@lovable.dev/mcp-js 2.0.2 → 2.0.3

package/dist/{authorize-Wg16_NdO.d.ts → authorize-B5VMSzcN.d.ts}

@@ -1,4 +1,7 @@
 import "./types-C6O4ciic.js";
+//#region src/metrics/recorder.d.ts
+type ScheduleBackground = (task: Promise<unknown>) => void;
+//#endregion
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /** Public MCP path OAuth resource/audience checks bind to when it differs from the request path. */
@@ -33,4 +36,4 @@ interface McpRuntimeOptions {
   forwardedHostTrustedByPlatform?: boolean;
 }
 //#endregion
-export { McpRuntimeOptions as t };
+export { ScheduleBackground as n, McpRuntimeOptions as t };

package/dist/{authorize-BobVCjtA.d.cts → authorize-oCEahmRv.d.cts}

@@ -1,4 +1,7 @@
 import "./types-C6O4ciic.cjs";
+//#region src/metrics/recorder.d.ts
+type ScheduleBackground = (task: Promise<unknown>) => void;
+//#endregion
 //#region src/auth/authorize.d.ts
 interface McpRuntimeOptions {
   /** Public MCP path OAuth resource/audience checks bind to when it differs from the request path. */
@@ -33,4 +36,4 @@ interface McpRuntimeOptions {
   forwardedHostTrustedByPlatform?: boolean;
 }
 //#endregion
-export { McpRuntimeOptions as t };
+export { ScheduleBackground as n, McpRuntimeOptions as t };

package/dist/{base-6YZsnawW.d.cts → base-DAkOPRay.d.cts}

@@ -27,8 +27,7 @@ interface InvocationRecord {
    *  summary (`handler_error`). Local log only — never sent to the collector. */
   errorText?: string;
 }
-/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
- *  single OTLP POST, awaited so it lands before the request ends. */
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a single OTLP POST. */
 interface MetricsRecorder {
   emit(ev: InvocationRecord): Promise<void>;
 }

package/dist/{base-BKfPCoJ4.d.ts → base-DnCoJOZN.d.ts}

@@ -27,8 +27,7 @@ interface InvocationRecord {
    *  summary (`handler_error`). Local log only — never sent to the collector. */
   errorText?: string;
 }
-/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
- *  single OTLP POST, awaited so it lands before the request ends. */
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a single OTLP POST. */
 interface MetricsRecorder {
   emit(ev: InvocationRecord): Promise<void>;
 }

package/dist/cli/extract-manifest.cjs

@@ -4,7 +4,7 @@ const projectRoot = process.argv[2] ?? process.cwd();
 import("zod/v3").catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	throw new Error(`@lovable.dev/mcp-js requires zod ^3.25 or ^4.0 to extract MCP schemas. Verify the project's zod dependency and package resolution, then try again. Underlying error: ${message}`);
-}).then(() => Promise.resolve().then(() => require("../io-CZzR7mTd.cjs"))).then(({ runExtract }) => runExtract(projectRoot)).catch((err) => {
+}).then(() => Promise.resolve().then(() => require("../io-XzL-H5AK.cjs"))).then(({ runExtract }) => runExtract(projectRoot)).catch((err) => {
 	console.error(err instanceof Error ? err.message : String(err));
 	process.exit(1);
 });

package/dist/cli/extract-manifest.js

@@ -4,7 +4,7 @@ const projectRoot = process.argv[2] ?? process.cwd();
 import("zod/v3").catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	throw new Error(`@lovable.dev/mcp-js requires zod ^3.25 or ^4.0 to extract MCP schemas. Verify the project's zod dependency and package resolution, then try again. Underlying error: ${message}`);
-}).then(() => import("../io-BAr6VW3z.js")).then(({ runExtract }) => runExtract(projectRoot)).catch((err) => {
+}).then(() => import("../io-C3ADoUpo.js")).then(({ runExtract }) => runExtract(projectRoot)).catch((err) => {
 	console.error(err instanceof Error ? err.message : String(err));
 	process.exit(1);
 });

