@lovable.dev/mcp-js 2.0.4-rc.0 → 2.1.0-rc.0

package/dist/stacks/supabase/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_cors = require("../../cors-DheH0sX2.cjs");
+const require_cors = require("../../cors-0ZCwmwyK.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CY55D6Km.cjs");
+const require_mcp = require("../../mcp-Q_rjpR99.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
 const require_forwarded = require("../../forwarded-B37IdmMX.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/index.d.cts

@@ -1,4 +1,4 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.cjs";
+import { p as McpDefinition } from "../../types-S6J_QTXw.cjs";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.d.ts

@@ -1,4 +1,4 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.js";
+import { p as McpDefinition } from "../../types-S6J_QTXw.js";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.js

@@ -1,7 +1,7 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-K-QaLAV0.js";
+import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-D4BjUpgU.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-TJZHxHwb.js";
+import { t as createMcpProtocolHandler } from "../../mcp-CuHyVOZK.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BBXvFeh6.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-ClsLrfmB.cjs");
+const require_package = require("../../package-DlouusYQ.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-D2PGAhYM.cjs";
+import { t as McpPluginApi } from "../../io-9jGNgPfl.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-BD2TuqtG.js";
+import { t as McpPluginApi } from "../../io-BLZ8jYW6.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-ZzwBAUf7.js";
+import { t as version } from "../../package-BAYb-3dX.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-DheH0sX2.cjs");
-const require_mcp = require("../../mcp-CY55D6Km.cjs");
+const require_cors = require("../../cors-0ZCwmwyK.cjs");
+const require_mcp = require("../../mcp-Q_rjpR99.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
 const require_forwarded = require("../../forwarded-B37IdmMX.cjs");
 //#region src/stacks/tanstack/handlers.ts

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.cjs";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-oCEahmRv.cjs";
+import { p as McpDefinition } from "../../types-S6J_QTXw.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-BC4TM__8.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRequest extends Request {
   waitUntil?: ScheduleBackground;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { d as McpDefinition } from "../../types-C6O4ciic.js";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-B5VMSzcN.js";
+import { p as McpDefinition } from "../../types-S6J_QTXw.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-DEsM-zTN.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRequest extends Request {
   waitUntil?: ScheduleBackground;

package/dist/stacks/tanstack/index.js

@@ -1,5 +1,5 @@
-import { c as createRecorderForRuntime } from "../../cors-K-QaLAV0.js";
-import { t as createMcpProtocolHandler } from "../../mcp-TJZHxHwb.js";
+import { c as createRecorderForRuntime } from "../../cors-D4BjUpgU.js";
+import { t as createMcpProtocolHandler } from "../../mcp-CuHyVOZK.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BBXvFeh6.js";
 //#region src/stacks/tanstack/handlers.ts

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-D2PGAhYM.cjs";
+import { t as McpPluginApi } from "../../io-9jGNgPfl.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-BD2TuqtG.js";
+import { t as McpPluginApi } from "../../io-BLZ8jYW6.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/{types-C6O4ciic.d.ts → types-S6J_QTXw.d.cts}

