@lovable.dev/mcp-js 1.0.0 → 2.0.1

package/README.internal.md

@@ -4,7 +4,7 @@ Architecture rationale, source layout, and dev scripts for contributors. The use
 
 ## Folder meaning
 
-- **`protocols/`** is the wire layer — one folder per externally observable HTTP surface. `protocols/mcp` is the public MCP-over-HTTP surface; `protocols/oauth-metadata` serves the RFC 9728 protected-resource metadata required to bootstrap protected MCP clients. `protocols/gate.ts` is the CORS → auth → method gate the MCP surface runs behind.
+- **`protocols/`** is the wire layer — one folder per externally observable HTTP surface. `protocols/mcp` is the public MCP-over-HTTP surface; `protocols/oauth-metadata` serves the RFC 9728 protected-resource metadata required to bootstrap protected MCP clients. `protocols/gate.ts` is the shared CORS → auth → method gate both surfaces run behind.
 - **`auth/`** (unpublished) is the cross-cutting OAuth middleware — bearer verification, issuer/JWKS discovery, the `auth.oauth.*` config namespace. It depends only on `core/`; `protocols/mcp` depends on it for the bearer gate, so it isn't a wire-format peer of `mcp` and doesn't live under `protocols/`.
 - **`stacks/`** is the framework integration. Two are published: `stacks/tanstack/` (file-router routes emitted by a Vite plugin) and `stacks/supabase/` (a single Deno-served function with URL-suffix dispatch, emitted by the Supabase Vite plugin). Future entries (classic Vite, Cloudflare Workers, …) live alongside them. Each stack forwards to `protocols/{mcp,oauth-metadata}` directly — protocol logic stays shared, only ctx unwrapping and route emission differ.
 - **`manifest/`** is the stack-agnostic snapshot writer. `lovable-mcp-extract-manifest` is one CLI for every stack: it asks Vite for the resolved config, finds any plugin whose name matches `@lovable.dev/mcp-js*`, and reads `mcpEntry` + `urlPath` off its `api`. TanStack publishes its configured route path (`/mcp`); Supabase publishes `/functions/v1/<functionName>`. The projection (`extract.ts` + `listing.ts`) is pure and derives from the same `defineMcp` definition the live `tools/list` serves, so the committed manifest and the served catalog can't drift.
@@ -79,7 +79,7 @@ The published `.d.ts` files import only from `zod` and `vite`. Three SDK concern
 - **`ZodRawShape`, `ZodType`, `infer`** — sourced directly from `zod` (a peer dep). zod v3 and v4 both export all three at the top level; `ZodType` is non-deprecated in both versions with safe generic defaults. We re-export them from `core/types.ts` as `ZodRawShape` / `ZodSchema` / `ShapeOutput` (`ZodSchema` is a no-generic alias for `ZodType`). No dependency on `@modelcontextprotocol/sdk/server/zod-compat.js` types.
 - **`ContentBlock` union** — `TextContent | ImageContent | AudioContent | EmbeddedResource | ResourceLink`, structurally matching MCP's wire format. Consumers can type custom content (`return { content: [<ImageContent>, <TextContent>] }`) without referencing the SDK.
 
-The **runtime** still hands off to the MCP SDK — we still `import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"` and call `registerTool`, and we still use `objectFromShape` + `toJsonSchemaCompat` from the SDK's zod-compat modules to serialize the tool catalog to JSON Schema. That's a runtime dependency, not a type-surface dependency.
+The **runtime** still hands off to the MCP SDKs — `createMcpHandler` + `McpServer` come from `@modelcontextprotocol/server` (v2), and `objectFromShape` + `safeParseAsync` + `toJsonSchemaCompat` come from `@modelcontextprotocol/sdk`'s zod-compat modules for input validation and JSON-Schema serialization. Those are runtime dependencies, not type-surface dependencies.
 
