@lovable.dev/mcp-js 0.7.1 → 0.9.0

package/dist/stacks/tanstack/index.cjs

@@ -258,10 +258,10 @@ function resolveProtectedResource(auth, request, options) {
   resourceURL.hash = "";
   return trimTrailingSlash(resourceURL.toString());
 }
-function assertResourcePathShape(resourcePath) {
+function assertResourcePathShape(resourcePath, label = "resourcePath") {
   if (!resourcePath.startsWith("/") || resourcePath.startsWith("//") || resourcePath.includes("\\") || /(^|\/)\.\.(\/|$)/.test(resourcePath)) {
     throw new Error(
-      `@lovable.dev/mcp-js: resourcePath must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
+      `@lovable.dev/mcp-js: ${label} must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
     );
   }
 }
@@ -402,16 +402,16 @@ function quoteAuthenticateParam(value) {
   const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
   return `"${sanitized.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
-function resolveProtectedResourceMetadataUrl(auth, request) {
+function resolveProtectedResourceMetadataUrl(auth, request, options) {
   if (auth.protectedResourceMetadataUrl !== void 0)
     return auth.protectedResourceMetadataUrl;
   const base = auth.resource ?? request.url;
-  return new URL(OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
+  return new URL(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
 }
-function wwwAuthenticateHeader(auth, request, params = {}) {
+function wwwAuthenticateHeader(auth, request, options, params = {}) {
   const values = [
     `realm=${quoteAuthenticateParam("mcp")}`,
-    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request))}`
+    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request, options))}`
   ];
   if (auth.requiredScopes && auth.requiredScopes.length > 0) {
     values.push(`scope=${quoteAuthenticateParam(auth.requiredScopes.join(" "))}`);
@@ -422,9 +422,12 @@ function wwwAuthenticateHeader(auth, request, params = {}) {
     values.push(`error_description=${quoteAuthenticateParam(params.errorDescription)}`);
   return `Bearer ${values.join(", ")}`;
 }
-function challengeResponse(auth, request, status, oauthError, errorDescription) {
+function challengeResponse(auth, request, options, status, oauthError, errorDescription) {
   const headers = new Headers(JSON_HEADERS);
-  headers.set("WWW-Authenticate", wwwAuthenticateHeader(auth, request, { error: oauthError, errorDescription }));
+  headers.set(
+    "WWW-Authenticate",
+    wwwAuthenticateHeader(auth, request, options, { error: oauthError, errorDescription })
+  );
   headers.set("Cache-Control", "no-store");
   return new Response(JSON.stringify({ error: status === 403 ? "forbidden" : "unauthorized" }), {
     status,
@@ -452,10 +455,17 @@ function parseBearerToken(request) {
 function getOAuthRuntime(mcp, options = {}) {
   if (options.resourcePath !== void 0)
     assertResourcePathShape(options.resourcePath);
-  const stableOptions = { resourcePath: options.resourcePath };
+  if (options.metadataPath !== void 0)
+    assertResourcePathShape(options.metadataPath, "metadataPath");
+  const stableOptions = { resourcePath: options.resourcePath, metadataPath: options.metadataPath };
   const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
   if (!auth)
     return { kind: "unconfigured", options: stableOptions };
+  if (options.metadataPath !== void 0 && auth.protectedResourceMetadataUrl !== void 0) {
+    throw new Error(
+      `@lovable.dev/mcp-js: the Vite plugin generates protected-resource metadata (metadataPath set), so auth.protectedResourceMetadataUrl must not also be set. Drop protectedResourceMetadataUrl, or set protectedResourceMetadataRoute: false in mcpPlugin(...) to host the document yourself.`
+    );
+  }
   const discovery = createOAuthDiscoveryResolver(auth);
   return {
     kind: "configured",
@@ -494,7 +504,7 @@ function createRequestAuthorizer(mcp, options = {}) {
       const token = parseBearerToken(request);
       if (!token) {
         log.info("auth.no_bearer_token", { outcome: "401" });
-        return { ok: false, response: challengeResponse(runtime.auth, request, 401) };
+        return { ok: false, response: challengeResponse(runtime.auth, request, runtime.options, 401) };
       }
       try {
         const auth = await runtime.verify(token, request, runtime.options);
@@ -509,13 +519,27 @@ function createRequestAuthorizer(mcp, options = {}) {
           log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
           return {
             ok: false,
-            response: challengeResponse(runtime.auth, request, err.status, err.oauthError, err.message)
+            response: challengeResponse(
+              runtime.auth,
+              request,
+              runtime.options,
+              err.status,
+              err.oauthError,
+              err.message
+            )
           };
         }
         log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
         return {
           ok: false,
-          response: challengeResponse(runtime.auth, request, 401, "invalid_token", "Invalid access token")
+          response: challengeResponse(
+            runtime.auth,
+            request,
+            runtime.options,
+            401,
+            "invalid_token",
+            "Invalid access token"
+          )
         };
       }
     }
@@ -718,6 +742,19 @@ function shapeToJsonSchema(shape) {
     return null;
   }
 }
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
@@ -727,18 +764,7 @@ function createListToolsHandler(mcp, options = {}) {
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
       return methodNotAllowed("GET, HEAD, OPTIONS");
-    const body = {
-      server: { name: mcp.name, version: mcp.version, title: mcp.title },
-      tools: mcp.tools.map((tool) => ({
-        name: tool.name,
-        title: tool.title,
-        description: tool.description,
-        annotations: tool.annotations,
-        inputSchema: shapeToJsonSchema(tool.inputSchema),
-        outputSchema: shapeToJsonSchema(tool.outputSchema)
-      }))
-    };
-    const response = Response.json(body);
+    const response = Response.json(buildMcpListing(mcp));
     return request.method === "HEAD" ? headResponse(response) : response;
   };
   return async (request) => {