@@ -116,18 +116,11 @@ interface ToolRequestContext {
   client?: McpClientInfo;
   sendProgress?: (update: ProgressUpdate) => Promise<void>;
 }
-/** The per-request context passed to every tool handler as its second argument. The
- * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
-declare class ToolContext {
+/** Verified caller identity exposed to the app-context factory.
+ * `getToken()` is the sole bearer escape hatch. */
+declare class AuthContext {
   #private;
-  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
-  /** Aborts when the client cancels the request or disconnects. */
-  get signal(): AbortSignal;
-  /** What the client declared about itself on this request. Unverified input. */
-  get client(): McpClientInfo;
-  /** Send a progress notification for this call. A no-op when the client
-   * didn't request progress (no `progressToken` on the request). */
-  progress(update: ProgressUpdate): Promise<void>;
+  constructor(auth: McpAuthContext | undefined);
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -148,6 +141,20 @@ declare class ToolContext {
    */
   getClaims(): JwtClaims | undefined;
 }
+/** The per-request context passed to every tool handler as its second argument. */
+declare class ToolContext<TAppContext = undefined> extends AuthContext {
+  #private;
+  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext, appContext?: TAppContext);
+  /** App-defined context created for this tool call. */
+  get appContext(): TAppContext;
+  /** Aborts when the client cancels the request or disconnects. */
+  get signal(): AbortSignal;
+  /** What the client declared about itself on this request. Unverified input. */
+  get client(): McpClientInfo;
+  /** Send a progress notification for this call. A no-op when the client
+   * didn't request progress (no `progressToken` on the request). */
+  progress(update: ProgressUpdate): Promise<void>;
+}
 //#endregion
 //#region src/metrics/config.d.ts
 /**
@@ -302,7 +309,16 @@ interface ToolHandlerResult {
   structuredContent?: JsonValueInput;
   isError?: boolean;
 }
-interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
+/** Inputs available while creating app context for one MCP request. */
+interface CreateAppContextInput {
+  readonly auth: AuthContext;
+  readonly signal: AbortSignal;
+}
+/** The restricted surface used to decide whether a tool exists. */
+interface ToolVisibilityContext<TAppContext> {
+  readonly appContext: TAppContext;
+}
+interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined, TAppContext = undefined> {
   readonly name: string;
   /** Human-readable display name shown to the user in MCP clients. Required. */
   readonly title: string;
@@ -311,22 +327,44 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly inputSchema?: TInput;
   readonly outputSchema?: TOutput;
   readonly annotations?: ToolAnnotations;
-  readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
+  /** Synchronously decide whether this tool exists for the current caller. */
+  readonly enabled?: (ctx: ToolVisibilityContext<TAppContext>) => boolean;
+  readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult>;
+}
+interface AppContextToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined, TAppContext = unknown> extends ToolDefinition<TInput, TOutput, TAppContext> {
+  readonly requiresAppContext: true;
 }
 /** Type-erased element of `McpDefinition.tools`; per-tool generic typing
  * happens at the `defineTool` call site. */
-interface AnyToolDefinition {
+interface AnyToolDefinition<TAppContext = never> {
   readonly name: string;
   readonly title: string;
   readonly description: string;
   readonly inputSchema?: ZodRawShape$1 | undefined;
   readonly outputSchema?: ZodOutputSchema | undefined;
   readonly annotations?: ToolAnnotations;
-  readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
+  readonly enabled?: (ctx: ToolVisibilityContext<TAppContext>) => boolean;
+  readonly handler: (args: any, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
+type StaticToolDefinition = Omit<AnyToolDefinition<undefined>, "enabled"> & {
+  readonly enabled?: never;
+};
+type AnyAppContextToolDefinition<TAppContext = unknown> = AnyToolDefinition<TAppContext> & {
+  readonly requiresAppContext: true;
+};
+type CreateAppContext<TAppContext> = (input: CreateAppContextInput) => TAppContext | Promise<TAppContext>;
+/** Concrete app context requires a factory. `undefined`, `unknown`, and `never`
+ * remain optional because the SDK uses them for static or type-erased tools. */
+type AppContextConfiguration<TAppContext> = [TAppContext] extends [undefined] ? {
+  readonly createAppContext?: CreateAppContext<TAppContext>;
+} : unknown extends TAppContext ? {
+  readonly createAppContext?: CreateAppContext<TAppContext>;
+} : {
+  readonly createAppContext: CreateAppContext<TAppContext>;
+};
 /** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
  * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
-interface McpDefinitionInput {
+type McpDefinitionInput<TAppContext = undefined> = {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
   readonly title: string;
@@ -341,17 +379,19 @@ interface McpDefinitionInput {
    * empty string to opt out.
    */
   readonly instructions: string;
-  readonly tools: readonly AnyToolDefinition[];
+  readonly tools: readonly (AnyAppContextToolDefinition<TAppContext> | StaticToolDefinition)[];
   /**
    * Usage-metrics emission (runtime telemetry), on by default. `false` opts out;
    * `{ endpoint, headers }` sends to your own OTLP collector. Self-disables at
    * runtime without `LOVABLE_API_KEY` on the default Lovable endpoint.
    */
   readonly metrics?: MetricsConfig;
-}
+} & AppContextConfiguration<TAppContext>;
 declare const McpDefinitionBrand: unique symbol;
-type McpDefinition = McpDefinitionInput & {
+type McpDefinition<TAppContext = unknown> = Omit<McpDefinitionInput<TAppContext>, "createAppContext" | "tools"> & {
+  readonly createAppContext?: (input: CreateAppContextInput) => TAppContext | Promise<TAppContext>;
+  readonly tools: readonly AnyToolDefinition[];
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { McpAuthConfig as A, MetricsConfig as C, ProgressUpdate as D, McpProtocolEra as E, ToolContext as O, ZodSchema as S, McpClientInfo as T, ToolContent as _, EmbeddedResource as a, ZodOutputSchema as b, JsonValue as c, McpDefinition as d, McpDefinitionInput as f, ToolAnnotations as g, TextContent as h, EmbeddedBlobResource as i, JwtClaims as k, JsonValueInput as l, ResourceLinkIcon as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLink as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpAllowedOrigins as u, ToolDefinition as v, MetricsOptions as w, ZodRawShape$1 as x, ToolHandlerResult as y };
+export { McpProtocolEra as A, ZodOutputSchema as C, MetricsOptions as D, MetricsConfig as E, ToolContext as M, JwtClaims as N, AuthContext as O, McpAuthConfig as P, ToolVisibilityContext as S, ZodSchema as T, TextContent as _, CreateAppContextInput as a, ToolDefinition as b, EmbeddedTextResource as c, JsonValueInput as d, McpAllowedOrigins as f, ResourceLinkIcon as g, ResourceLink as h, ContentBlock as i, ProgressUpdate as j, McpClientInfo as k, ImageContent as l, McpDefinitionInput as m, AudioContent as n, EmbeddedBlobResource as o, McpDefinition as p, ContentAnnotations as r, EmbeddedResource as s, AppContextToolDefinition as t, JsonValue as u, ToolAnnotations as v, ZodRawShape$1 as w, ToolHandlerResult as x, ToolContent as y };

package/dist/{types-C6O4ciic.d.cts → types-S6J_QTXw.d.ts}

@@ -116,18 +116,11 @@ interface ToolRequestContext {
   client?: McpClientInfo;
   sendProgress?: (update: ProgressUpdate) => Promise<void>;
 }
-/** The per-request context passed to every tool handler as its second argument. The
- * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
-declare class ToolContext {
+/** Verified caller identity exposed to the app-context factory.
+ * `getToken()` is the sole bearer escape hatch. */
+declare class AuthContext {
   #private;
-  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
-  /** Aborts when the client cancels the request or disconnects. */
-  get signal(): AbortSignal;
-  /** What the client declared about itself on this request. Unverified input. */
-  get client(): McpClientInfo;
-  /** Send a progress notification for this call. A no-op when the client
-   * didn't request progress (no `progressToken` on the request). */
-  progress(update: ProgressUpdate): Promise<void>;
+  constructor(auth: McpAuthContext | undefined);
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -148,6 +141,20 @@ declare class ToolContext {
    */
   getClaims(): JwtClaims | undefined;
 }
+/** The per-request context passed to every tool handler as its second argument. */
+declare class ToolContext<TAppContext = undefined> extends AuthContext {
+  #private;
+  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext, appContext?: TAppContext);
+  /** App-defined context created for this tool call. */
+  get appContext(): TAppContext;
+  /** Aborts when the client cancels the request or disconnects. */
+  get signal(): AbortSignal;
+  /** What the client declared about itself on this request. Unverified input. */
+  get client(): McpClientInfo;
+  /** Send a progress notification for this call. A no-op when the client
+   * didn't request progress (no `progressToken` on the request). */
+  progress(update: ProgressUpdate): Promise<void>;
+}
 //#endregion
 //#region src/metrics/config.d.ts
 /**
@@ -302,7 +309,16 @@ interface ToolHandlerResult {
   structuredContent?: JsonValueInput;
   isError?: boolean;
 }
-interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
+/** Inputs available while creating app context for one MCP request. */
+interface CreateAppContextInput {
+  readonly auth: AuthContext;
+  readonly signal: AbortSignal;
+}
+/** The restricted surface used to decide whether a tool exists. */
+interface ToolVisibilityContext<TAppContext> {
+  readonly appContext: TAppContext;
+}
+interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined, TAppContext = undefined> {
   readonly name: string;
   /** Human-readable display name shown to the user in MCP clients. Required. */
   readonly title: string;
@@ -311,22 +327,44 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly inputSchema?: TInput;
   readonly outputSchema?: TOutput;
   readonly annotations?: ToolAnnotations;
-  readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
+  /** Synchronously decide whether this tool exists for the current caller. */
+  readonly enabled?: (ctx: ToolVisibilityContext<TAppContext>) => boolean;
+  readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult>;
+}
+interface AppContextToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined, TAppContext = unknown> extends ToolDefinition<TInput, TOutput, TAppContext> {
+  readonly requiresAppContext: true;
 }
 /** Type-erased element of `McpDefinition.tools`; per-tool generic typing
  * happens at the `defineTool` call site. */
-interface AnyToolDefinition {
+interface AnyToolDefinition<TAppContext = never> {
   readonly name: string;
   readonly title: string;
   readonly description: string;
   readonly inputSchema?: ZodRawShape$1 | undefined;
   readonly outputSchema?: ZodOutputSchema | undefined;
   readonly annotations?: ToolAnnotations;