 ### 8. Stale-route cleanup on every regen
 
@@ -141,7 +141,7 @@ src/
       vite.ts                    # mcpPlugin (Vite-lifecycle trigger; exposes McpPluginApi with urlPath=/functions/v1/<functionName>)
       index.ts                   # barrel
 tests/
-  core/{content,define,errors,forwarded,logger,promise,supabase-config,url}.test.ts
+  core/{content,cors,define,errors,forwarded,logger,promise,supabase-config,url}.test.ts
   auth/{claims,config,context,oauth,oauth-fallback,oauth-logging,oauth-metrics}.test.ts  # OAuth config + bearer verification
   metrics/{config,dispatch,otlp,recorder}.test.ts
   protocols/

package/README.md

@@ -49,7 +49,13 @@ That's the whole authoring surface. No imperative server construction, no route
 
 The table shows the default `path: "/mcp"`; `mcpPlugin({ path: "/api/public/mcp" })` moves the MCP route accordingly.
 
-MCP (`POST <path>`, `/mcp` by default) is the wire format clients speak directly. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth policy protects them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, clients must pass `Authorization: Bearer <token>`. Rate limiting belongs at the app host or edge.
+MCP (`POST <path>`, `/mcp` by default) is the wire format clients speak directly. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth and browser-origin policies protect them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, clients must pass `Authorization: Bearer <token>`. Rate limiting belongs at the app host or edge.
+
+The MCP endpoint supports both protocol eras on one URL. Finalized `2026-07-28` clients send the version, client capabilities, and mirrored HTTP headers on every request; the server returns typed results plus cache metadata on discovery and list responses without initialization or protocol sessions. Initialization-era clients continue through a stateless compatibility path: `initialize`, `tools/list`, and `tools/call` work as independent requests, and the endpoint never mints `Mcp-Session-Id`. `GET` and `DELETE` return `405` because there is no standalone stream or session to manage.
+
+`outputSchema` accepts either the existing object-shape shorthand (`{ value: z.string() }`) or a JSON-Schema-representable Zod schema such as `z.array(z.string())`; `structuredContent` may be any JSON value. The server returns the schema's parsed output, so coercions are reflected in the result; transforms with no truthful JSON Schema are rejected when `defineMcp` runs. Modern clients receive the natural schema and value. The compatibility path wraps non-object schemas and values under `result` for initialization-era clients whose wire format requires an object root.
+
+Browser-origin checks apply to the MCP and OAuth metadata routes before authentication. Omit `allowedOrigins` to allow requests with no `Origin` header (Go, desktop, CLI, and server clients) plus same-origin browser requests. Set `allowedOrigins: ["https://client.example.com"]` for exact additional origins, or `allowedOrigins: "any"` to intentionally restore wildcard CORS. Exact and same origins are reflected with `Vary: Origin`; other browser origins receive `403` without an OAuth challenge. Reverse-proxy adapters compare against the effective public origin after applying only their configured trusted forwarded headers.
 
 The OAuth metadata route is emitted by default and returns `404` until OAuth auth is configured. Disable it with `mcpPlugin({ protectedResourceMetadataRoute: false })` only if the app owns `/.well-known/oauth-protected-resource` itself.
 
@@ -160,6 +166,23 @@ and no `node:async_hooks` dependency, so it works on any runtime and is safe
 under concurrency by construction. A handler that hands `ctx` to deferred work (a
 detached timer, an un-awaited promise) keeps full access to it.
 
