@lovable.dev/mcp-js 0.7.1 → 0.9.0

package/dist/protocols/rest/index.cjs

@@ -256,10 +256,10 @@ function resolveProtectedResource(auth, request, options) {
   resourceURL.hash = "";
   return trimTrailingSlash(resourceURL.toString());
 }
-function assertResourcePathShape(resourcePath) {
+function assertResourcePathShape(resourcePath, label = "resourcePath") {
   if (!resourcePath.startsWith("/") || resourcePath.startsWith("//") || resourcePath.includes("\\") || /(^|\/)\.\.(\/|$)/.test(resourcePath)) {
     throw new Error(
-      `@lovable.dev/mcp-js: resourcePath must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
+      `@lovable.dev/mcp-js: ${label} must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
     );
   }
 }
@@ -400,16 +400,16 @@ function quoteAuthenticateParam(value) {
   const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
   return `"${sanitized.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
-function resolveProtectedResourceMetadataUrl(auth, request) {
+function resolveProtectedResourceMetadataUrl(auth, request, options) {
   if (auth.protectedResourceMetadataUrl !== void 0)
     return auth.protectedResourceMetadataUrl;
   const base = auth.resource ?? request.url;
-  return new URL(OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
+  return new URL(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
 }
-function wwwAuthenticateHeader(auth, request, params = {}) {
+function wwwAuthenticateHeader(auth, request, options, params = {}) {
   const values = [
     `realm=${quoteAuthenticateParam("mcp")}`,
-    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request))}`
+    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request, options))}`
   ];
   if (auth.requiredScopes && auth.requiredScopes.length > 0) {
     values.push(`scope=${quoteAuthenticateParam(auth.requiredScopes.join(" "))}`);
@@ -420,9 +420,12 @@ function wwwAuthenticateHeader(auth, request, params = {}) {
     values.push(`error_description=${quoteAuthenticateParam(params.errorDescription)}`);
   return `Bearer ${values.join(", ")}`;
 }
-function challengeResponse(auth, request, status, oauthError, errorDescription) {
+function challengeResponse(auth, request, options, status, oauthError, errorDescription) {
   const headers = new Headers(JSON_HEADERS);
-  headers.set("WWW-Authenticate", wwwAuthenticateHeader(auth, request, { error: oauthError, errorDescription }));
+  headers.set(
+    "WWW-Authenticate",
+    wwwAuthenticateHeader(auth, request, options, { error: oauthError, errorDescription })
+  );
   headers.set("Cache-Control", "no-store");
   return new Response(JSON.stringify({ error: status === 403 ? "forbidden" : "unauthorized" }), {
     status,
@@ -450,10 +453,17 @@ function parseBearerToken(request) {
 function getOAuthRuntime(mcp, options = {}) {
   if (options.resourcePath !== void 0)
     assertResourcePathShape(options.resourcePath);
-  const stableOptions = { resourcePath: options.resourcePath };
+  if (options.metadataPath !== void 0)
+    assertResourcePathShape(options.metadataPath, "metadataPath");
+  const stableOptions = { resourcePath: options.resourcePath, metadataPath: options.metadataPath };
   const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
   if (!auth)
     return { kind: "unconfigured", options: stableOptions };
+  if (options.metadataPath !== void 0 && auth.protectedResourceMetadataUrl !== void 0) {
+    throw new Error(
+      `@lovable.dev/mcp-js: the Vite plugin generates protected-resource metadata (metadataPath set), so auth.protectedResourceMetadataUrl must not also be set. Drop protectedResourceMetadataUrl, or set protectedResourceMetadataRoute: false in mcpPlugin(...) to host the document yourself.`
+    );
+  }
   const discovery = createOAuthDiscoveryResolver(auth);
   return {
     kind: "configured",
@@ -492,7 +502,7 @@ function createRequestAuthorizer(mcp, options = {}) {
       const token = parseBearerToken(request);
       if (!token) {
         log.info("auth.no_bearer_token", { outcome: "401" });
-        return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+        return { ok: false, response: challengeResponse(runtime.auth, request, runtime.options, 401) };
       }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
@@ -507,13 +517,27 @@ function createRequestAuthorizer(mcp, options = {}) {
           log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
-            response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
+            response: challengeResponse(
+              runtime.auth,
+              request,
+              runtime.options,
+              err.status,
+              err.oauthError,
+              err.message
+            )
           };
         }
         log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
-          response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")
+          response: challengeResponse(
+            runtime.auth,
+            request,
+            runtime.options,
+            401,
+            "invalid_token",
+            "Invalid access token"
+          )
         };
       }
     }
@@ -550,6 +574,19 @@ function shapeToJsonSchema(shape) {
     return null;
   }
 }
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
@@ -559,18 +596,7 @@ function createListToolsHandler(mcp, options = {}) {
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
       return methodNotAllowed("GET, HEAD, OPTIONS");
-    const body = {
-      server: { name: mcp.name, version: mcp.version, title: mcp.title },
-      tools: mcp.tools.map((tool) => ({
-        name: tool.name,
-        title: tool.title,
-        description: tool.description,
-        annotations: tool.annotations,
-        inputSchema: shapeToJsonSchema(tool.inputSchema),
-        outputSchema: shapeToJsonSchema(tool.outputSchema)
-      }))
-    };
-    const response = Response.json(body);
+    const response = Response.json(buildMcpListing(mcp));
     return request.method === "HEAD" ? headResponse(response) : response;
   };
   return async (request) => {

