@lovable.dev/mcp-js 2.1.0-rc.0 → 2.1.0

package/dist/index.js

@@ -1,5 +1,149 @@
-import { a as setLogLevel } from "./logger-Ctv5xUSD.js";
-import { a as ToolContext, i as AuthContext, o as defineMcp, s as defineTool, t as ToolError } from "./errors-DTvfh8lb.js";
+import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
+import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
+import { i as ToolContext, t as ToolError } from "./errors-Bwd1L0Rf.js";
+//#region src/core/define.ts
+function assertUniqueNames(mcp) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const tool of mcp.tools) {
+		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
+		seen.add(tool.name);
+	}
+}
+function assertNonEmptyString(label, value) {
+	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
+	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
+}
+function assertHttpsUrlField(name, value) {
+	assertNonEmptyString(`auth.${name}`, value);
+	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
+}
+function assertScope(scope) {
+	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
+}
+function assertJwtAlgorithm(algorithm) {
+	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
+	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
+}
+const MAX_CLOCK_TOLERANCE_SECONDS = 300;
+function assertClockToleranceSeconds(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
+}
+function assertOAuthConfig(auth) {
+	if (auth.type !== "oauth") {
+		const authType = String(auth.type);
+		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
+	}
+	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
+	assertHttpsUrlField("issuer", auth.issuer);
+	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
+	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
+	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
+	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
+	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
+	if (auth.acceptedAudiences !== void 0) {
+		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
+		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
+		for (const audience of auth.acceptedAudiences) {
+			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
+			assertNonEmptyString("auth.acceptedAudiences", audience);
+			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+		}
+	}
+	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+	if (auth.requiredScopes !== void 0) {
+		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
+		for (const scope of auth.requiredScopes) assertScope(scope);
+	}
+	if (auth.algorithms !== void 0) {
+		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
+		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
+		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
+	}
+	if (auth.accessTokenTyp !== void 0) {
+		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
+		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
+		for (const typ of auth.accessTokenTyp) {
+			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
+			assertNonEmptyString("auth.accessTokenTyp", typ);
+		}
+	}
+	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
+	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
+}
+function freezeAuth(auth) {
+	if (!auth) return;
+	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
+	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
+	if (auth.algorithms) Object.freeze(auth.algorithms);
+	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
+	Object.freeze(auth);
+}
+function assertAllowedOrigins(allowedOrigins) {
+	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
+	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
+	for (const origin of allowedOrigins) {
+		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
+	}
+}
+function assertToolSchemas(mcp) {
+	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
+		"inputSchema",
+		tool.inputSchema,
+		"input"
+	], [
+		"outputSchema",
+		tool.outputSchema,
+		"output"
+	]]) {
+		if (!definition) continue;
+		try {
+			jsonSchemaFromDefinition(definition, strategy);
+		} catch (error) {
+			const detail = error instanceof Error ? `: ${error.message}` : "";
+			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
+		}
+	}
+}
+/**
+* Declare a single MCP tool. Import the result into your MCP definition's
+* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
+*
+* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
+* full `z.object(...)` — the MCP SDK builds the object wrapper internally
+* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
+*/
+function defineTool(def) {
+	return def;
+}
+/**
+* Declare the MCP server. `export default` the result from your MCP
+* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
+* emit the framework-specific route(s) at build time.
+*/
+function defineMcp(def) {
+	assertNonEmptyString("name", def.name);
+	assertNonEmptyString("title", def.title);
+	assertNonEmptyString("version", def.version);
+	assertUniqueNames(def);
+	if (def.auth) assertOAuthConfig(def.auth);
+	assertAllowedOrigins(def.allowedOrigins);
+	assertToolSchemas(def);
+	resolveMetricsConfig(def.metrics);
+	freezeAuth(def.auth);
+	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
+	Object.freeze(def.tools);
+	for (const tool of def.tools) Object.freeze(tool);
+	return def;
+}
+//#endregion
 //#region src/auth/config.ts
 function frozenArray(value) {
 	return value === void 0 ? void 0 : Object.freeze([...value]);
@@ -34,4 +178,4 @@ function issuer(options) {
 const oauth = Object.freeze({ issuer });
 const auth = Object.freeze({ oauth });
 //#endregion
-export { AuthContext, ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };
+export { ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };

package/dist/{io-BEoJ_gb5.js → io-DG83CLKx.js}

@@ -1,5 +1,5 @@
 import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { t as version } from "./package-BAYb-3dX.js";
+import { t as version } from "./package-BNFIhH0F.js";
 import { t as isFileMissing } from "./fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
@@ -23,8 +23,7 @@ function buildMcpListing(mcp) {
 			description: tool.description,
 			annotations: tool.annotations,
 			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output"),
-			...tool.enabled ? { conditional: true } : {}
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
 		}))
 	};
 }

package/dist/{io-Cz81GsrM.cjs → io-DZD6xmJQ.cjs}

@@ -1,5 +1,5 @@
 const require_schema = require("./schema-D3vClxb7.cjs");
-const require_package = require("./package-DlouusYQ.cjs");
+const require_package = require("./package-CFVl3oIe.cjs");
 const require_fs_errors = require("./fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -23,8 +23,7 @@ function buildMcpListing(mcp) {
 			description: tool.description,
 			annotations: tool.annotations,
 			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output"),
-			...tool.enabled ? { conditional: true } : {}
+			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
 		}))
 	};
 }

package/dist/{io-9jGNgPfl.d.cts → io-Ds5MRSiK.d.cts}

@@ -1,4 +1,4 @@
-import "./types-S6J_QTXw.cjs";
+import "./types-B3_lX-L1.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-BLZ8jYW6.d.ts → io-pl5npWDw.d.ts}

@@ -1,4 +1,4 @@
-import "./types-S6J_QTXw.js";
+import "./types-B3_lX-L1.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{mcp-Q_rjpR99.cjs → mcp-Bx3LUn5O.cjs}