+Beyond auth, `ToolContext` carries the per-request runtime surface:
+
+| Member | Purpose |
+| --- | --- |
+| `signal` | An `AbortSignal` that aborts when the client cancels the request or disconnects. Pass it to `fetch` and other cancelable APIs, or check `signal.aborted` between steps of long work. |
+| `client` | What the calling client declared about itself (`McpClientInfo`): `protocol` (`"2026-07-28"` or `"legacy"`), and for modern requests the envelope's `info`, `capabilities`, and `extensions`. Unverified client input — use it to adapt output, never to authorize. |
+| `progress(update)` | Sends a `notifications/progress` frame (`{ progress, total?, message? }`) for long-running tools. A no-op unless the client requested progress by sending `_meta.progressToken`; safe to call unconditionally. |
+
+```ts
+handler: async ({ url }, ctx) => {
+  await ctx.progress({ progress: 0, total: 2, message: "fetching" });
+  const res = await fetch(url, { signal: ctx.signal });
+  await ctx.progress({ progress: 1, total: 2, message: "processing" });
+  return { content: [{ type: "text", text: await res.text() }] };
+};
+```
+
 **Security contract for the bearer token.** `getToken()` is the only way to read
 the raw token. `ToolContext` holds the verified context in a private field, so the
 credential can't be read off the instance via `JSON.stringify`, object spread, or
@@ -205,9 +228,19 @@ The request-derived `resource` default trusts the incoming `Host` to name this s
 
 Use `auth.oauth.issuer(...)`, set `resource` or `acceptedAudiences` to anchor the accepted audience, and optionally set `jwksUri` and `requiredScopes`. For Supabase project auth, set `acceptedAudiences: "authenticated"`, keep app/business checks in app code, and forward `ctx.getToken()` to Supabase for RLS-backed data access.
 
+## Security posture
+
+For anyone evaluating an app that exposes an MCP server with this package:
+
+- **Verification runs in the app runtime.** When `defineMcp({ auth })` configures OAuth, the emitted TanStack route or Supabase Edge Function verifies the bearer before dispatching a tool. Clients call the app's published endpoint; the SDK does not relay MCP calls through a shared Lovable MCP protocol gateway, although a Lovable-hosted TanStack app still receives ordinary web traffic through Lovable's hosting proxy. The SDK may fetch issuer metadata and JWKS. When default usage telemetry is emitted, it sends the operational fields described below, including the verified token `sub`; it never sends the bearer, full claims, tool arguments, or tool results.
+- **No protocol sessions.** Every HTTP request gets a fresh MCP server, auth context, and tool callback closure. The endpoint never mints a session ID or retains MCP protocol or auth session state across requests. Durable application state belongs in the app's own storage.
+- **Audience validation is explicit.** A populated token `aud` must exactly match `resource` or `acceptedAudiences`. For issuer compatibility, the default also accepts a matching `resource` claim when `aud` is absent or an empty array; set `acceptResourceClaim: false` to require a matching `aud` (strict RFC 9068).
+- **The deployment controls the SDK version.** TanStack resolves the app's declared dependency through its package manager and lockfile. The generated Supabase function exact-pins the SDK release that emitted it. Updating or regenerating the dependency and redeploying is how an app adopts a newer SDK.
+- **Controls are divided between layers.** When OAuth is configured, the SDK owns bearer verification; it also owns origin policy (`allowedOrigins`) and redacts unexpected errors. `ToolError` and returned `isError` results are intentionally caller-visible. Per-tool authorization, data access (including RLS), rate limiting, and WAF belong to the app and its host.
+
 ## Debug logging
 
-The runtime logs operational events (tool invocations, auth outcomes, warnings, errors) at `info` by default. Raise the level to `debug` to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token, full claims, or PII** — only non-secret fields such as the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, the token `scopes`, and `jose` error codes. End-user identifiers (the token `sub`/`client_id`) appear only at `debug`, as the `oauth.verify.principal` event — the default `info` level never collects them.
+The runtime logs operational events (tool invocations, auth outcomes, warnings, errors) at `info` by default. Raise the level to `debug` to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token or full claims**. Depending on the log level, operational fields include the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, token scopes, and `jose` error codes. The default `info` level excludes end-user identifiers; the token `sub`/`client_id` appears only at `debug`, as the `oauth.verify.principal` event.
 
