@lovable.dev/mcp-js 2.0.4-rc.0 → 2.1.0-rc.0

package/dist/index.js

@@ -1,149 +1,5 @@
-import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { i as ToolContext, t as ToolError } from "./errors-Bwd1L0Rf.js";
-//#region src/core/define.ts
-function assertUniqueNames(mcp) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const tool of mcp.tools) {
-		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-		seen.add(tool.name);
-	}
-}
-function assertNonEmptyString(label, value) {
-	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
-}
-function assertHttpsUrlField(name, value) {
-	assertNonEmptyString(`auth.${name}`, value);
-	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
-}
-function assertScope(scope) {
-	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
-}
-function assertJwtAlgorithm(algorithm) {
-	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
-}
-const MAX_CLOCK_TOLERANCE_SECONDS = 300;
-function assertClockToleranceSeconds(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
-}
-function assertOAuthConfig(auth) {
-	if (auth.type !== "oauth") {
-		const authType = String(auth.type);
-		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-	}
-	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-	assertHttpsUrlField("issuer", auth.issuer);
-	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
-	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
-	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
-	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
-	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
-	if (auth.acceptedAudiences !== void 0) {
-		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-		for (const audience of auth.acceptedAudiences) {
-			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-			assertNonEmptyString("auth.acceptedAudiences", audience);
-			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-		}
-	}
-	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-	if (auth.requiredScopes !== void 0) {
-		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-		for (const scope of auth.requiredScopes) assertScope(scope);
-	}
-	if (auth.algorithms !== void 0) {
-		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
-	}
-	if (auth.accessTokenTyp !== void 0) {
-		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-		for (const typ of auth.accessTokenTyp) {
-			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-			assertNonEmptyString("auth.accessTokenTyp", typ);
-		}
-	}
-	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
-	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
-}
-function freezeAuth(auth) {
-	if (!auth) return;
-	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
-	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
-	if (auth.algorithms) Object.freeze(auth.algorithms);
-	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
-	Object.freeze(auth);
-}
-function assertAllowedOrigins(allowedOrigins) {
-	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
-	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
-	for (const origin of allowedOrigins) {
-		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch {
-			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
-	}
-}
-function assertToolSchemas(mcp) {
-	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
-		"inputSchema",
-		tool.inputSchema,
-		"input"
-	], [
-		"outputSchema",
-		tool.outputSchema,
-		"output"
-	]]) {
-		if (!definition) continue;
-		try {
-			jsonSchemaFromDefinition(definition, strategy);
-		} catch (error) {
-			const detail = error instanceof Error ? `: ${error.message}` : "";
-			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
-		}
-	}
-}
-/**
-* Declare a single MCP tool. Import the result into your MCP definition's
-* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
-*
-* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
-* full `z.object(...)` — the MCP SDK builds the object wrapper internally
-* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
-*/
-function defineTool(def) {
-	return def;
-}
-/**
-* Declare the MCP server. `export default` the result from your MCP
-* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
-* emit the framework-specific route(s) at build time.
-*/
-function defineMcp(def) {
-	assertNonEmptyString("name", def.name);
-	assertNonEmptyString("title", def.title);
-	assertNonEmptyString("version", def.version);
-	assertUniqueNames(def);
-	if (def.auth) assertOAuthConfig(def.auth);
-	assertAllowedOrigins(def.allowedOrigins);
-	assertToolSchemas(def);
-	resolveMetricsConfig(def.metrics);
-	freezeAuth(def.auth);
-	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
-	Object.freeze(def.tools);
-	for (const tool of def.tools) Object.freeze(tool);
-	return def;
-}
-//#endregion
+import { a as setLogLevel } from "./logger-Ctv5xUSD.js";
+import { a as ToolContext, i as AuthContext, o as defineMcp, s as defineTool, t as ToolError } from "./errors-DTvfh8lb.js";
 //#region src/auth/config.ts
 function frozenArray(value) {
 	return value === void 0 ? void 0 : Object.freeze([...value]);
@@ -178,4 +34,4 @@ function issuer(options) {
 const oauth = Object.freeze({ issuer });
 const auth = Object.freeze({ oauth });
 //#endregion
-export { ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };
+export { AuthContext, ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };

package/dist/{io-D2PGAhYM.d.cts → io-9jGNgPfl.d.cts}

@@ -1,4 +1,4 @@
-import "./types-C6O4ciic.cjs";
+import "./types-S6J_QTXw.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-CanMDPsW.js → io-BEoJ_gb5.js}

@@ -1,5 +1,5 @@
 import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { t as version } from "./package-ZzwBAUf7.js";
+import { t as version } from "./package-BAYb-3dX.js";
 import { t as isFileMissing } from "./fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
@@ -23,7 +23,8 @@ function buildMcpListing(mcp) {
 			description: tool.description,
 			annotations: tool.annotations,
 			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output"),
+			...tool.enabled ? { conditional: true } : {}
 		}))
 	};
 }

package/dist/{io-BD2TuqtG.d.ts → io-BLZ8jYW6.d.ts}

@@ -1,4 +1,4 @@
-import "./types-C6O4ciic.js";
+import "./types-S6J_QTXw.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-B5Mit9aD.cjs → io-Cz81GsrM.cjs}

@@ -1,5 +1,5 @@
 const require_schema = require("./schema-D3vClxb7.cjs");
-const require_package = require("./package-ClsLrfmB.cjs");
+const require_package = require("./package-DlouusYQ.cjs");
 const require_fs_errors = require("./fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -23,7 +23,8 @@ function buildMcpListing(mcp) {
 			description: tool.description,
 			annotations: tool.annotations,
 			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output"),
+			...tool.enabled ? { conditional: true } : {}
 		}))
 	};
 }