-  readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
+  readonly enabled?: (ctx: ToolVisibilityContext<TAppContext>) => boolean;
+  readonly handler: (args: any, ctx: ToolContext<TAppContext>) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
+type StaticToolDefinition = Omit<AnyToolDefinition<undefined>, "enabled"> & {
+  readonly enabled?: never;
+};
+type AnyAppContextToolDefinition<TAppContext = unknown> = AnyToolDefinition<TAppContext> & {
+  readonly requiresAppContext: true;
+};
+type CreateAppContext<TAppContext> = (input: CreateAppContextInput) => TAppContext | Promise<TAppContext>;
+/** Concrete app context requires a factory. `undefined`, `unknown`, and `never`
+ * remain optional because the SDK uses them for static or type-erased tools. */
+type AppContextConfiguration<TAppContext> = [TAppContext] extends [undefined] ? {
+  readonly createAppContext?: CreateAppContext<TAppContext>;
+} : unknown extends TAppContext ? {
+  readonly createAppContext?: CreateAppContext<TAppContext>;
+} : {
+  readonly createAppContext: CreateAppContext<TAppContext>;
+};
 /** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
  * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
-interface McpDefinitionInput {
+type McpDefinitionInput<TAppContext = undefined> = {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
   readonly title: string;
@@ -341,17 +379,19 @@ interface McpDefinitionInput {
    * empty string to opt out.
    */
   readonly instructions: string;
-  readonly tools: readonly AnyToolDefinition[];
+  readonly tools: readonly (AnyAppContextToolDefinition<TAppContext> | StaticToolDefinition)[];
   /**
    * Usage-metrics emission (runtime telemetry), on by default. `false` opts out;
    * `{ endpoint, headers }` sends to your own OTLP collector. Self-disables at
    * runtime without `LOVABLE_API_KEY` on the default Lovable endpoint.
    */
   readonly metrics?: MetricsConfig;
-}
+} & AppContextConfiguration<TAppContext>;
 declare const McpDefinitionBrand: unique symbol;
-type McpDefinition = McpDefinitionInput & {
+type McpDefinition<TAppContext = unknown> = Omit<McpDefinitionInput<TAppContext>, "createAppContext" | "tools"> & {
+  readonly createAppContext?: (input: CreateAppContextInput) => TAppContext | Promise<TAppContext>;
+  readonly tools: readonly AnyToolDefinition[];
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { McpAuthConfig as A, MetricsConfig as C, ProgressUpdate as D, McpProtocolEra as E, ToolContext as O, ZodSchema as S, McpClientInfo as T, ToolContent as _, EmbeddedResource as a, ZodOutputSchema as b, JsonValue as c, McpDefinition as d, McpDefinitionInput as f, ToolAnnotations as g, TextContent as h, EmbeddedBlobResource as i, JwtClaims as k, JsonValueInput as l, ResourceLinkIcon as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLink as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpAllowedOrigins as u, ToolDefinition as v, MetricsOptions as w, ZodRawShape$1 as x, ToolHandlerResult as y };
+export { McpProtocolEra as A, ZodOutputSchema as C, MetricsOptions as D, MetricsConfig as E, ToolContext as M, JwtClaims as N, AuthContext as O, McpAuthConfig as P, ToolVisibilityContext as S, ZodSchema as T, TextContent as _, CreateAppContextInput as a, ToolDefinition as b, EmbeddedTextResource as c, JsonValueInput as d, McpAllowedOrigins as f, ResourceLinkIcon as g, ResourceLink as h, ContentBlock as i, ProgressUpdate as j, McpClientInfo as k, ImageContent as l, McpDefinitionInput as m, AudioContent as n, EmbeddedBlobResource as o, McpDefinition as p, ContentAnnotations as r, EmbeddedResource as s, AppContextToolDefinition as t, JsonValue as u, ToolAnnotations as v, ZodRawShape$1 as w, ToolHandlerResult as x, ToolContent as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "2.0.4-rc.0",
+  "version": "2.1.0-rc.0",
   "engines": {
     "node": ">=20"
   },