 Enable it either way:
 
@@ -228,7 +261,7 @@ A `500` on an OAuth-protected route is always one of two causes, logged at `erro
 
 ## Usage metrics
 
-Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome, and latency — as **OTLP/HTTP JSON logs**, one awaited POST per record, bounded by a 3-second timeout; a failed or slow POST is logged (`metrics.failed`) and swallowed, never failing the request. Outcomes cover tool results (`ok`, `tool_error`, `handler_error`, `transport_error`) and the authorization gate: `auth_challenge` for an unauthenticated request answered with the `401` challenge (so probe traffic produces records), and the `auth_*` discovery/JWKS failure outcomes. No tool arguments or response payloads are ever captured. Emission is **on by default** and self-disables at runtime when `LOVABLE_API_KEY` is absent: records are dropped and one `metrics.disabled_no_api_key` warning is logged per process, so a local `vite dev` stays quiet. With `metrics: false` the recorder never runs — on Deno and Cloudflare Workers that also means `LOVABLE_MCP_LOG_LEVEL` is never applied (use `setLogLevel()` instead).
+Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome, latency, request and response sizes when available, and the verified token `sub` for authenticated calls — as **OTLP/HTTP JSON logs**, one awaited POST per record, bounded by a 3-second timeout; a failed or slow POST is logged (`metrics.failed`) and swallowed, never failing the request. Outcomes cover tool results (`ok`, `tool_error`, `handler_error`, `transport_error`), the authorization gate — `auth_challenge` for an unauthenticated request answered with the `401` challenge (so probe traffic produces records), and the `auth_*` discovery/JWKS failure outcomes — and `origin_rejected` for a request refused `403` by the origin policy. Tool-call records also carry the protocol era (`mcp.protocol`: `2026-07-28` or `legacy`); records emitted before protocol classification (auth challenges, transport errors, origin rejections) have no protocol attribute. The bearer token, full claims, tool arguments, and response payloads are never captured. Emission is **on by default** and self-disables at runtime when `LOVABLE_API_KEY` is absent: records are dropped and one `metrics.disabled_no_api_key` warning is logged per process, so a local `vite dev` stays quiet. With `metrics: false` the recorder never runs — on Deno and Cloudflare Workers that also means `LOVABLE_MCP_LOG_LEVEL` is never applied (use `setLogLevel()` instead).
 
 Configure it on the MCP definition:
 

package/dist/{authorize-DIYS7zBP.d.cts → authorize-9hTTG-qJ.d.cts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.cjs";
+import "./types-3CZPz364.cjs";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /** Public MCP path OAuth resource/audience checks bind to when it differs from the request path. */

package/dist/{authorize-CqYsQYfa.d.ts → authorize-DNUlPT7k.d.ts}

@@ -1,4 +1,4 @@
-import "./types-C0Wgm9zp.js";
+import "./types-3CZPz364.js";
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /** Public MCP path OAuth resource/audience checks bind to when it differs from the request path. */

package/dist/base-7cq6HCPO.d.ts

@@ -0,0 +1,36 @@
+import { E as McpProtocolEra } from "./types-3CZPz364.js";
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "origin_rejected" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** Wire surface that served the call; absent on records emitted before
+   *  protocol classification (auth gate, transport faults). */
+  protocol?: McpProtocolEra;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
+   *  summary (`handler_error`). Local log only — never sent to the collector. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
+export { MetricsRecorder as t };

package/dist/base-CHNFFrMG.d.cts

@@ -0,0 +1,36 @@
+import { E as McpProtocolEra } from "./types-3CZPz364.cjs";
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "origin_rejected" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** Wire surface that served the call; absent on records emitted before
+   *  protocol classification (auth gate, transport faults). */
+  protocol?: McpProtocolEra;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
+   *  summary (`handler_error`). Local log only — never sent to the collector. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
+export { MetricsRecorder as t };