package/dist/{mcp-TJZHxHwb.js → mcp-CuHyVOZK.js}

@@ -1,7 +1,7 @@
 import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
 import { n as schemaFromDefinition, t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-Bwd1L0Rf.js";
-import { d as nowMs, i as normalizeHttpMethod, l as emitBeforeResponse, n as createRequestAuthorizer, p as finalizeWireResponse, t as evaluateCors, u as createNoopRecorder } from "./cors-K-QaLAV0.js";
+import { a as ToolContext, c as toolRequiresAppContext, i as AuthContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DTvfh8lb.js";
+import { d as nowMs, i as normalizeHttpMethod, l as emitBeforeResponse, n as createRequestAuthorizer, p as finalizeWireResponse, t as evaluateCors, u as createNoopRecorder } from "./cors-D4BjUpgU.js";
 import { getParseErrorMessage, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/core/content.ts
@@ -117,6 +117,52 @@ function createGatedHandler(gate) {
 //#endregion
 //#region src/protocols/mcp/protocol.ts
 const MODERN_PROTOCOL_VERSION = "2026-07-28";
+const HOUR_MS = 3600 * 1e3;
+const NO_OPERATIONS = {
+	listTools: false,
+	calledTools: /* @__PURE__ */ new Set()
+};
+function collectRequestOperations(value, calledTools) {
+	if (Array.isArray(value)) {
+		let listTools = false;
+		for (const item of value) listTools = collectRequestOperations(item, calledTools) || listTools;
+		return listTools;
+	}
+	if (!isPlainObject(value)) return false;
+	if (value.method === "tools/list") return true;
+	if (value.method === "tools/call" && isPlainObject(value.params) && typeof value.params.name === "string") calledTools.add(value.params.name);
+	return false;
+}
+/** Marks a failure in app-owned `createAppContext` or `enabled` code so telemetry
+* can attribute it to the author rather than to the transport. */
+var AppContextError = class extends Error {
+	constructor(cause) {
+		super("app context evaluation failed", { cause });
+		this.name = "AppContextError";
+	}
+};
+async function withAppContextError(run) {
+	try {
+		return await run();
+	} catch (cause) {
+		throw new AppContextError(cause);
+	}
+}
+async function classifyRequest(request) {
+	try {
+		const parsedBody = await request.clone().json();
+		const calledTools = /* @__PURE__ */ new Set();
+		return {
+			operations: {
+				listTools: collectRequestOperations(parsedBody, calledTools),
+				calledTools
+			},
+			parsedBody
+		};
+	} catch {
+		return { operations: NO_OPERATIONS };
+	}
+}
 function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
@@ -191,12 +237,12 @@ function toolRequestContext(sdkCtx, protocol) {
 		sendProgress
 	};
 }
-async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
+async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appContext) {
 	const endUserId = auth?.principal.sub;
 	const start = nowMs();
 	let result;
 	try {
-		result = await tool.handler(args, new ToolContext(auth, toolRequestContext(sdkCtx, protocol)));
+		result = await tool.handler(args, new ToolContext(auth, toolRequestContext(sdkCtx, protocol), appContext));
 	} catch (err) {
 		const callerMessage = resolveToolErrorMessage(err);
 		if (callerMessage === void 0) {
@@ -254,10 +300,10 @@ async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
 	});
 	return result;
 }
-function adaptToolCallback(tool, auth, recorder, protocol) {
+function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
 	return async (first, second) => {
 		const sdkCtx = tool.inputSchema ? second : first;
-		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx);
+		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx, appContext);
 		return {
 			content: result.content ?? [],
 			structuredContent: result.structuredContent,
@@ -265,23 +311,52 @@ function adaptToolCallback(tool, auth, recorder, protocol) {