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { M as McpRuntimeOptions } from '../../authorize-DpTEIFvs.js';
-import { d as McpDefinition } from '../../types-zMlr1mOK.js';
+import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
 import 'zod';
 
 interface TanStackRouteCtx {

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { M as McpRuntimeOptions } from '../../authorize-DpTEIFvs.js';
-import { d as McpDefinition } from '../../types-zMlr1mOK.js';
+import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
 import 'zod';
 
 interface TanStackRouteCtx {

package/dist/stacks/tanstack/index.js

@@ -1,15 +1,17 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-3XPKR4G6.js";
+} from "../../chunk-CJMHLE7F.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-W7F6JRDB.js";
+} from "../../chunk-3GQXQBYQ.js";
 import {
-  createInvokeToolHandler,
-  createListToolsHandler
-} from "../../chunk-LMT6RXUF.js";
+  createInvokeToolHandler
+} from "../../chunk-SBKIKJNB.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-HRMLGCXV.js";
+import {
+  createListToolsHandler
+} from "../../chunk-BG3HOZXZ.js";
+import "../../chunk-FQLM4JDU.js";
 import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 

package/dist/stacks/tanstack/vite.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/stacks/tanstack/vite.ts
 var vite_exports = {};
 __export(vite_exports, {
+  assertMetadataPathShape: () => assertMetadataPathShape,
   assertUrlPathShape: () => assertUrlPathShape,
   default: () => vite_default,
   deriveRouteFileName: () => deriveRouteFileName,
@@ -32,11 +33,13 @@ var import_node_path = require("path");
 // src/auth/metadata-path.ts
 var OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
 