package/dist/cli/extract-manifest.cjs

@@ -1,20 +1,15 @@
 #!/usr/bin/env node
-const require_package = require("../package-C_8WAZRS.cjs");
+const require_schema = require("../schema-D3vClxb7.cjs");
+const require_package = require("../package-D8nZVoHm.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let vite = require("vite");
 let node_crypto = require("node:crypto");
-let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
-let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
 //#region src/manifest/listing.ts
-function shapeToJsonSchema(shape) {
-	if (!shape) return null;
-	try {
-		return (0, _modelcontextprotocol_sdk_server_zod_json_schema_compat_js.toJsonSchemaCompat)((0, _modelcontextprotocol_sdk_server_zod_compat_js.objectFromShape)(shape));
-	} catch {
-		return null;
-	}
+function schemaToJsonSchema(definition, pipeStrategy) {
+	if (!definition) return null;
+	return require_schema.jsonSchemaFromDefinition(definition, pipeStrategy);
 }
 function buildMcpListing(mcp) {
 	return {
@@ -28,8 +23,8 @@ function buildMcpListing(mcp) {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
-			inputSchema: shapeToJsonSchema(tool.inputSchema),
-			outputSchema: shapeToJsonSchema(tool.outputSchema)
+			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
 		}))
 	};
 }

package/dist/cli/extract-manifest.js

@@ -1,20 +1,15 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CLhOKbJP.js";
+import { t as jsonSchemaFromDefinition } from "../schema-CW1jKvio.js";
+import { t as version } from "../package-DSwNopNG.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createServer, resolveConfig } from "vite";
 import { randomUUID } from "node:crypto";
-import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
-import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
 //#region src/manifest/listing.ts
-function shapeToJsonSchema(shape) {
-	if (!shape) return null;
-	try {
-		return toJsonSchemaCompat(objectFromShape(shape));
-	} catch {
-		return null;
-	}
+function schemaToJsonSchema(definition, pipeStrategy) {
+	if (!definition) return null;
+	return jsonSchemaFromDefinition(definition, pipeStrategy);
 }
 function buildMcpListing(mcp) {
 	return {
@@ -28,8 +23,8 @@ function buildMcpListing(mcp) {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
-			inputSchema: shapeToJsonSchema(tool.inputSchema),
-			outputSchema: shapeToJsonSchema(tool.outputSchema)
+			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
 		}))
 	};
 }