 		};
 	};
 }
-function buildServer(mcp, auth, recorder, era) {
+async function buildServer(mcp, auth, recorder, era, signal, operations) {
+	const calledTools = operations ? mcp.tools.filter((tool) => operations.calledTools.has(tool.name)) : mcp.tools;
+	const selectedTools = !operations || operations.listTools ? mcp.tools : calledTools;
+	const hasConditionalTools = mcp.tools.some((tool) => tool.enabled !== void 0);
+	const needsAppContext = operations?.listTools === true && hasConditionalTools || calledTools.some((tool) => tool.enabled !== void 0 || toolRequiresAppContext(tool));
+	const { createAppContext } = mcp;
+	const appContext = needsAppContext && createAppContext ? await withAppContextError(() => createAppContext({
+		auth: new AuthContext(auth),
+		signal
+	})) : void 0;
+	const visibilityContext = Object.freeze({ appContext });
+	const cacheHint = hasConditionalTools ? {
+		cacheScope: "private",
+		ttlMs: 12 * HOUR_MS
+	} : {
+		cacheScope: "public",
+		ttlMs: 24 * HOUR_MS
+	};
 	const server = new McpServer({
 		name: mcp.name,
 		version: mcp.version,
 		title: mcp.title
 	}, {
 		instructions: mcp.instructions,
-		capabilities: { tools: { listChanged: false } }
+		capabilities: { tools: { listChanged: false } },
+		cacheHints: {
+			"tools/list": cacheHint,
+			"server/discover": cacheHint
+		}
 	});
-	for (const tool of mcp.tools) {
+	for (const tool of selectedTools) {
+		if (tool.enabled) {
+			const { enabled } = tool;
+			if (!await withAppContextError(() => {
+				const value = enabled(visibilityContext);
+				if (typeof value !== "boolean") throw new TypeError(`@lovable.dev/mcp-js: tool "${tool.name}" enabled must return a boolean synchronously`);
+				return value;
+			})) continue;
+		}
 		const config = {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
 			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
 		};
-		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION);
+		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION, appContext);
 		if (tool.inputSchema) server.registerTool(tool.name, {
 			...config,
 			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
@@ -302,26 +377,28 @@ function createMcpProtocolHandler(mcp, options = {}) {
 	const handle = async (request, authResult, recorder) => {
 		let protocolError;
 		const reportTransportError = async (error) => {
+			const appContextFailure = error instanceof AppContextError;
 			await recorder.emit({
 				tool: null,
 				method: "transport",
-				outcome: "transport_error",
+				outcome: appContextFailure ? "app_context_error" : "transport_error",
 				durationMs: 0,
 				endUserId: authResult.auth?.principal.sub
 			});
-			log.error("mcp.transport_error", {
-				...error === void 0 ? {} : describeError(error),
+			log.error(appContextFailure ? "mcp.app_context_error" : "mcp.transport_error", {
+				...error === void 0 ? {} : describeError(appContextFailure ? error.cause : error),
 				outcome: "500 internal error"
 			});
 		};
 		try {
-			const response = await createMcpHandler(({ era }) => buildServer(mcp, authResult.auth, recorder, era), {
+			const classified = mcp.createAppContext ? await classifyRequest(request) : void 0;
+			const response = await createMcpHandler(({ era, requestInfo }) => buildServer(mcp, authResult.auth, recorder, era, requestInfo?.signal ?? request.signal, classified?.operations), {
 				legacy: "stateless",
 				maxSubscriptions: 0,
 				onerror: (error) => {
 					protocolError = error;
 				}
-			}).fetch(request);
+			}).fetch(request, classified?.parsedBody === void 0 ? void 0 : { parsedBody: classified.parsedBody });
 			if (response.status >= 500) await reportTransportError(protocolError);
 			return response;
 		} catch (err) {