package/dist/errors-Bwd1L0Rf.js

@@ -1,100 +0,0 @@
-//#region src/auth/context.ts
-const NEVER_ABORTED = new AbortController().signal;
-/** The per-request context passed to every tool handler as its second argument. The
-* auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
-var ToolContext = class {
-	#auth;
-	#signal;
-	#client;
-	#sendProgress;
-	constructor(auth, request = {}) {
-		this.#auth = auth;
-		this.#signal = request.signal ?? NEVER_ABORTED;
-		this.#client = request.client ?? { protocol: "legacy" };
-		this.#sendProgress = request.sendProgress;
-	}
-	/** Aborts when the client cancels the request or disconnects. */
-	get signal() {
-		return this.#signal;
-	}
-	/** What the client declared about itself on this request. Unverified input. */
-	get client() {
-		return this.#client;
-	}
-	/** Send a progress notification for this call. A no-op when the client
-	* didn't request progress (no `progressToken` on the request). */
-	async progress(update) {
-		await this.#sendProgress?.(update);
-	}
-	/** Whether the in-flight tool call carries a verified auth context. */
-	isAuthenticated() {
-		return this.#auth !== void 0;
-	}
-	/** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
-	getToken() {
-		return this.#auth?.bearer.token;
-	}
-	/** The verified user id (the token `sub`), or `undefined`. */
-	getUserId() {
-		return this.#auth?.principal.sub;
-	}
-	/** The verified user email, or `undefined` when absent. */
-	getUserEmail() {
-		return this.#auth?.principal.email;
-	}
-	/** The verified OAuth `client_id`, or `undefined`. */
-	getClientId() {
-		return this.#auth?.principal.clientId;
-	}
-	/** The verified OAuth scopes, or `undefined` when unauthenticated. */
-	getScopes() {
-		return this.#auth?.principal.scopes;
-	}
-	/** The verified token issuer, or `undefined`. */
-	getIssuer() {
-		return this.#auth?.principal.issuer;
-	}
-	/**
-	* The full verified JWT claims, or `undefined`. Use this for app/business
-	* authorization on issuer-specific claims that have no dedicated accessor.
-	*/
-	getClaims() {
-		return this.#auth?.principal.claims;
-	}
-};
-//#endregion
-//#region src/core/errors.ts
-const TOOL_ERROR_BRAND = Symbol.for("@lovable.dev/mcp-js/tool-error");
-/** Error whose message is meant for the remote MCP caller; thrown from a handler
-*  it becomes an `isError` result carrying exactly `message`. */
-var ToolError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ToolError";
-		Object.defineProperty(this, TOOL_ERROR_BRAND, { value: true });
-	}
-};
-function isToolError(err) {
-	return err instanceof Error && Object.getOwnPropertyDescriptor(err, TOOL_ERROR_BRAND)?.value === true;
-}
-/** The caller-visible message of a thrown ToolError, or undefined for anything
-*  else — including when inspecting the value itself throws (fail closed). */
-function resolveToolErrorMessage(err) {
-	try {
-		return isToolError(err) ? String(err.message) : void 0;
-	} catch {
-		return;
-	}
-}
-const MAX_ERROR_SUMMARY = 500;
-/** Bounded name+message line for local logs; never for wire responses. */
-function errorSummary(err) {
-	try {
-		const text = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
-		return text.length > MAX_ERROR_SUMMARY ? `${text.slice(0, MAX_ERROR_SUMMARY)}…` : text;
-	} catch {
-		return "unprintable error";
-	}
-}
-//#endregion
-export { ToolContext as i, errorSummary as n, resolveToolErrorMessage as r, ToolError as t };