package/dist/{authorize-9wHgaqeQ.js → cors-BLWQyVL5.js}

@@ -1,28 +1,7 @@
 import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as version } from "./package-CLhOKbJP.js";
+import { t as version } from "./package-DSwNopNG.js";
 import "./metadata-path-CAkNcfyY.js";
 import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -34,7 +13,7 @@ function headResponse(response) {
 	});
 }
 function finalizeWireResponse(request, response) {
-	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+	return request.method === "HEAD" ? headResponse(response) : response;
 }
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
@@ -49,7 +28,8 @@ function methodNotAllowed(allow) {
 //#endregion
 //#region src/metrics/otlp.ts
 const SCOPE_NAME = "@lovable.dev/mcp-js";
-const EVENT_NAME = "mcp.tool.invocation";
+const TOOL_EVENT_NAME = "mcp.tool.invocation";
+const GATE_EVENT_NAME = "mcp.gate.rejection";
 const SEVERITY_INFO = 9;
 function strAttr(key, value) {
 	return {
@@ -64,8 +44,9 @@ function intAttr(key, value) {
 	};
 }
 function toLogRecord(rec) {
+	const eventName = rec.method === "authorize" ? GATE_EVENT_NAME : TOOL_EVENT_NAME;
 	const attributes = [
-		strAttr("event.name", EVENT_NAME),
+		strAttr("event.name", eventName),
 		strAttr("mcp.method", rec.method),
 		strAttr("mcp.outcome", rec.outcome),
 		intAttr("mcp.duration_ms", rec.durationMs)
@@ -74,6 +55,7 @@ function toLogRecord(rec) {
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
 	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
+	if (rec.protocol !== void 0) attributes.push(strAttr("mcp.protocol", rec.protocol));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -81,7 +63,7 @@ function toLogRecord(rec) {
 		observedTimeUnixNano: rec.timeUnixNano,
 		severityNumber: SEVERITY_INFO,
 		severityText: "INFO",
-		body: { stringValue: EVENT_NAME },
+		body: { stringValue: eventName },
 		attributes
 	};
 }
@@ -171,12 +153,13 @@ var BaseMetricRecorder = class {
 	}
 	async emit(ev) {
 		await this.applyLazyLogLevel();
-		if (ev.outcome !== "auth_challenge") log.info("tool.invoked", {
+		if (ev.outcome !== "auth_challenge" && ev.outcome !== "origin_rejected") log.info(ev.method === "authorize" ? "gate.rejected" : "tool.invoked", {
 			tool: ev.tool,
 			method: ev.method,
 			outcome: ev.outcome,
 			durationMs: ev.durationMs,
 			stack: this.stack,
+			...ev.protocol !== void 0 && { protocol: ev.protocol },
 			...ev.errorText !== void 0 && { errorText: ev.errorText }
 		});
 		if (!this.config.enabled) return;
@@ -948,4 +931,72 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
-export { resolveProtectedResource as a, nowMs as c, methodNotAllowed as d, corsPreflightResponse as f, assertResourcePathShape as i, JSON_HEADERS as l, getOAuthRuntime as n, createRecorderForRuntime as o, oauthConfigurationErrorResponse as r, createNoopRecorder as s, createRequestAuthorizer as t, finalizeWireResponse as u };
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id";
+const ALLOW_HEADERS = [
+	"Authorization",
+	"Content-Type",
+	"MCP-Protocol-Version",
+	"Mcp-Method",
+	"Mcp-Name",
+	"Mcp-Session-Id",
+	"Last-Event-ID"
+];
+const MCP_PARAM_HEADER = /^mcp-param-[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function appendVary(headers, value) {
+	const values = new Set((headers.get("Vary") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
+	values.add(value);
+	headers.set("Vary", [...values].join(", "));
+}
+function addCorsHeaders(response, allowedOrigin, variesByOrigin) {
+	if (allowedOrigin !== void 0) {
+		response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	}
+	if (variesByOrigin) appendVary(response.headers, "Origin");
+	return response;
+}
+function allowedRequestHeaders(request) {
+	const allowed = new Map(ALLOW_HEADERS.map((header) => [header.toLowerCase(), header]));
+	for (const header of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+		const normalized = header.trim();
+		if (MCP_PARAM_HEADER.test(normalized)) allowed.set(normalized.toLowerCase(), normalized);
+	}
+	return [...allowed.values()].join(", ");
+}
+function evaluateCors(request, allowedOrigins) {
+	const origin = request.headers.get("Origin");
+	const allowAny = allowedOrigins === "any";
+	const originAllowed = origin === null || origin === new URL(request.url).origin || allowedOrigins?.includes(origin) === true;
+	if (!allowAny && !originAllowed) {
+		const response = Response.json({ error: "origin not allowed" }, {
+			status: 403,
+			headers: { "Cache-Control": "no-store" }
+		});
+		appendVary(response.headers, "Origin");
+		return {
+			ok: false,
+			response
+		};
+	}
+	const allowedOrigin = allowAny ? "*" : origin ?? void 0;
+	return {
+		ok: true,
+		withHeaders: (response) => addCorsHeaders(response, allowedOrigin, !allowAny),
+		preflight: (allowMethods) => {
+			const requestedHeaders = request.headers.get("Access-Control-Request-Headers");
+			const response = new Response(null, {
+				status: 204,
+				headers: {
+					"Access-Control-Allow-Methods": allowMethods,
+					"Access-Control-Allow-Headers": allowedRequestHeaders(request),
+					"Access-Control-Max-Age": "86400"
+				}
+			});
+			if (requestedHeaders) appendVary(response.headers, "Access-Control-Request-Headers");
+			return addCorsHeaders(response, allowedOrigin, !allowAny);
+		}
+	};
+}
+//#endregion
+export { oauthConfigurationErrorResponse as a, createRecorderForRuntime as c, JSON_HEADERS as d, finalizeWireResponse as f, normalizeHttpMethod as i, createNoopRecorder as l, createRequestAuthorizer as n, assertResourcePathShape as o, methodNotAllowed as p, getOAuthRuntime as r, resolveProtectedResource as s, evaluateCors as t, nowMs as u };