package/dist/{mcp-CY55D6Km.cjs → mcp-Q_rjpR99.cjs}

@@ -1,7 +1,7 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
 const require_schema = require("./schema-D3vClxb7.cjs");
-const require_errors = require("./errors-Cr95rSkB.cjs");
-const require_cors = require("./cors-DheH0sX2.cjs");
+const require_errors = require("./errors-CdrGi5aP.cjs");
+const require_cors = require("./cors-0ZCwmwyK.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_server = require("@modelcontextprotocol/server");
 //#region src/core/content.ts
@@ -117,6 +117,52 @@ function createGatedHandler(gate) {
 //#endregion
 //#region src/protocols/mcp/protocol.ts
 const MODERN_PROTOCOL_VERSION = "2026-07-28";
+const HOUR_MS = 3600 * 1e3;
+const NO_OPERATIONS = {
+	listTools: false,
+	calledTools: /* @__PURE__ */ new Set()
+};
+function collectRequestOperations(value, calledTools) {
+	if (Array.isArray(value)) {
+		let listTools = false;
+		for (const item of value) listTools = collectRequestOperations(item, calledTools) || listTools;
+		return listTools;
+	}
+	if (!isPlainObject(value)) return false;
+	if (value.method === "tools/list") return true;
+	if (value.method === "tools/call" && isPlainObject(value.params) && typeof value.params.name === "string") calledTools.add(value.params.name);
+	return false;
+}
+/** Marks a failure in app-owned `createAppContext` or `enabled` code so telemetry
+* can attribute it to the author rather than to the transport. */
+var AppContextError = class extends Error {
+	constructor(cause) {
+		super("app context evaluation failed", { cause });
+		this.name = "AppContextError";
+	}
+};
+async function withAppContextError(run) {
+	try {
+		return await run();
+	} catch (cause) {
+		throw new AppContextError(cause);
+	}
+}
+async function classifyRequest(request) {
+	try {
+		const parsedBody = await request.clone().json();
+		const calledTools = /* @__PURE__ */ new Set();
+		return {
+			operations: {
+				listTools: collectRequestOperations(parsedBody, calledTools),
+				calledTools
+			},
+			parsedBody
+		};
+	} catch {
+		return { operations: NO_OPERATIONS };
+	}
+}
 function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
@@ -191,12 +237,12 @@ function toolRequestContext(sdkCtx, protocol) {
 		sendProgress
 	};
 }
-async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
+async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appContext) {
 	const endUserId = auth?.principal.sub;
 	const start = require_cors.nowMs();
 	let result;
 	try {
-		result = await tool.handler(args, new require_errors.ToolContext(auth, toolRequestContext(sdkCtx, protocol)));
+		result = await tool.handler(args, new require_errors.ToolContext(auth, toolRequestContext(sdkCtx, protocol), appContext));
 	} catch (err) {
 		const callerMessage = require_errors.resolveToolErrorMessage(err);
 		if (callerMessage === void 0) {
@@ -254,10 +300,10 @@ async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
 	});
 	return result;
 }
-function adaptToolCallback(tool, auth, recorder, protocol) {
+function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
 	return async (first, second) => {
 		const sdkCtx = tool.inputSchema ? second : first;
-		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx);
+		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx, appContext);
 		return {
 			content: result.content ?? [],
 			structuredContent: result.structuredContent,
@@ -265,23 +311,52 @@ function adaptToolCallback(tool, auth, recorder, protocol) {
 		};
 	};
 }
-function buildServer(mcp, auth, recorder, era) {
+async function buildServer(mcp, auth, recorder, era, signal, operations) {
+	const calledTools = operations ? mcp.tools.filter((tool) => operations.calledTools.has(tool.name)) : mcp.tools;
+	const selectedTools = !operations || operations.listTools ? mcp.tools : calledTools;
+	const hasConditionalTools = mcp.tools.some((tool) => tool.enabled !== void 0);
+	const needsAppContext = operations?.listTools === true && hasConditionalTools || calledTools.some((tool) => tool.enabled !== void 0 || require_errors.toolRequiresAppContext(tool));
+	const { createAppContext } = mcp;
+	const appContext = needsAppContext && createAppContext ? await withAppContextError(() => createAppContext({
+		auth: new require_errors.AuthContext(auth),
+		signal
+	})) : void 0;
+	const visibilityContext = Object.freeze({ appContext });
+	const cacheHint = hasConditionalTools ? {
+		cacheScope: "private",
+		ttlMs: 12 * HOUR_MS
+	} : {
+		cacheScope: "public",
+		ttlMs: 24 * HOUR_MS
+	};
 	const server = new _modelcontextprotocol_server.McpServer({
 		name: mcp.name,
 		version: mcp.version,
 		title: mcp.title
 	}, {
 		instructions: mcp.instructions,
-		capabilities: { tools: { listChanged: false } }
+		capabilities: { tools: { listChanged: false } },
+		cacheHints: {
+			"tools/list": cacheHint,
+			"server/discover": cacheHint
+		}
 	});
-	for (const tool of mcp.tools) {
+	for (const tool of selectedTools) {
+		if (tool.enabled) {
+			const { enabled } = tool;
+			if (!await withAppContextError(() => {
+				const value = enabled(visibilityContext);
+				if (typeof value !== "boolean") throw new TypeError(`@lovable.dev/mcp-js: tool "${tool.name}" enabled must return a boolean synchronously`);
+				return value;
+			})) continue;
+		}
 		const config = {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
 			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
 		};
-		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION);
+		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION, appContext);
 		if (tool.inputSchema) server.registerTool(tool.name, {
 			...config,
 			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
@@ -302,26 +377,28 @@ function createMcpProtocolHandler(mcp, options = {}) {
 	const handle = async (request, authResult, recorder) => {
 		let protocolError;
 		const reportTransportError = async (error) => {
+			const appContextFailure = error instanceof AppContextError;
 			await recorder.emit({
 				tool: null,
 				method: "transport",
-				outcome: "transport_error",
+				outcome: appContextFailure ? "app_context_error" : "transport_error",
 				durationMs: 0,
 				endUserId: authResult.auth?.principal.sub
 			});
-			require_logger.log.error("mcp.transport_error", {
-				...error === void 0 ? {} : require_logger.describeError(error),
+			require_logger.log.error(appContextFailure ? "mcp.app_context_error" : "mcp.transport_error", {
+				...error === void 0 ? {} : require_logger.describeError(appContextFailure ? error.cause : error),
 				outcome: "500 internal error"
 			});
 		};
 		try {
-			const response = await (0, _modelcontextprotocol_server.createMcpHandler)(({ era }) => buildServer(mcp, authResult.auth, recorder, era), {
+			const classified = mcp.createAppContext ? await classifyRequest(request) : void 0;
+			const response = await (0, _modelcontextprotocol_server.createMcpHandler)(({ era, requestInfo }) => buildServer(mcp, authResult.auth, recorder, era, requestInfo?.signal ?? request.signal, classified?.operations), {
 				legacy: "stateless",
 				maxSubscriptions: 0,
 				onerror: (error) => {
 					protocolError = error;
 				}
-			}).fetch(request);
+			}).fetch(request, classified?.parsedBody === void 0 ? void 0 : { parsedBody: classified.parsedBody });
 			if (response.status >= 500) await reportTransportError(protocolError);
 			return response;
 		} catch (err) {