@@ -1,7 +1,7 @@
 const require_logger = require("./logger-CN1q-KNn.cjs");
 const require_schema = require("./schema-D3vClxb7.cjs");
-const require_errors = require("./errors-CdrGi5aP.cjs");
-const require_cors = require("./cors-0ZCwmwyK.cjs");
+const require_errors = require("./errors-Cr95rSkB.cjs");
+const require_cors = require("./cors-D-X0aP4O.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_server = require("@modelcontextprotocol/server");
 //#region src/core/content.ts
@@ -117,52 +117,6 @@ function createGatedHandler(gate) {
 //#endregion
 //#region src/protocols/mcp/protocol.ts
 const MODERN_PROTOCOL_VERSION = "2026-07-28";
-const HOUR_MS = 3600 * 1e3;
-const NO_OPERATIONS = {
-	listTools: false,
-	calledTools: /* @__PURE__ */ new Set()
-};
-function collectRequestOperations(value, calledTools) {
-	if (Array.isArray(value)) {
-		let listTools = false;
-		for (const item of value) listTools = collectRequestOperations(item, calledTools) || listTools;
-		return listTools;
-	}
-	if (!isPlainObject(value)) return false;
-	if (value.method === "tools/list") return true;
-	if (value.method === "tools/call" && isPlainObject(value.params) && typeof value.params.name === "string") calledTools.add(value.params.name);
-	return false;
-}
-/** Marks a failure in app-owned `createAppContext` or `enabled` code so telemetry
-* can attribute it to the author rather than to the transport. */
-var AppContextError = class extends Error {
-	constructor(cause) {
-		super("app context evaluation failed", { cause });
-		this.name = "AppContextError";
-	}
-};
-async function withAppContextError(run) {
-	try {
-		return await run();
-	} catch (cause) {
-		throw new AppContextError(cause);
-	}
-}
-async function classifyRequest(request) {
-	try {
-		const parsedBody = await request.clone().json();
-		const calledTools = /* @__PURE__ */ new Set();
-		return {
-			operations: {
-				listTools: collectRequestOperations(parsedBody, calledTools),
-				calledTools
-			},
-			parsedBody
-		};
-	} catch {
-		return { operations: NO_OPERATIONS };
-	}
-}
 function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
@@ -237,12 +191,12 @@ function toolRequestContext(sdkCtx, protocol) {
 		sendProgress
 	};
 }
-async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appContext) {
+async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
 	const endUserId = auth?.principal.sub;
 	const start = require_cors.nowMs();
 	let result;
 	try {
-		result = await tool.handler(args, new require_errors.ToolContext(auth, toolRequestContext(sdkCtx, protocol), appContext));
+		result = await tool.handler(args, new require_errors.ToolContext(auth, toolRequestContext(sdkCtx, protocol)));
 	} catch (err) {
 		const callerMessage = require_errors.resolveToolErrorMessage(err);
 		if (callerMessage === void 0) {
@@ -300,10 +254,10 @@ async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appConte
 	});
 	return result;
 }
-function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
+function adaptToolCallback(tool, auth, recorder, protocol) {
 	return async (first, second) => {
 		const sdkCtx = tool.inputSchema ? second : first;
-		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx, appContext);
+		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx);
 		return {
 			content: result.content ?? [],
 			structuredContent: result.structuredContent,
@@ -311,52 +265,23 @@ function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
 		};
 	};
 }
-async function buildServer(mcp, auth, recorder, era, signal, operations) {
-	const calledTools = operations ? mcp.tools.filter((tool) => operations.calledTools.has(tool.name)) : mcp.tools;
-	const selectedTools = !operations || operations.listTools ? mcp.tools : calledTools;
-	const hasConditionalTools = mcp.tools.some((tool) => tool.enabled !== void 0);
-	const needsAppContext = operations?.listTools === true && hasConditionalTools || calledTools.some((tool) => tool.enabled !== void 0 || require_errors.toolRequiresAppContext(tool));
-	const { createAppContext } = mcp;
-	const appContext = needsAppContext && createAppContext ? await withAppContextError(() => createAppContext({
-		auth: new require_errors.AuthContext(auth),
-		signal
-	})) : void 0;
-	const visibilityContext = Object.freeze({ appContext });
-	const cacheHint = hasConditionalTools ? {
-		cacheScope: "private",
-		ttlMs: 12 * HOUR_MS
-	} : {
-		cacheScope: "public",
-		ttlMs: 24 * HOUR_MS
-	};
+function buildServer(mcp, auth, recorder, era) {
 	const server = new _modelcontextprotocol_server.McpServer({
 		name: mcp.name,
 		version: mcp.version,
 		title: mcp.title
 	}, {
 		instructions: mcp.instructions,
-		capabilities: { tools: { listChanged: false } },
-		cacheHints: {
-			"tools/list": cacheHint,
-			"server/discover": cacheHint
-		}
+		capabilities: { tools: { listChanged: false } }
 	});
-	for (const tool of selectedTools) {
-		if (tool.enabled) {
-			const { enabled } = tool;
-			if (!await withAppContextError(() => {
-				const value = enabled(visibilityContext);
-				if (typeof value !== "boolean") throw new TypeError(`@lovable.dev/mcp-js: tool "${tool.name}" enabled must return a boolean synchronously`);
-				return value;
-			})) continue;
-		}
+	for (const tool of mcp.tools) {
 		const config = {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
 			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
 		};
-		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION, appContext);
+		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION);
 		if (tool.inputSchema) server.registerTool(tool.name, {
 			...config,
 			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
@@ -377,28 +302,26 @@ function createMcpProtocolHandler(mcp, options = {}) {
 	const handle = async (request, authResult, recorder) => {
 		let protocolError;
 		const reportTransportError = async (error) => {
-			const appContextFailure = error instanceof AppContextError;
 			await recorder.emit({
 				tool: null,
 				method: "transport",
-				outcome: appContextFailure ? "app_context_error" : "transport_error",
+				outcome: "transport_error",
 				durationMs: 0,
 				endUserId: authResult.auth?.principal.sub
 			});
-			require_logger.log.error(appContextFailure ? "mcp.app_context_error" : "mcp.transport_error", {
-				...error === void 0 ? {} : require_logger.describeError(appContextFailure ? error.cause : error),
+			require_logger.log.error("mcp.transport_error", {
+				...error === void 0 ? {} : require_logger.describeError(error),
 				outcome: "500 internal error"
 			});
 		};
 		try {
-			const classified = mcp.createAppContext ? await classifyRequest(request) : void 0;
-			const response = await (0, _modelcontextprotocol_server.createMcpHandler)(({ era, requestInfo }) => buildServer(mcp, authResult.auth, recorder, era, requestInfo?.signal ?? request.signal, classified?.operations), {
+			const response = await (0, _modelcontextprotocol_server.createMcpHandler)(({ era }) => buildServer(mcp, authResult.auth, recorder, era), {
 				legacy: "stateless",
 				maxSubscriptions: 0,
 				onerror: (error) => {
 					protocolError = error;
 				}
-			}).fetch(request, classified?.parsedBody === void 0 ? void 0 : { parsedBody: classified.parsedBody });
+			}).fetch(request);
 			if (response.status >= 500) await reportTransportError(protocolError);
 			return response;
 		} catch (err) {