-// src/stacks/tanstack/vite.ts
-var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
+// src/stacks/tanstack/fs-errors.ts
 function isFileMissing(err) {
   return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
+
+// src/stacks/tanstack/vite.ts
+var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
 function normalizePath(p) {
   return p.split(import_node_path.sep).join("/");
 }
@@ -53,15 +56,17 @@ function wellKnownRouteFile(routesDir, urlPath) {
   });
   return (0, import_node_path.resolve)(routesDir, ...fileSegments);
 }
-function resolveAllRoutes(projectRoot, routesDirOption, routeFileName) {
+function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath) {
   const routesDir = (0, import_node_path.resolve)(projectRoot, routesDirOption);
   assertContains(projectRoot, routesDir, `routesDir "${routesDirOption}"`);
   const mcpRouteFile = (0, import_node_path.resolve)(routesDir, routeFileName);
   assertContains(routesDir, mcpRouteFile, `routeFileName "${routeFileName}"`);
+  const metadataRouteFile = wellKnownRouteFile(routesDir, metadataUrlPath);
+  assertContains(routesDir, metadataRouteFile, `metadataPath "${metadataUrlPath}"`);
   return {
     routesDir,
     mcpRouteFile,
-    metadataRouteFile: wellKnownRouteFile(routesDir, OAUTH_PROTECTED_RESOURCE_METADATA_PATH),
+    metadataRouteFile,
     listToolsRouteFile: (0, import_node_path.resolve)(routesDir, "[.mcp]", "list-tools.ts"),
     invokeToolRouteFile: (0, import_node_path.resolve)(routesDir, "[.mcp]", "invoke-tool", "$tool.ts")
   };
@@ -85,6 +90,24 @@ function assertUrlPathShape(urlPath) {
 function deriveRouteFileName(urlPath) {
   return `${assertUrlPathShape(urlPath)}.ts`;
 }
+function assertMetadataPathShape(metadataPath) {
+  if (!metadataPath.startsWith("/")) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath must start with "/", got "${metadataPath}"`);
+  }
+  if (/\/{2,}/.test(metadataPath)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" contains empty segments ("//")`);
+  }
+  if (/(^|\/)\.\.(\/|$)/.test(metadataPath)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" must not contain ".." segments`);
+  }
+  const trimmed = metadataPath.replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" has no route segment`);
+  }
+  if (!/^[a-zA-Z0-9_\-./]+$/.test(trimmed)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" contains unsupported characters`);
+  }
+}
 function canonicalUrlPath(urlPath) {
   return `/${urlPath.replace(/^\/+/, "").replace(/\/+$/, "")}`;
 }
@@ -93,10 +116,11 @@ function relativeImportSpecifier(routeFile, target) {
   const withoutExt = rel.replace(/\.ts$/, "");
   return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, mcpEntry, projectRoot) {
   const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
   const routeRel = normalizePath((0, import_node_path.relative)(projectRoot, route.file));
   const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
+  const runtimeOptions = metadataPath === void 0 ? `{ resourcePath: "${resourcePath}" }` : `{ resourcePath: "${resourcePath}", metadataPath: "${metadataPath}" }`;
   return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -110,7 +134,7 @@ import mcp from "${mcpImport}";
 export const Route = createFileRoute("${route.routeLiteral}")({
   server: {
     handlers: {
-${note}      ANY: ${route.handlerFactory}(mcp, { resourcePath: "${resourcePath}" }),
+${note}      ANY: ${route.handlerFactory}(mcp, ${runtimeOptions}),
     },
   },
 });
@@ -189,12 +213,23 @@ function mcpPlugin(options = {}) {
   const urlPath = canonicalUrlPath(rawUrlPath);
   const emitRestRoutes = options.restRoutes !== false;
   const emitProtectedResourceMetadataRoute = options.protectedResourceMetadataRoute !== false;
+  if (options.metadataPath !== void 0) {
+    if (!emitProtectedResourceMetadataRoute) {
+      throw new Error(
+        `@lovable.dev/mcp-js: metadataPath sets where the protected-resource metadata route is served, so it can't be combined with protectedResourceMetadataRoute: false.`
+      );
+    }
+    assertMetadataPathShape(options.metadataPath);
+  }
+  const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
+  const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
   let projectRoot = process.cwd();
   let mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
   let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
     projectRoot,
     routesDirOption,
-    routeFileName
+    routeFileName,
+    metadataUrlPath
   );
   const regenerate = () => {
     let mcpEntryExists = true;
@@ -213,7 +248,7 @@ function mcpPlugin(options = {}) {
       if (emitProtectedResourceMetadataRoute) {
         routes.push({
           file: metadataRouteFile,
-          routeLiteral: OAUTH_PROTECTED_RESOURCE_METADATA_PATH,
+          routeLiteral: metadataUrlPath,
           handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
         });
       }
@@ -235,7 +270,7 @@ function mcpPlugin(options = {}) {
       }
       for (const route of routes) {
         expected.add(route.file);
-        writeIfChanged(route.file, buildRouteSource(route, urlPath, mcpEntry, projectRoot));
+        writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, mcpEntry, projectRoot));
       }
     }
     for (const file of findAdoptedFiles(routesDir)) {
@@ -251,30 +286,42 @@ function mcpPlugin(options = {}) {
   };
   return {
     name: "@lovable.dev/mcp-js",
+    // The extract CLI reads the resolved entry + URL path back through this
+    // (via `resolveConfig().plugins`) so the manifest honors custom
+    // `mcpEntry`/`path` instead of assuming the defaults. Getters because
+    // `mcpEntry` is finalized in `configResolved`.
+    api: {
+      get mcpEntry() {
+        return mcpEntry;
+      },
+      get urlPath() {
+        return urlPath;
+      }
+    },
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
       ({ routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
         projectRoot,
         routesDirOption,
-        routeFileName
+        routeFileName,
+        metadataUrlPath
       ));
       regenerate();
     },
     configureServer(server) {
-      const watchedEntry = mcpEntry;
-      const onEntryChange = (file) => {
-        if (normalizePath(file) === normalizePath(watchedEntry)) {
+      const onChange = (file) => {
+        if (normalizePath(file) === normalizePath(mcpEntry)) {
           regenerate();
         }
       };
-      server.watcher.on("add", onEntryChange);
-      server.watcher.on("change", onEntryChange);
-      server.watcher.on("unlink", onEntryChange);
+      server.watcher.on("add", onChange);
+      server.watcher.on("change", onChange);
+      server.watcher.on("unlink", onChange);
       server.watcher.once("close", () => {
-        server.watcher.off("add", onEntryChange);
-        server.watcher.off("change", onEntryChange);
-        server.watcher.off("unlink", onEntryChange);
+        server.watcher.off("add", onChange);
+        server.watcher.off("change", onChange);
+        server.watcher.off("unlink", onChange);
       });
     },
     buildStart() {
@@ -285,6 +332,7 @@ function mcpPlugin(options = {}) {
 var vite_default = mcpPlugin;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  assertMetadataPathShape,
   assertUrlPathShape,
   deriveRouteFileName,
   mcpPlugin