package/dist/{package-ZzwBAUf7.js → package-BAYb-3dX.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "2.0.4-rc.0";
+var version = "2.1.0-rc.0";
 //#endregion
 export { version as t };

package/dist/{package-ClsLrfmB.cjs → package-DlouusYQ.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.0.4-rc.0";
+var version = "2.1.0-rc.0";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-CY55D6Km.cjs");
+const require_mcp = require("../../mcp-Q_rjpR99.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.cjs";
-import { t as MetricsRecorder } from "../../base-DAkOPRay.cjs";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-oCEahmRv.cjs";
+import { p as McpDefinition } from "../../types-S6J_QTXw.cjs";
+import { t as MetricsRecorder } from "../../base-4G2k3bMl.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-BC4TM__8.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.js";
-import { t as MetricsRecorder } from "../../base-DnCoJOZN.js";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-B5VMSzcN.js";
+import { p as McpDefinition } from "../../types-S6J_QTXw.js";
+import { t as MetricsRecorder } from "../../base-BnlJz6TE.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-DEsM-zTN.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-TJZHxHwb.js";
+import { t as createMcpProtocolHandler } from "../../mcp-CuHyVOZK.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_cors = require("../cors-DheH0sX2.cjs");
+const require_cors = require("../cors-0ZCwmwyK.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/oauth-metadata.d.cts

@@ -1,6 +1,6 @@
-import { d as McpDefinition } from "../types-C6O4ciic.cjs";
-import { t as MetricsRecorder } from "../base-DAkOPRay.cjs";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-oCEahmRv.cjs";
+import { p as McpDefinition } from "../types-S6J_QTXw.cjs";
+import { t as MetricsRecorder } from "../base-4G2k3bMl.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-BC4TM__8.cjs";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.ts

@@ -1,6 +1,6 @@
-import { d as McpDefinition } from "../types-C6O4ciic.js";
-import { t as MetricsRecorder } from "../base-DnCoJOZN.js";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-B5VMSzcN.js";
+import { p as McpDefinition } from "../types-S6J_QTXw.js";
+import { t as MetricsRecorder } from "../base-BnlJz6TE.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-DEsM-zTN.js";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { a as oauthConfigurationErrorResponse, f as JSON_HEADERS, i as normalizeHttpMethod, l as emitBeforeResponse, m as methodNotAllowed, p as finalizeWireResponse, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors, u as createNoopRecorder } from "../cors-K-QaLAV0.js";
+import { a as oauthConfigurationErrorResponse, f as JSON_HEADERS, i as normalizeHttpMethod, l as emitBeforeResponse, m as methodNotAllowed, p as finalizeWireResponse, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors, u as createNoopRecorder } from "../cors-D4BjUpgU.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {