  createListToolsHandler
-} from "../../chunk-53M2X7FU.js";
+  createInvokeToolHandler
+} from "../../chunk-4Y72OCPS.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-NTXHOUK6.js";
+import {
+  createListToolsHandler
+} from "../../chunk-E335BBVM.js";
+import "../../chunk-HRMLGCXV.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 

package/dist/stacks/tanstack/vite.cjs

@@ -32,11 +32,13 @@ var import_node_path = require("path");
 // src/auth/metadata-path.ts
 var OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
 
-// src/stacks/tanstack/vite.ts
-var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
+// src/stacks/tanstack/fs-errors.ts
 function isFileMissing(err) {
   return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
+
+// src/stacks/tanstack/vite.ts
+var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
 function normalizePath(p) {
   return p.split(import_node_path.sep).join("/");
 }
@@ -251,6 +253,18 @@ function mcpPlugin(options = {}) {
   };
   return {
     name: "@lovable.dev/mcp-js",
+    // The extract CLI reads the resolved entry + URL path back through this
+    // (via `resolveConfig().plugins`) so the manifest honors custom
+    // `mcpEntry`/`path` instead of assuming the defaults. Getters because
+    // `mcpEntry` is finalized in `configResolved`.
+    api: {
+      get mcpEntry() {
+        return mcpEntry;
+      },
+      get urlPath() {
+        return urlPath;
+      }
+    },
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
@@ -262,19 +276,18 @@ function mcpPlugin(options = {}) {
       regenerate();
     },
     configureServer(server) {
-      const watchedEntry = mcpEntry;
-      const onEntryChange = (file) => {
-        if (normalizePath(file) === normalizePath(watchedEntry)) {
+      const onChange = (file) => {
+        if (normalizePath(file) === normalizePath(mcpEntry)) {
           regenerate();
         }
       };
-      server.watcher.on("add", onEntryChange);
-      server.watcher.on("change", onEntryChange);
-      server.watcher.on("unlink", onEntryChange);
+      server.watcher.on("add", onChange);
+      server.watcher.on("change", onChange);
+      server.watcher.on("unlink", onChange);
       server.watcher.once("close", () => {
-        server.watcher.off("add", onEntryChange);
-        server.watcher.off("change", onEntryChange);
-        server.watcher.off("unlink", onEntryChange);
+        server.watcher.off("add", onChange);
+        server.watcher.off("change", onChange);
+        server.watcher.off("unlink", onChange);
       });
     },
     buildStart() {

package/dist/stacks/tanstack/vite.d.cts

@@ -49,6 +49,10 @@ interface McpPluginOptions {
      */
     protectedResourceMetadataRoute?: boolean;
 }
+interface McpPluginApi {
+    readonly mcpEntry: string;
+    readonly urlPath: string;
+}
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;
 /**
@@ -57,8 +61,12 @@ declare function deriveRouteFileName(urlPath: string): string;
  * Place this in your `vite.config.ts` plugins array. Emits during
  * `configResolved` (so dev-server boot and the TanStack file-router both
  * see the routes on the first request) and re-emits when the MCP entry
- * file changes during dev.
+ * file appears or disappears during dev.
+ *
+ * The `.lovable/mcp/manifest.json` snapshot is produced separately by the
+ * `lovable-mcp-extract-manifest` CLI (run by a host platform at build/commit
+ * time) — not by this plugin.
  */
 declare function mcpPlugin(options?: McpPluginOptions): Plugin;
 
-export { type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };
+export { type McpPluginApi, type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };

package/dist/stacks/tanstack/vite.d.ts

@@ -49,6 +49,10 @@ interface McpPluginOptions {
      */
     protectedResourceMetadataRoute?: boolean;
 }
+interface McpPluginApi {
+    readonly mcpEntry: string;
+    readonly urlPath: string;
+}
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;
 /**
@@ -57,8 +61,12 @@ declare function deriveRouteFileName(urlPath: string): string;
  * Place this in your `vite.config.ts` plugins array. Emits during
  * `configResolved` (so dev-server boot and the TanStack file-router both
  * see the routes on the first request) and re-emits when the MCP entry
- * file changes during dev.
+ * file appears or disappears during dev.
+ *
+ * The `.lovable/mcp/manifest.json` snapshot is produced separately by the
+ * `lovable-mcp-extract-manifest` CLI (run by a host platform at build/commit
+ * time) — not by this plugin.
  */
 declare function mcpPlugin(options?: McpPluginOptions): Plugin;
 