package/dist/stacks/tanstack/vite.d.cts

@@ -48,17 +48,41 @@ interface McpPluginOptions {
      * @default true
      */
     protectedResourceMetadataRoute?: boolean;
+    /**
+     * Public URL path for the OAuth protected-resource metadata route (RFC 9728).
+     * Both the emitted route file and the runtime `WWW-Authenticate` challenge use
+     * this path, so they can't drift. Use it when a host gate exposes only a
+     * sub-prefix (e.g. workspace-private projects where only `/api/public/*` is
+     * anonymously reachable) and the default well-known path is blocked.
+     *
+     * Leading-dot segments are bracket-escaped for TanStack file routing
+     * (`.well-known` → `[.well-known]`); the final segment becomes the route file.
+     * Mutually exclusive with `auth.protectedResourceMetadataUrl` (that option
+     * advertises an externally hosted document instead of serving one), and
+     * cannot be combined with `protectedResourceMetadataRoute: false`.
+     * @default "/.well-known/oauth-protected-resource"
+     */
+    metadataPath?: string;
+}
+interface McpPluginApi {
+    readonly mcpEntry: string;
+    readonly urlPath: string;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;
+declare function assertMetadataPathShape(metadataPath: string): void;
 /**
  * Generate the TanStack route(s) that mount the MCP server.
  *
  * Place this in your `vite.config.ts` plugins array. Emits during
  * `configResolved` (so dev-server boot and the TanStack file-router both
  * see the routes on the first request) and re-emits when the MCP entry
- * file changes during dev.
+ * file appears or disappears during dev.
+ *
+ * The `.lovable/mcp/manifest.json` snapshot is produced separately by the
+ * `lovable-mcp-extract-manifest` CLI (run by a host platform at build/commit
+ * time) — not by this plugin.
  */
 declare function mcpPlugin(options?: McpPluginOptions): Plugin;
 
-export { type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };
+export { type McpPluginApi, type McpPluginOptions, assertMetadataPathShape, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };

package/dist/stacks/tanstack/vite.d.ts

@@ -48,17 +48,41 @@ interface McpPluginOptions {
      * @default true
      */
     protectedResourceMetadataRoute?: boolean;
+    /**
+     * Public URL path for the OAuth protected-resource metadata route (RFC 9728).
+     * Both the emitted route file and the runtime `WWW-Authenticate` challenge use
+     * this path, so they can't drift. Use it when a host gate exposes only a
+     * sub-prefix (e.g. workspace-private projects where only `/api/public/*` is
+     * anonymously reachable) and the default well-known path is blocked.
+     *
+     * Leading-dot segments are bracket-escaped for TanStack file routing
+     * (`.well-known` → `[.well-known]`); the final segment becomes the route file.
+     * Mutually exclusive with `auth.protectedResourceMetadataUrl` (that option
+     * advertises an externally hosted document instead of serving one), and
+     * cannot be combined with `protectedResourceMetadataRoute: false`.
+     * @default "/.well-known/oauth-protected-resource"
+     */
+    metadataPath?: string;
+}
+interface McpPluginApi {
+    readonly mcpEntry: string;
+    readonly urlPath: string;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;
+declare function assertMetadataPathShape(metadataPath: string): void;
 /**
  * Generate the TanStack route(s) that mount the MCP server.
  *
  * Place this in your `vite.config.ts` plugins array. Emits during
  * `configResolved` (so dev-server boot and the TanStack file-router both
  * see the routes on the first request) and re-emits when the MCP entry
- * file changes during dev.
+ * file appears or disappears during dev.
+ *
+ * The `.lovable/mcp/manifest.json` snapshot is produced separately by the
+ * `lovable-mcp-extract-manifest` CLI (run by a host platform at build/commit
+ * time) — not by this plugin.
  */
 declare function mcpPlugin(options?: McpPluginOptions): Plugin;
 