package/dist/{authorize-DBk5GkN_.cjs → cors-BvJ-XM16.cjs}

@@ -1,28 +1,7 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
-const require_package = require("./package-C_8WAZRS.cjs");
+const require_package = require("./package-D8nZVoHm.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
-//#region src/core/cors.ts
-const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-/** Add permissive CORS to a built response, preserving its other headers. */
-function withCors(response) {
-	response.headers.set("Access-Control-Allow-Origin", "*");
-	response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-	return response;
-}
-function corsPreflightResponse(allowMethods) {
-	return new Response(null, {
-		status: 204,
-		headers: {
-			"Access-Control-Allow-Origin": "*",
-			"Access-Control-Allow-Methods": allowMethods,
-			"Access-Control-Allow-Headers": ALLOW_HEADERS,
-			"Access-Control-Max-Age": "86400"
-		}
-	});
-}
-//#endregion
 //#region src/core/http.ts
 const JSON_HEADERS = { "Content-Type": "application/json" };
 /** Strip the body from a built response, preserving status and headers, for HEAD. */
@@ -34,7 +13,7 @@ function headResponse(response) {
 	});
 }
 function finalizeWireResponse(request, response) {
-	return withCors(request.method === "HEAD" ? headResponse(response) : response);
+	return request.method === "HEAD" ? headResponse(response) : response;
 }
 function methodNotAllowed(allow) {
 	return new Response(JSON.stringify({ error: "method not allowed" }), {
@@ -49,7 +28,8 @@ function methodNotAllowed(allow) {
 //#endregion
 //#region src/metrics/otlp.ts
 const SCOPE_NAME = "@lovable.dev/mcp-js";
-const EVENT_NAME = "mcp.tool.invocation";
+const TOOL_EVENT_NAME = "mcp.tool.invocation";
+const GATE_EVENT_NAME = "mcp.gate.rejection";
 const SEVERITY_INFO = 9;
 function strAttr(key, value) {
 	return {
@@ -64,8 +44,9 @@ function intAttr(key, value) {
 	};
 }
 function toLogRecord(rec) {
+	const eventName = rec.method === "authorize" ? GATE_EVENT_NAME : TOOL_EVENT_NAME;
 	const attributes = [
-		strAttr("event.name", EVENT_NAME),
+		strAttr("event.name", eventName),
 		strAttr("mcp.method", rec.method),
 		strAttr("mcp.outcome", rec.outcome),
 		intAttr("mcp.duration_ms", rec.durationMs)
@@ -74,6 +55,7 @@ function toLogRecord(rec) {
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
 	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
+	if (rec.protocol !== void 0) attributes.push(strAttr("mcp.protocol", rec.protocol));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -81,7 +63,7 @@ function toLogRecord(rec) {
 		observedTimeUnixNano: rec.timeUnixNano,
 		severityNumber: SEVERITY_INFO,
 		severityText: "INFO",
-		body: { stringValue: EVENT_NAME },
+		body: { stringValue: eventName },
 		attributes
 	};
 }
@@ -171,12 +153,13 @@ var BaseMetricRecorder = class {
 	}
 	async emit(ev) {
 		await this.applyLazyLogLevel();
-		if (ev.outcome !== "auth_challenge") require_logger.log.info("tool.invoked", {
+		if (ev.outcome !== "auth_challenge" && ev.outcome !== "origin_rejected") require_logger.log.info(ev.method === "authorize" ? "gate.rejected" : "tool.invoked", {
 			tool: ev.tool,
 			method: ev.method,
 			outcome: ev.outcome,
 			durationMs: ev.durationMs,
 			stack: this.stack,
+			...ev.protocol !== void 0 && { protocol: ev.protocol },
 			...ev.errorText !== void 0 && { errorText: ev.errorText }
 		});
 		if (!this.config.enabled) return;
@@ -948,6 +931,74 @@ function createRequestAuthorizer(mcp, options = {}) {
 	} };
 }
 //#endregion
+//#region src/core/cors.ts