package/dist/{cors-DgPttZS3.cjs → cors-D7UGErr1.cjs}

@@ -1,5 +1,5 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
-const require_package = require("./package-pO0n3HOU.cjs");
+const require_package = require("./package-JU_QJfZ9.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
 //#region src/core/http.ts
@@ -118,17 +118,7 @@ function readProcessEnv(name) {
 		return;
 	}
 }
-/**
-* Base per-request recorder. Owns everything stack-agnostic: log-level setup, the
-* `tool.invoked` log, the single-record OTLP POST (awaited so it lands within the
-* request — serverless workers kill detached work once the response returns), and
-* never throwing into tool dispatch. Every invocation is reported (no sampling).
-* Subclasses supply only the `stack` label and how to read env on that runtime.
-*
-* One instance is created per request by the stack handler and shared across
-* every invocation in that request; it is never a process-wide singleton, since
-* on Cloudflare the env binding isn't readable at module-init scope.
-*/
+/** Shared recorder implementation. Callers await `emit` or register it with the runtime's request lifetime. */
 var BaseMetricRecorder = class {
 	config;
 	server;
@@ -284,6 +274,16 @@ var SupabaseMetricRecorder = class extends BaseMetricRecorder {
 };
 //#endregion
 //#region src/metrics/recorder.ts
+async function emitBeforeResponse(recorder, event, scheduleBackground) {
+	const task = recorder.emit(event);
+	if (scheduleBackground) try {
+		scheduleBackground(task);
+		return;
+	} catch (err) {
+		require_logger.log.warn("metrics.background_schedule_failed", require_logger.describeError(err));
+	}
+	await task;
+}
 /** Vend the recorder for a stack, in-flight per request. Returns a no-op when
 *  metrics are disabled (`metrics: false`); otherwise the stack-specific class, which
 *  logs `tool.invoked` for tool invocations even if the key or endpoint is unavailable. */
@@ -840,7 +840,7 @@ function assertRequiredScopes(auth, context) {
 }
 function createRequestAuthorizer(mcp, options = {}) {
 	const runtime = getOAuthRuntime(mcp, options);
-	return { async authorize(request, recorder) {
+	return { async authorize(request, recorder, scheduleBackground) {
 		if (runtime.kind === "unconfigured") return { ok: true };
 		const startedAt = nowMs();
 		const token = parseBearerToken(request);
@@ -850,13 +850,13 @@ function createRequestAuthorizer(mcp, options = {}) {
 				httpMethod,
 				outcome: "401"
 			});
-			await recorder?.emit({
+			if (recorder) await emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "auth_challenge",
 				httpMethod,
 				durationMs: nowMs() - startedAt
-			});
+			}, scheduleBackground);
 			return {
 				ok: false,
 				response: challengeResponse(runtime.auth, request, runtime.options, 401)
@@ -1029,6 +1029,12 @@ Object.defineProperty(exports, "createRequestAuthorizer", {
 		return createRequestAuthorizer;
 	}
 });
+Object.defineProperty(exports, "emitBeforeResponse", {
+	enumerable: true,
+	get: function() {
+		return emitBeforeResponse;
+	}
+});
 Object.defineProperty(exports, "evaluateCors", {
 	enumerable: true,
 	get: function() {