-export { type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };
+export { type McpPluginApi, type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };

package/dist/stacks/tanstack/vite.js

@@ -1,3 +1,6 @@
+import {
+  isFileMissing
+} from "../../chunk-QJ7XEKT3.js";
 import {
   OAUTH_PROTECTED_RESOURCE_METADATA_PATH
 } from "../../chunk-6DXGZZA4.js";
@@ -6,9 +9,6 @@ import {
 import { lstatSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "fs";
 import { dirname, join, relative, resolve, sep } from "path";
 var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
-function isFileMissing(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
 function normalizePath(p) {
   return p.split(sep).join("/");
 }
@@ -223,6 +223,18 @@ function mcpPlugin(options = {}) {
   };
   return {
     name: "@lovable.dev/mcp-js",
+    // The extract CLI reads the resolved entry + URL path back through this
+    // (via `resolveConfig().plugins`) so the manifest honors custom
+    // `mcpEntry`/`path` instead of assuming the defaults. Getters because
+    // `mcpEntry` is finalized in `configResolved`.
+    api: {
+      get mcpEntry() {
+        return mcpEntry;
+      },
+      get urlPath() {
+        return urlPath;
+      }
+    },
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = resolve(projectRoot, mcpEntryOption);
@@ -234,19 +246,18 @@ function mcpPlugin(options = {}) {
       regenerate();
     },
     configureServer(server) {
-      const watchedEntry = mcpEntry;
-      const onEntryChange = (file) => {
-        if (normalizePath(file) === normalizePath(watchedEntry)) {
+      const onChange = (file) => {
+        if (normalizePath(file) === normalizePath(mcpEntry)) {
           regenerate();
         }
       };
-      server.watcher.on("add", onEntryChange);
-      server.watcher.on("change", onEntryChange);
-      server.watcher.on("unlink", onEntryChange);
+      server.watcher.on("add", onChange);
+      server.watcher.on("change", onChange);
+      server.watcher.on("unlink", onChange);
       server.watcher.once("close", () => {
-        server.watcher.off("add", onEntryChange);
-        server.watcher.off("change", onEntryChange);
-        server.watcher.off("unlink", onEntryChange);
+        server.watcher.off("add", onChange);
+        server.watcher.off("change", onChange);
+        server.watcher.off("unlink", onChange);
       });
     },
     buildStart() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and the framework adapter (TanStack today, Supabase Edge Functions next) emits the route(s) at build time.",
   "type": "module",
   "repository": {
@@ -50,6 +50,9 @@
       "require": "./dist/stacks/tanstack/vite.cjs"
     }
   },
+  "bin": {
+    "lovable-mcp-extract-manifest": "./dist/stacks/tanstack/cli/extract-manifest.cjs"
+  },
   "files": [
     "dist"
   ],
@@ -79,8 +82,8 @@
     "zod": "^4.1.13"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/protocols/mcp/index.ts src/protocols/oauth-metadata.ts src/protocols/rest/index.ts src/stacks/tanstack/index.ts src/stacks/tanstack/vite.ts --format cjs,esm --dts --outDir dist",
-    "dev": "tsup src/index.ts src/protocols/mcp/index.ts src/protocols/oauth-metadata.ts src/protocols/rest/index.ts src/stacks/tanstack/index.ts src/stacks/tanstack/vite.ts --format cjs,esm --dts --watch",
+    "build": "tsup src/index.ts src/protocols/mcp/index.ts src/protocols/oauth-metadata.ts src/protocols/rest/index.ts src/stacks/tanstack/index.ts src/stacks/tanstack/vite.ts src/stacks/tanstack/cli/extract-manifest.ts --format cjs,esm --dts --outDir dist",
+    "dev": "tsup src/index.ts src/protocols/mcp/index.ts src/protocols/oauth-metadata.ts src/protocols/rest/index.ts src/stacks/tanstack/index.ts src/stacks/tanstack/vite.ts src/stacks/tanstack/cli/extract-manifest.ts --format cjs,esm --dts --watch",
     "typecheck": "tsgo --noEmit",
     "format": "oxfmt --write src/ tests/",
     "format:check": "oxfmt --check src/ tests/",