+const EXPOSE_HEADERS = "WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id";
+const ALLOW_HEADERS = [
+	"Authorization",
+	"Content-Type",
+	"MCP-Protocol-Version",
+	"Mcp-Method",
+	"Mcp-Name",
+	"Mcp-Session-Id",
+	"Last-Event-ID"
+];
+const MCP_PARAM_HEADER = /^mcp-param-[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function appendVary(headers, value) {
+	const values = new Set((headers.get("Vary") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
+	values.add(value);
+	headers.set("Vary", [...values].join(", "));
+}
+function addCorsHeaders(response, allowedOrigin, variesByOrigin) {
+	if (allowedOrigin !== void 0) {
+		response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+	}
+	if (variesByOrigin) appendVary(response.headers, "Origin");
+	return response;
+}
+function allowedRequestHeaders(request) {
+	const allowed = new Map(ALLOW_HEADERS.map((header) => [header.toLowerCase(), header]));
+	for (const header of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+		const normalized = header.trim();
+		if (MCP_PARAM_HEADER.test(normalized)) allowed.set(normalized.toLowerCase(), normalized);
+	}
+	return [...allowed.values()].join(", ");
+}
+function evaluateCors(request, allowedOrigins) {
+	const origin = request.headers.get("Origin");
+	const allowAny = allowedOrigins === "any";
+	const originAllowed = origin === null || origin === new URL(request.url).origin || allowedOrigins?.includes(origin) === true;
+	if (!allowAny && !originAllowed) {
+		const response = Response.json({ error: "origin not allowed" }, {
+			status: 403,
+			headers: { "Cache-Control": "no-store" }
+		});
+		appendVary(response.headers, "Origin");
+		return {
+			ok: false,
+			response
+		};
+	}
+	const allowedOrigin = allowAny ? "*" : origin ?? void 0;
+	return {
+		ok: true,
+		withHeaders: (response) => addCorsHeaders(response, allowedOrigin, !allowAny),
+		preflight: (allowMethods) => {
+			const requestedHeaders = request.headers.get("Access-Control-Request-Headers");
+			const response = new Response(null, {
+				status: 204,
+				headers: {
+					"Access-Control-Allow-Methods": allowMethods,
+					"Access-Control-Allow-Headers": allowedRequestHeaders(request),
+					"Access-Control-Max-Age": "86400"
+				}
+			});
+			if (requestedHeaders) appendVary(response.headers, "Access-Control-Request-Headers");
+			return addCorsHeaders(response, allowedOrigin, !allowAny);
+		}
+	};
+}
+//#endregion
 Object.defineProperty(exports, "JSON_HEADERS", {
 	enumerable: true,
 	get: function() {
@@ -960,12 +1011,6 @@ Object.defineProperty(exports, "assertResourcePathShape", {
 		return assertResourcePathShape;
 	}
 });
-Object.defineProperty(exports, "corsPreflightResponse", {
-	enumerable: true,
-	get: function() {
-		return corsPreflightResponse;
-	}
-});
 Object.defineProperty(exports, "createNoopRecorder", {
 	enumerable: true,
 	get: function() {
@@ -984,6 +1029,12 @@ Object.defineProperty(exports, "createRequestAuthorizer", {
 		return createRequestAuthorizer;
 	}
 });
+Object.defineProperty(exports, "evaluateCors", {
+	enumerable: true,
+	get: function() {
+		return evaluateCors;
+	}
+});
 Object.defineProperty(exports, "finalizeWireResponse", {
 	enumerable: true,
 	get: function() {
@@ -1002,6 +1053,12 @@ Object.defineProperty(exports, "methodNotAllowed", {
 		return methodNotAllowed;
 	}
 });
+Object.defineProperty(exports, "normalizeHttpMethod", {
+	enumerable: true,
+	get: function() {
+		return normalizeHttpMethod;
+	}
+});
 Object.defineProperty(exports, "nowMs", {
 	enumerable: true,
 	get: function() {