package/dist/protocols/rest/index.d.cts

@@ -1,5 +1,5 @@
-import { M as McpRuntimeOptions } from '../../authorize-DpTEIFvs.js';
-import { d as McpDefinition } from '../../types-zMlr1mOK.js';
+import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request) => Promise<Response>;

package/dist/protocols/rest/index.d.ts

@@ -1,5 +1,5 @@
-import { M as McpRuntimeOptions } from '../../authorize-DpTEIFvs.js';
-import { d as McpDefinition } from '../../types-zMlr1mOK.js';
+import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
 import 'zod';
 
 type RestListToolsHandler = (request: Request) => Promise<Response>;

package/dist/protocols/rest/index.js

@@ -1,9 +1,11 @@
 import {
-  createInvokeToolHandler,
-  createListToolsHandler
-} from "../../chunk-LMT6RXUF.js";
+  createInvokeToolHandler
+} from "../../chunk-SBKIKJNB.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-HRMLGCXV.js";
+import {
+  createListToolsHandler
+} from "../../chunk-BG3HOZXZ.js";
+import "../../chunk-FQLM4JDU.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/stacks/tanstack/cli/extract-manifest.cjs

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/stacks/tanstack/manifest-io.ts
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_vite2 = require("vite");
+
+// package.json
+var version = "0.9.0";
+
+// src/protocols/rest/list-tools.ts
+var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+var import_zod_json_schema_compat = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+
+// src/auth/verifier.ts
+var import_jose = require("jose");
+
+// src/protocols/rest/list-tools.ts
+function shapeToJsonSchema(shape) {
+  if (!shape)
+    return null;
+  try {
+    return (0, import_zod_json_schema_compat.toJsonSchemaCompat)((0, import_zod_compat.objectFromShape)(shape));
+  } catch {
+    return null;
+  }
+}
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
+
+// src/stacks/tanstack/extract-manifest.ts
+var MANIFEST_VERSION = 1;
+var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+function manifestAuth(auth) {
+  if (!auth)
+    return { type: "none" };
+  const oauth = { type: "oauth", issuer: auth.issuer };
+  if (auth.resource !== void 0)
+    oauth.resource = auth.resource;
+  if (auth.resourceName !== void 0)
+    oauth.resource_name = auth.resourceName;
+  if (auth.resourceDocumentation !== void 0)
+    oauth.resource_documentation = auth.resourceDocumentation;
+  if (auth.protectedResourceMetadataUrl !== void 0)
+    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+  if (auth.requireOAuthClientClaim !== void 0)
+    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptedAudiences !== void 0)
+    oauth.accepted_audiences = auth.acceptedAudiences;
+  if (auth.requiredScopes !== void 0)
+    oauth.required_scopes = auth.requiredScopes;
+  if (auth.jwksUri !== void 0)
+    oauth.jwks_uri = auth.jwksUri;
+  if (auth.algorithms !== void 0)
+    oauth.algorithms = auth.algorithms;
+  if (auth.clockToleranceSeconds !== void 0)
+    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+  return oauth;
+}
+function isToolShape(tool) {
+  if (typeof tool !== "object" || tool === null)
+    return false;
+  const t = tool;
+  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+}
+function isAuthShape(auth) {
+  if (auth === void 0)
+    return true;
+  if (typeof auth !== "object" || auth === null)
+    return false;
+  const a = auth;
+  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+}
+function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
+  const def = definition;
+  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
+  if (!validShape) {
+    const got = definition == null ? "no default export" : typeof definition;
+    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
+  }
+  return {
+    version: MANIFEST_VERSION,
+    sdk_version: version,
+    path: urlPath,
+    auth: manifestAuth(def.auth),
+    mcp: buildMcpListing(def)
+  };
+}
+
+// src/stacks/tanstack/fs-errors.ts
+function isFileMissing(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+
+// src/stacks/tanstack/ssr-loader.ts
+var import_vite = require("vite");
+async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