package/dist/errors-Cr95rSkB.cjs

@@ -1,123 +0,0 @@
-//#region src/auth/context.ts
-const NEVER_ABORTED = new AbortController().signal;
-/** The per-request context passed to every tool handler as its second argument. The
-* auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
-var ToolContext = class {
-	#auth;
-	#signal;
-	#client;
-	#sendProgress;
-	constructor(auth, request = {}) {
-		this.#auth = auth;
-		this.#signal = request.signal ?? NEVER_ABORTED;
-		this.#client = request.client ?? { protocol: "legacy" };
-		this.#sendProgress = request.sendProgress;
-	}
-	/** Aborts when the client cancels the request or disconnects. */
-	get signal() {
-		return this.#signal;
-	}
-	/** What the client declared about itself on this request. Unverified input. */
-	get client() {
-		return this.#client;
-	}
-	/** Send a progress notification for this call. A no-op when the client
-	* didn't request progress (no `progressToken` on the request). */
-	async progress(update) {
-		await this.#sendProgress?.(update);
-	}
-	/** Whether the in-flight tool call carries a verified auth context. */
-	isAuthenticated() {
-		return this.#auth !== void 0;
-	}
-	/** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
-	getToken() {
-		return this.#auth?.bearer.token;
-	}
-	/** The verified user id (the token `sub`), or `undefined`. */
-	getUserId() {
-		return this.#auth?.principal.sub;
-	}
-	/** The verified user email, or `undefined` when absent. */
-	getUserEmail() {
-		return this.#auth?.principal.email;
-	}
-	/** The verified OAuth `client_id`, or `undefined`. */
-	getClientId() {
-		return this.#auth?.principal.clientId;
-	}
-	/** The verified OAuth scopes, or `undefined` when unauthenticated. */
-	getScopes() {
-		return this.#auth?.principal.scopes;
-	}
-	/** The verified token issuer, or `undefined`. */
-	getIssuer() {
-		return this.#auth?.principal.issuer;
-	}
-	/**
-	* The full verified JWT claims, or `undefined`. Use this for app/business
-	* authorization on issuer-specific claims that have no dedicated accessor.
-	*/
-	getClaims() {
-		return this.#auth?.principal.claims;
-	}
-};
-//#endregion
-//#region src/core/errors.ts
-const TOOL_ERROR_BRAND = Symbol.for("@lovable.dev/mcp-js/tool-error");
-/** Error whose message is meant for the remote MCP caller; thrown from a handler
-*  it becomes an `isError` result carrying exactly `message`. */
-var ToolError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ToolError";
-		Object.defineProperty(this, TOOL_ERROR_BRAND, { value: true });
-	}
-};
-function isToolError(err) {
-	return err instanceof Error && Object.getOwnPropertyDescriptor(err, TOOL_ERROR_BRAND)?.value === true;
-}
-/** The caller-visible message of a thrown ToolError, or undefined for anything
-*  else — including when inspecting the value itself throws (fail closed). */
-function resolveToolErrorMessage(err) {
-	try {
-		return isToolError(err) ? String(err.message) : void 0;
-	} catch {
-		return;
-	}
-}
-const MAX_ERROR_SUMMARY = 500;
-/** Bounded name+message line for local logs; never for wire responses. */
-function errorSummary(err) {
-	try {
-		const text = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
-		return text.length > MAX_ERROR_SUMMARY ? `${text.slice(0, MAX_ERROR_SUMMARY)}…` : text;
-	} catch {
-		return "unprintable error";
-	}
-}
-//#endregion
-Object.defineProperty(exports, "ToolContext", {
-	enumerable: true,
-	get: function() {
-		return ToolContext;
-	}
-});
-Object.defineProperty(exports, "ToolError", {
-	enumerable: true,
-	get: function() {
-		return ToolError;
-	}
-});
-Object.defineProperty(exports, "errorSummary", {
-	enumerable: true,
-	get: function() {
-		return errorSummary;
-	}
-});
-Object.defineProperty(exports, "resolveToolErrorMessage", {
-	enumerable: true,
-	get: function() {
-		return resolveToolErrorMessage;
-	}
-});