-export { type McpPluginOptions, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };
+export { type McpPluginApi, type McpPluginOptions, assertMetadataPathShape, assertUrlPathShape, mcpPlugin as default, deriveRouteFileName, mcpPlugin };

package/dist/stacks/tanstack/vite.js

@@ -1,3 +1,6 @@
+import {
+  isFileMissing
+} from "../../chunk-QJ7XEKT3.js";
 import {
   OAUTH_PROTECTED_RESOURCE_METADATA_PATH
 } from "../../chunk-6DXGZZA4.js";
@@ -6,9 +9,6 @@ import {
 import { lstatSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "fs";
 import { dirname, join, relative, resolve, sep } from "path";
 var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
-function isFileMissing(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
 function normalizePath(p) {
   return p.split(sep).join("/");
 }
@@ -25,15 +25,17 @@ function wellKnownRouteFile(routesDir, urlPath) {
   });
   return resolve(routesDir, ...fileSegments);
 }
-function resolveAllRoutes(projectRoot, routesDirOption, routeFileName) {
+function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath) {
   const routesDir = resolve(projectRoot, routesDirOption);
   assertContains(projectRoot, routesDir, `routesDir "${routesDirOption}"`);
   const mcpRouteFile = resolve(routesDir, routeFileName);
   assertContains(routesDir, mcpRouteFile, `routeFileName "${routeFileName}"`);
+  const metadataRouteFile = wellKnownRouteFile(routesDir, metadataUrlPath);
+  assertContains(routesDir, metadataRouteFile, `metadataPath "${metadataUrlPath}"`);
   return {
     routesDir,
     mcpRouteFile,
-    metadataRouteFile: wellKnownRouteFile(routesDir, OAUTH_PROTECTED_RESOURCE_METADATA_PATH),
+    metadataRouteFile,
     listToolsRouteFile: resolve(routesDir, "[.mcp]", "list-tools.ts"),
     invokeToolRouteFile: resolve(routesDir, "[.mcp]", "invoke-tool", "$tool.ts")
   };
@@ -57,6 +59,24 @@ function assertUrlPathShape(urlPath) {
 function deriveRouteFileName(urlPath) {
   return `${assertUrlPathShape(urlPath)}.ts`;
 }
+function assertMetadataPathShape(metadataPath) {
+  if (!metadataPath.startsWith("/")) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath must start with "/", got "${metadataPath}"`);
+  }
+  if (/\/{2,}/.test(metadataPath)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" contains empty segments ("//")`);
+  }
+  if (/(^|\/)\.\.(\/|$)/.test(metadataPath)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" must not contain ".." segments`);
+  }
+  const trimmed = metadataPath.replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" has no route segment`);
+  }
+  if (!/^[a-zA-Z0-9_\-./]+$/.test(trimmed)) {
+    throw new Error(`@lovable.dev/mcp-js: metadataPath "${metadataPath}" contains unsupported characters`);
+  }
+}
 function canonicalUrlPath(urlPath) {
   return `/${urlPath.replace(/^\/+/, "").replace(/\/+$/, "")}`;
 }
@@ -65,10 +85,11 @@ function relativeImportSpecifier(routeFile, target) {
   const withoutExt = rel.replace(/\.ts$/, "");
   return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, mcpEntry, projectRoot) {
   const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
   const routeRel = normalizePath(relative(projectRoot, route.file));
   const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
+  const runtimeOptions = metadataPath === void 0 ? `{ resourcePath: "${resourcePath}" }` : `{ resourcePath: "${resourcePath}", metadataPath: "${metadataPath}" }`;
   return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -82,7 +103,7 @@ import mcp from "${mcpImport}";
 export const Route = createFileRoute("${route.routeLiteral}")({
   server: {
     handlers: {
-${note}      ANY: ${route.handlerFactory}(mcp, { resourcePath: "${resourcePath}" }),
+${note}      ANY: ${route.handlerFactory}(mcp, ${runtimeOptions}),
     },
   },
 });
@@ -161,12 +182,23 @@ function mcpPlugin(options = {}) {
   const urlPath = canonicalUrlPath(rawUrlPath);
   const emitRestRoutes = options.restRoutes !== false;
   const emitProtectedResourceMetadataRoute = options.protectedResourceMetadataRoute !== false;
+  if (options.metadataPath !== void 0) {
+    if (!emitProtectedResourceMetadataRoute) {
+      throw new Error(