+  const server = await (0, import_vite.createServer)({
+    configFile: false,
+    root: projectRoot2,
+    logLevel: "silent",
+    server: { middlewareMode: true, hmr: false, watch: null },
+    optimizeDeps: { noDiscovery: true },
+    resolve: { alias }
+  });
+  try {
+    const mod = await server.ssrLoadModule(entryAbs);
+    return manifestFromDefinition(mod.default, urlPath, entryAbs);
+  } finally {
+    await server.close();
+  }
+}
+
+// src/stacks/tanstack/manifest-io.ts
+var MCP_PLUGIN_NAME = "@lovable.dev/mcp-js";
+var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
+var DEFAULT_MCP_PATH = "/mcp";
+function writeManifestIfChanged(file, manifest) {
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  let existing;
+  try {
+    existing = (0, import_node_fs.readFileSync)(file, "utf8");
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+  if (existing === content)
+    return;
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(file), { recursive: true });
+  const tmp = `${file}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs.writeFileSync)(tmp, content, "utf8");
+    (0, import_node_fs.renameSync)(tmp, file);
+  } catch (err) {
+    try {
+      (0, import_node_fs.unlinkSync)(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function removeManifest(file) {
+  try {
+    (0, import_node_fs.unlinkSync)(file);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+}
+async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
+  let entryExists = true;
+  try {
+    (0, import_node_fs.lstatSync)(entryAbs);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+    entryExists = false;
+  }
+  if (!entryExists) {
+    removeManifest(manifestFile);
+    return;
+  }
+  const manifest = await produce(entryAbs, urlPath);
+  writeManifestIfChanged(manifestFile, manifest);
+}
+async function runExtract(projectRoot2) {
+  const resolved = await (0, import_vite2.resolveConfig)({ root: projectRoot2, logLevel: "silent" }, "serve");
+  const alias = resolved.resolve?.alias ?? [];
+  const pluginApi = resolved.plugins.find((p) => p.name === MCP_PLUGIN_NAME)?.api;
+  const entryAbs = pluginApi?.mcpEntry ?? (0, import_node_path.resolve)(projectRoot2, DEFAULT_MCP_ENTRY);
+  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
+  await syncManifest(
+    (0, import_node_path.resolve)(projectRoot2, MANIFEST_RELATIVE_PATH),
+    entryAbs,
+    urlPath,
+    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
+  );
+}
+
+// src/stacks/tanstack/cli/extract-manifest.ts
+var projectRoot = process.argv[2] ?? process.cwd();
+runExtract(projectRoot).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/dist/stacks/tanstack/cli/extract-manifest.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/stacks/tanstack/cli/extract-manifest.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/stacks/tanstack/cli/extract-manifest.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+import {
+  buildMcpListing
+} from "../../../chunk-BG3HOZXZ.js";
+import "../../../chunk-FQLM4JDU.js";
+import "../../../chunk-QC3DXQTH.js";
+import {
+  isFileMissing
+} from "../../../chunk-QJ7XEKT3.js";
+import "../../../chunk-6DXGZZA4.js";
+
+// src/stacks/tanstack/manifest-io.ts
+import { randomUUID } from "crypto";
+import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { resolveConfig } from "vite";
+
+// package.json
+var version = "0.9.0";
+
+// src/stacks/tanstack/extract-manifest.ts
+var MANIFEST_VERSION = 1;
+var MANIFEST_RELATIVE_PATH = ".lovable/mcp/manifest.json";
+function manifestAuth(auth) {
+  if (!auth)
+    return { type: "none" };
+  const oauth = { type: "oauth", issuer: auth.issuer };
+  if (auth.resource !== void 0)
+    oauth.resource = auth.resource;
+  if (auth.resourceName !== void 0)
+    oauth.resource_name = auth.resourceName;
+  if (auth.resourceDocumentation !== void 0)
+    oauth.resource_documentation = auth.resourceDocumentation;
+  if (auth.protectedResourceMetadataUrl !== void 0)
+    oauth.protected_resource_metadata_url = auth.protectedResourceMetadataUrl;
+  if (auth.requireOAuthClientClaim !== void 0)
+    oauth.require_oauth_client_claim = auth.requireOAuthClientClaim;