package/dist/{cors-Dtb_zOPJ.js → cors-struSqwR.js}

@@ -1,5 +1,5 @@
 import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as version } from "./package-BdEtuU4E.js";
+import { t as version } from "./package-BEdPHDOg.js";
 import "./metadata-path-CAkNcfyY.js";
 import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/core/http.ts
@@ -118,17 +118,7 @@ function readProcessEnv(name) {
 		return;
 	}
 }
-/**
-* Base per-request recorder. Owns everything stack-agnostic: log-level setup, the
-* `tool.invoked` log, the single-record OTLP POST (awaited so it lands within the
-* request — serverless workers kill detached work once the response returns), and
-* never throwing into tool dispatch. Every invocation is reported (no sampling).
-* Subclasses supply only the `stack` label and how to read env on that runtime.
-*
-* One instance is created per request by the stack handler and shared across
-* every invocation in that request; it is never a process-wide singleton, since
-* on Cloudflare the env binding isn't readable at module-init scope.
-*/
+/** Shared recorder implementation. Callers await `emit` or register it with the runtime's request lifetime. */
 var BaseMetricRecorder = class {
 	config;
 	server;
@@ -284,6 +274,16 @@ var SupabaseMetricRecorder = class extends BaseMetricRecorder {
 };
 //#endregion
 //#region src/metrics/recorder.ts
+async function emitBeforeResponse(recorder, event, scheduleBackground) {
+	const task = recorder.emit(event);
+	if (scheduleBackground) try {
+		scheduleBackground(task);
+		return;
+	} catch (err) {
+		log.warn("metrics.background_schedule_failed", describeError(err));
+	}
+	await task;
+}
 /** Vend the recorder for a stack, in-flight per request. Returns a no-op when
 *  metrics are disabled (`metrics: false`); otherwise the stack-specific class, which
 *  logs `tool.invoked` for tool invocations even if the key or endpoint is unavailable. */
@@ -840,7 +840,7 @@ function assertRequiredScopes(auth, context) {
 }
 function createRequestAuthorizer(mcp, options = {}) {
 	const runtime = getOAuthRuntime(mcp, options);
-	return { async authorize(request, recorder) {
+	return { async authorize(request, recorder, scheduleBackground) {
 		if (runtime.kind === "unconfigured") return { ok: true };
 		const startedAt = nowMs();
 		const token = parseBearerToken(request);
@@ -850,13 +850,13 @@ function createRequestAuthorizer(mcp, options = {}) {
 				httpMethod,
 				outcome: "401"
 			});
-			await recorder?.emit({
+			if (recorder) await emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "auth_challenge",
 				httpMethod,
 				durationMs: nowMs() - startedAt
-			});
+			}, scheduleBackground);
 			return {
 				ok: false,
 				response: challengeResponse(runtime.auth, request, runtime.options, 401)
@@ -999,4 +999,4 @@ function evaluateCors(request, allowedOrigins) {
 	};
 }
 //#endregion
-export { oauthConfigurationErrorResponse as a, createRecorderForRuntime as c, JSON_HEADERS as d, finalizeWireResponse as f, normalizeHttpMethod as i, createNoopRecorder as l, createRequestAuthorizer as n, assertResourcePathShape as o, methodNotAllowed as p, getOAuthRuntime as r, resolveProtectedResource as s, evaluateCors as t, nowMs as u };
+export { oauthConfigurationErrorResponse as a, createRecorderForRuntime as c, nowMs as d, JSON_HEADERS as f, normalizeHttpMethod as i, emitBeforeResponse as l, methodNotAllowed as m, createRequestAuthorizer as n, assertResourcePathShape as o, finalizeWireResponse as p, getOAuthRuntime as r, resolveProtectedResource as s, evaluateCors as t, createNoopRecorder as u };

package/dist/{io-BAr6VW3z.js → io-C3ADoUpo.js}

@@ -1,5 +1,5 @@
 import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { t as version } from "./package-BdEtuU4E.js";
+import { t as version } from "./package-BEdPHDOg.js";
 import { t as isFileMissing } from "./fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{io-CZzR7mTd.cjs → io-XzL-H5AK.cjs}

@@ -1,5 +1,5 @@
 const require_schema = require("./schema-D3vClxb7.cjs");
-const require_package = require("./package-pO0n3HOU.cjs");
+const require_package = require("./package-JU_QJfZ9.cjs");
 const require_fs_errors = require("./fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/{mcp-BoA7vYNm.js → mcp-BcqkkVKv.js}

@@ -1,7 +1,7 @@
 import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
 import { n as schemaFromDefinition, t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
 import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-Bwd1L0Rf.js";
-import { f as finalizeWireResponse, i as normalizeHttpMethod, l as createNoopRecorder, n as createRequestAuthorizer, t as evaluateCors, u as nowMs } from "./cors-Dtb_zOPJ.js";
+import { d as nowMs, i as normalizeHttpMethod, l as emitBeforeResponse, n as createRequestAuthorizer, p as finalizeWireResponse, t as evaluateCors, u as createNoopRecorder } from "./cors-struSqwR.js";
 import { getParseErrorMessage, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/core/content.ts
@@ -85,13 +85,13 @@ async function finalizeToolResult(tool, result) {
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");
-	const respond = async (request, recorder) => {
-		const authResult = await gate.authorizer.authorize(request, recorder);
+	const respond = async (request, recorder, scheduleBackground) => {
+		const authResult = await gate.authorizer.authorize(request, recorder, scheduleBackground);
 		if (!authResult.ok) return authResult.response;
 		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
 		return gate.handle(request, authResult, recorder);
 	};
-	return async (request, recorder = createNoopRecorder()) => {
+	return async (request, recorder = createNoopRecorder(), scheduleBackground) => {
 		const cors = evaluateCors(request, gate.allowedOrigins);
 		if (!cors.ok) {
 			const httpMethod = normalizeHttpMethod(request.method);
@@ -99,17 +99,17 @@ function createGatedHandler(gate) {
 				origin: request.headers.get("Origin"),
 				httpMethod
 			});
-			await recorder.emit({
+			await emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "origin_rejected",
 				httpMethod,
 				durationMs: 0
-			});
+			}, scheduleBackground);
 			return finalizeWireResponse(request, cors.response);
 		}
 		if (request.method === "OPTIONS") return cors.preflight(allow);
-		const final = finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder)));
+		const final = finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, scheduleBackground)));
 		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
 		return final;
 	};

package/dist/{mcp-B0a1JpSs.cjs → mcp-DS_Z5uVd.cjs}

@@ -1,7 +1,7 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
 const require_schema = require("./schema-D3vClxb7.cjs");
 const require_errors = require("./errors-Cr95rSkB.cjs");
-const require_cors = require("./cors-DgPttZS3.cjs");
+const require_cors = require("./cors-D7UGErr1.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_server = require("@modelcontextprotocol/server");
 //#region src/core/content.ts
@@ -85,13 +85,13 @@ async function finalizeToolResult(tool, result) {
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");
-	const respond = async (request, recorder) => {
-		const authResult = await gate.authorizer.authorize(request, recorder);
+	const respond = async (request, recorder, scheduleBackground) => {
+		const authResult = await gate.authorizer.authorize(request, recorder, scheduleBackground);
 		if (!authResult.ok) return authResult.response;
 		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
 		return gate.handle(request, authResult, recorder);
 	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
+	return async (request, recorder = require_cors.createNoopRecorder(), scheduleBackground) => {
 		const cors = require_cors.evaluateCors(request, gate.allowedOrigins);
 		if (!cors.ok) {
 			const httpMethod = require_cors.normalizeHttpMethod(request.method);
@@ -99,17 +99,17 @@ function createGatedHandler(gate) {
 				origin: request.headers.get("Origin"),
 				httpMethod
 			});
-			await recorder.emit({
+			await require_cors.emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "origin_rejected",
 				httpMethod,
 				durationMs: 0
-			});
+			}, scheduleBackground);
 			return require_cors.finalizeWireResponse(request, cors.response);
 		}
 		if (request.method === "OPTIONS") return cors.preflight(allow);
-		const final = require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder)));
+		const final = require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, scheduleBackground)));
 		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
 		return final;
 	};

package/dist/{package-BdEtuU4E.js → package-BEdPHDOg.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "2.0.2";
+var version = "2.0.3";
 //#endregion
 export { version as t };

package/dist/{package-pO0n3HOU.cjs → package-JU_QJfZ9.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.0.2";
+var version = "2.0.3";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-B0a1JpSs.cjs");
+const require_mcp = require("../../mcp-DS_Z5uVd.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,8 +1,8 @@
 import { d as McpDefinition } from "../../types-C6O4ciic.cjs";
-import { t as MetricsRecorder } from "../../base-6YZsnawW.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BobVCjtA.cjs";
+import { t as MetricsRecorder } from "../../base-DAkOPRay.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-oCEahmRv.cjs";
 //#region src/protocols/mcp/protocol.d.ts
-type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**
  * Build a Web-Standard request handler that serves the MCP protocol over
  * streamable HTTP. A fresh `McpServer` + transport is constructed per

package/dist/protocols/mcp/index.d.ts

@@ -1,8 +1,8 @@
 import { d as McpDefinition } from "../../types-C6O4ciic.js";
-import { t as MetricsRecorder } from "../../base-BKfPCoJ4.js";
-import { t as McpRuntimeOptions } from "../../authorize-Wg16_NdO.js";
+import { t as MetricsRecorder } from "../../base-DnCoJOZN.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-B5VMSzcN.js";
 //#region src/protocols/mcp/protocol.d.ts
-type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**
  * Build a Web-Standard request handler that serves the MCP protocol over
  * streamable HTTP. A fresh `McpServer` + transport is constructed per