+        `@lovable.dev/mcp-js: metadataPath sets where the protected-resource metadata route is served, so it can't be combined with protectedResourceMetadataRoute: false.`
+      );
+    }
+    assertMetadataPathShape(options.metadataPath);
+  }
+  const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
+  const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
   let projectRoot = process.cwd();
   let mcpEntry = resolve(projectRoot, mcpEntryOption);
   let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
     projectRoot,
     routesDirOption,
-    routeFileName
+    routeFileName,
+    metadataUrlPath
   );
   const regenerate = () => {
     let mcpEntryExists = true;
@@ -185,7 +217,7 @@ function mcpPlugin(options = {}) {
       if (emitProtectedResourceMetadataRoute) {
         routes.push({
           file: metadataRouteFile,
-          routeLiteral: OAUTH_PROTECTED_RESOURCE_METADATA_PATH,
+          routeLiteral: metadataUrlPath,
           handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
         });
       }
@@ -207,7 +239,7 @@ function mcpPlugin(options = {}) {
       }
       for (const route of routes) {
         expected.add(route.file);
-        writeIfChanged(route.file, buildRouteSource(route, urlPath, mcpEntry, projectRoot));
+        writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, mcpEntry, projectRoot));
       }
     }
     for (const file of findAdoptedFiles(routesDir)) {
@@ -223,30 +255,42 @@ function mcpPlugin(options = {}) {
   };
   return {
     name: "@lovable.dev/mcp-js",
+    // The extract CLI reads the resolved entry + URL path back through this
+    // (via `resolveConfig().plugins`) so the manifest honors custom
+    // `mcpEntry`/`path` instead of assuming the defaults. Getters because
+    // `mcpEntry` is finalized in `configResolved`.
+    api: {
+      get mcpEntry() {
+        return mcpEntry;
+      },
+      get urlPath() {
+        return urlPath;
+      }
+    },
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = resolve(projectRoot, mcpEntryOption);
       ({ routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
         projectRoot,
         routesDirOption,
-        routeFileName
+        routeFileName,
+        metadataUrlPath
       ));
       regenerate();
     },
     configureServer(server) {
-      const watchedEntry = mcpEntry;
-      const onEntryChange = (file) => {
-        if (normalizePath(file) === normalizePath(watchedEntry)) {
+      const onChange = (file) => {
+        if (normalizePath(file) === normalizePath(mcpEntry)) {
           regenerate();
         }
       };
-      server.watcher.on("add", onEntryChange);
-      server.watcher.on("change", onEntryChange);
-      server.watcher.on("unlink", onEntryChange);
+      server.watcher.on("add", onChange);
+      server.watcher.on("change", onChange);
+      server.watcher.on("unlink", onChange);
       server.watcher.once("close", () => {
-        server.watcher.off("add", onEntryChange);
-        server.watcher.off("change", onEntryChange);
-        server.watcher.off("unlink", onEntryChange);
+        server.watcher.off("add", onChange);
+        server.watcher.off("change", onChange);
+        server.watcher.off("unlink", onChange);
       });
     },
     buildStart() {
@@ -256,6 +300,7 @@ function mcpPlugin(options = {}) {
 }
 var vite_default = mcpPlugin;
 export {
+  assertMetadataPathShape,
   assertUrlPathShape,
   vite_default as default,
   deriveRouteFileName,

package/dist/{types-zMlr1mOK.d.ts → types-C5SSORxe.d.ts}

@@ -52,6 +52,10 @@ interface McpAuthConfig {
      * `WWW-Authenticate: resource_metadata` challenge and does not generate or
      * serve its own metadata (the `/.well-known/oauth-protected-resource` handler
      * 404s). Use it when the resource server already publishes its own PRM.
+     *
+     * Mutually exclusive with the Vite plugin's `metadataPath`: that option has
+     * the SDK serve the document itself at a custom path, so configuring both is
+     * rejected at handler construction.
      */
     readonly protectedResourceMetadataUrl?: string;
     readonly requireOAuthClientClaim?: boolean;