+  if (auth.acceptedAudiences !== void 0)
+    oauth.accepted_audiences = auth.acceptedAudiences;
+  if (auth.requiredScopes !== void 0)
+    oauth.required_scopes = auth.requiredScopes;
+  if (auth.jwksUri !== void 0)
+    oauth.jwks_uri = auth.jwksUri;
+  if (auth.algorithms !== void 0)
+    oauth.algorithms = auth.algorithms;
+  if (auth.clockToleranceSeconds !== void 0)
+    oauth.clock_tolerance_seconds = auth.clockToleranceSeconds;
+  return oauth;
+}
+function isToolShape(tool) {
+  if (typeof tool !== "object" || tool === null)
+    return false;
+  const t = tool;
+  return typeof t.name === "string" && typeof t.title === "string" && typeof t.description === "string";
+}
+function isAuthShape(auth) {
+  if (auth === void 0)
+    return true;
+  if (typeof auth !== "object" || auth === null)
+    return false;
+  const a = auth;
+  return a.type === "oauth" && typeof a.issuer === "string" && a.issuer.length > 0;
+}
+function manifestFromDefinition(definition, urlPath, source = "the MCP entry") {
+  const def = definition;
+  const validShape = !!def && typeof def === "object" && typeof def.name === "string" && typeof def.title === "string" && typeof def.version === "string" && Array.isArray(def.tools) && def.tools.every(isToolShape) && isAuthShape(def.auth);
+  if (!validShape) {
+    const got = definition == null ? "no default export" : typeof definition;
+    throw new Error(`@lovable.dev/mcp-js: ${source} must \`export default defineMcp(...)\` (got ${got}).`);
+  }
+  return {
+    version: MANIFEST_VERSION,
+    sdk_version: version,
+    path: urlPath,
+    auth: manifestAuth(def.auth),
+    mcp: buildMcpListing(def)
+  };
+}
+
+// src/stacks/tanstack/ssr-loader.ts
+import { createServer } from "vite";
+async function produceViaSsr(projectRoot2, alias, entryAbs, urlPath) {
+  const server = await createServer({
+    configFile: false,
+    root: projectRoot2,
+    logLevel: "silent",
+    server: { middlewareMode: true, hmr: false, watch: null },
+    optimizeDeps: { noDiscovery: true },
+    resolve: { alias }
+  });
+  try {
+    const mod = await server.ssrLoadModule(entryAbs);
+    return manifestFromDefinition(mod.default, urlPath, entryAbs);
+  } finally {
+    await server.close();
+  }
+}
+
+// src/stacks/tanstack/manifest-io.ts
+var MCP_PLUGIN_NAME = "@lovable.dev/mcp-js";
+var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
+var DEFAULT_MCP_PATH = "/mcp";
+function writeManifestIfChanged(file, manifest) {
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  let existing;
+  try {
+    existing = readFileSync(file, "utf8");
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+  if (existing === content)
+    return;
+  mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tmp, content, "utf8");
+    renameSync(tmp, file);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function removeManifest(file) {
+  try {
+    unlinkSync(file);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+}
+async function syncManifest(manifestFile, entryAbs, urlPath, produce) {
+  let entryExists = true;
+  try {
+    lstatSync(entryAbs);
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+    entryExists = false;
+  }
+  if (!entryExists) {
+    removeManifest(manifestFile);
+    return;
+  }
+  const manifest = await produce(entryAbs, urlPath);
+  writeManifestIfChanged(manifestFile, manifest);
+}
+async function runExtract(projectRoot2) {
+  const resolved = await resolveConfig({ root: projectRoot2, logLevel: "silent" }, "serve");
+  const alias = resolved.resolve?.alias ?? [];
+  const pluginApi = resolved.plugins.find((p) => p.name === MCP_PLUGIN_NAME)?.api;
+  const entryAbs = pluginApi?.mcpEntry ?? resolve(projectRoot2, DEFAULT_MCP_ENTRY);
+  const urlPath = pluginApi?.urlPath ?? DEFAULT_MCP_PATH;
+  await syncManifest(
+    resolve(projectRoot2, MANIFEST_RELATIVE_PATH),
+    entryAbs,
+    urlPath,
+    (entry, path) => produceViaSsr(projectRoot2, alias, entry, path)
+  );
+}
+
+// src/stacks/tanstack/cli/extract-manifest.ts
+var projectRoot = process.argv[2] ?? process.cwd();
+runExtract(projectRoot).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});