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-BoA7vYNm.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BcqkkVKv.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_cors = require("../cors-DgPttZS3.cjs");
+const require_cors = require("../cors-D7UGErr1.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -52,7 +52,7 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 			return require_cors.oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
+	return async (request, recorder = require_cors.createNoopRecorder(), scheduleBackground) => {
 		const cors = require_cors.evaluateCors(request, mcp.allowedOrigins);
 		if (!cors.ok) {
 			const httpMethod = require_cors.normalizeHttpMethod(request.method);
@@ -61,13 +61,13 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				httpMethod,
 				route: "oauth-metadata"
 			});
-			await recorder.emit({
+			await require_cors.emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "origin_rejected",
 				httpMethod,
 				durationMs: 0
-			});
+			}, scheduleBackground);
 			return require_cors.finalizeWireResponse(request, cors.response);
 		}
 		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");

package/dist/protocols/oauth-metadata.d.cts

@@ -1,8 +1,8 @@
 import { d as McpDefinition } from "../types-C6O4ciic.cjs";
-import { t as MetricsRecorder } from "../base-6YZsnawW.cjs";
-import { t as McpRuntimeOptions } from "../authorize-BobVCjtA.cjs";
+import { t as MetricsRecorder } from "../base-DAkOPRay.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-oCEahmRv.cjs";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.d.ts

@@ -1,8 +1,8 @@
 import { d as McpDefinition } from "../types-C6O4ciic.js";
-import { t as MetricsRecorder } from "../base-BKfPCoJ4.js";
-import { t as McpRuntimeOptions } from "../authorize-Wg16_NdO.js";
+import { t as MetricsRecorder } from "../base-DnCoJOZN.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-B5VMSzcN.js";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { a as oauthConfigurationErrorResponse, d as JSON_HEADERS, f as finalizeWireResponse, i as normalizeHttpMethod, l as createNoopRecorder, p as methodNotAllowed, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors } from "../cors-Dtb_zOPJ.js";
+import { a as oauthConfigurationErrorResponse, f as JSON_HEADERS, i as normalizeHttpMethod, l as emitBeforeResponse, m as methodNotAllowed, p as finalizeWireResponse, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors, u as createNoopRecorder } from "../cors-struSqwR.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -51,7 +51,7 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 			return oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request, recorder = createNoopRecorder()) => {
+	return async (request, recorder = createNoopRecorder(), scheduleBackground) => {
 		const cors = evaluateCors(request, mcp.allowedOrigins);
 		if (!cors.ok) {
 			const httpMethod = normalizeHttpMethod(request.method);
@@ -60,13 +60,13 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				httpMethod,
 				route: "oauth-metadata"
 			});
-			await recorder.emit({
+			await emitBeforeResponse(recorder, {
 				tool: null,
 				method: "authorize",
 				outcome: "origin_rejected",
 				httpMethod,
 				durationMs: 0
-			});
+			}, scheduleBackground);
 			return finalizeWireResponse(request, cors.response);
 		}
 		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");

package/dist/stacks/supabase/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_cors = require("../../cors-DgPttZS3.cjs");
+const require_cors = require("../../cors-D7UGErr1.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-B0a1JpSs.cjs");
+const require_mcp = require("../../mcp-DS_Z5uVd.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
 const require_forwarded = require("../../forwarded-B37IdmMX.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
@@ -16,6 +16,12 @@ function deriveResourcePath(options) {
 function isMetadataPath(pathname) {
 	return (pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname).endsWith(require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
 }
+function getScheduleBackground() {
+	const edgeRuntime = globalThis.EdgeRuntime;
+	const waitUntil = edgeRuntime?.waitUntil;
+	if (typeof waitUntil !== "function") return void 0;
+	return (task) => waitUntil.call(edgeRuntime, task);
+}
 /**
 * Build a single Web-Standard handler that serves the full MCP surface from
 * one Supabase Edge Function. The returned handler dispatches by URL suffix:
@@ -44,8 +50,9 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
-		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }));
-		return mcpHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }));
+		const scheduleBackground = getScheduleBackground();
+		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }), scheduleBackground);
+		return mcpHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }), scheduleBackground);
 	};
 }
 //#endregion

package/dist/stacks/supabase/index.js

@@ -1,7 +1,7 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-Dtb_zOPJ.js";
+import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-struSqwR.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-BoA7vYNm.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BcqkkVKv.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BBXvFeh6.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
@@ -15,6 +15,12 @@ function deriveResourcePath(options) {
 function isMetadataPath(pathname) {
 	return (pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname).endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
 }
+function getScheduleBackground() {
+	const edgeRuntime = globalThis.EdgeRuntime;
+	const waitUntil = edgeRuntime?.waitUntil;
+	if (typeof waitUntil !== "function") return void 0;
+	return (task) => waitUntil.call(edgeRuntime, task);
+}
 /**
 * Build a single Web-Standard handler that serves the full MCP surface from
 * one Supabase Edge Function. The returned handler dispatches by URL suffix:
@@ -43,8 +49,9 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = applyForwardedOrigin(request, runtimeOptions);
-		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }));
-		return mcpHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }));
+		const scheduleBackground = getScheduleBackground();
+		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }), scheduleBackground);
+		return mcpHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }), scheduleBackground);
 	};
 }
 //#endregion

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-pO0n3HOU.cjs");
+const require_package = require("../../package-JU_QJfZ9.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-BdEtuU4E.js";
+import { t as version } from "../../package-BEdPHDOg.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,17 +1,22 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-DgPttZS3.cjs");
-const require_mcp = require("../../mcp-B0a1JpSs.cjs");
+const require_cors = require("../../cors-D7UGErr1.cjs");
+const require_mcp = require("../../mcp-DS_Z5uVd.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
 const require_forwarded = require("../../forwarded-B37IdmMX.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
+function getScheduleBackground(request) {
+	const waitUntil = request.waitUntil;
+	if (typeof waitUntil !== "function") return void 0;
+	return (task) => waitUntil.call(request, task);
+}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }), getScheduleBackground(request));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -19,7 +24,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }), getScheduleBackground(request));
 }
 //#endregion
 exports.createTanStackMcpHandler = createTanStackMcpHandler;

package/dist/stacks/tanstack/index.d.cts

@@ -1,8 +1,11 @@
 import { d as McpDefinition } from "../../types-C6O4ciic.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BobVCjtA.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-oCEahmRv.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
+interface TanStackRequest extends Request {
+  waitUntil?: ScheduleBackground;
+}
 interface TanStackRouteCtx {
-  request: Request;
+  request: TanStackRequest;
 }
 type TanStackMcpHandler = (ctx: TanStackRouteCtx) => Promise<Response>;
 type TanStackOAuthProtectedResourceMetadataHandler = (ctx: TanStackRouteCtx) => Promise<Response>;

package/dist/stacks/tanstack/index.d.ts

@@ -1,8 +1,11 @@
 import { d as McpDefinition } from "../../types-C6O4ciic.js";
-import { t as McpRuntimeOptions } from "../../authorize-Wg16_NdO.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-B5VMSzcN.js";
 //#region src/stacks/tanstack/handlers.d.ts
+interface TanStackRequest extends Request {
+  waitUntil?: ScheduleBackground;
+}
 interface TanStackRouteCtx {
-  request: Request;
+  request: TanStackRequest;
 }
 type TanStackMcpHandler = (ctx: TanStackRouteCtx) => Promise<Response>;
 type TanStackOAuthProtectedResourceMetadataHandler = (ctx: TanStackRouteCtx) => Promise<Response>;

package/dist/stacks/tanstack/index.js

@@ -1,16 +1,21 @@
-import { c as createRecorderForRuntime } from "../../cors-Dtb_zOPJ.js";
-import { t as createMcpProtocolHandler } from "../../mcp-BoA7vYNm.js";
+import { c as createRecorderForRuntime } from "../../cors-struSqwR.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BcqkkVKv.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BBXvFeh6.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
+function getScheduleBackground(request) {
+	const waitUntil = request.waitUntil;
+	if (typeof waitUntil !== "function") return void 0;
+	return (task) => waitUntil.call(request, task);
+}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }), getScheduleBackground(request));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -18,7 +23,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }), getScheduleBackground(request));
 }
 //#endregion
 export { createTanStackMcpHandler, createTanStackOAuthProtectedResourceMetadataHandler };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "engines": {
     "node": ">=20"
   },