package/dist/{mcp-CuHyVOZK.js → mcp-DcmfehoI.js}

@@ -1,7 +1,7 @@
 import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
 import { n as schemaFromDefinition, t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { a as ToolContext, c as toolRequiresAppContext, i as AuthContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DTvfh8lb.js";
-import { d as nowMs, i as normalizeHttpMethod, l as emitBeforeResponse, n as createRequestAuthorizer, p as finalizeWireResponse, t as evaluateCors, u as createNoopRecorder } from "./cors-D4BjUpgU.js";
+import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-Bwd1L0Rf.js";
+import { d as nowMs, i as normalizeHttpMethod, l as emitBeforeResponse, n as createRequestAuthorizer, p as finalizeWireResponse, t as evaluateCors, u as createNoopRecorder } from "./cors-BaRKDl4r.js";
 import { getParseErrorMessage, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, McpServer, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/core/content.ts
@@ -117,52 +117,6 @@ function createGatedHandler(gate) {
 //#endregion
 //#region src/protocols/mcp/protocol.ts
 const MODERN_PROTOCOL_VERSION = "2026-07-28";
-const HOUR_MS = 3600 * 1e3;
-const NO_OPERATIONS = {
-	listTools: false,
-	calledTools: /* @__PURE__ */ new Set()
-};
-function collectRequestOperations(value, calledTools) {
-	if (Array.isArray(value)) {
-		let listTools = false;
-		for (const item of value) listTools = collectRequestOperations(item, calledTools) || listTools;
-		return listTools;
-	}
-	if (!isPlainObject(value)) return false;
-	if (value.method === "tools/list") return true;
-	if (value.method === "tools/call" && isPlainObject(value.params) && typeof value.params.name === "string") calledTools.add(value.params.name);
-	return false;
-}
-/** Marks a failure in app-owned `createAppContext` or `enabled` code so telemetry
-* can attribute it to the author rather than to the transport. */
-var AppContextError = class extends Error {
-	constructor(cause) {
-		super("app context evaluation failed", { cause });
-		this.name = "AppContextError";
-	}
-};
-async function withAppContextError(run) {
-	try {
-		return await run();
-	} catch (cause) {
-		throw new AppContextError(cause);
-	}
-}
-async function classifyRequest(request) {
-	try {
-		const parsedBody = await request.clone().json();
-		const calledTools = /* @__PURE__ */ new Set();
-		return {
-			operations: {
-				listTools: collectRequestOperations(parsedBody, calledTools),
-				calledTools
-			},
-			parsedBody
-		};
-	} catch {
-		return { operations: NO_OPERATIONS };
-	}
-}
 function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
@@ -237,12 +191,12 @@ function toolRequestContext(sdkCtx, protocol) {
 		sendProgress
 	};
 }
-async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appContext) {
+async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
 	const endUserId = auth?.principal.sub;
 	const start = nowMs();
 	let result;
 	try {
-		result = await tool.handler(args, new ToolContext(auth, toolRequestContext(sdkCtx, protocol), appContext));
+		result = await tool.handler(args, new ToolContext(auth, toolRequestContext(sdkCtx, protocol)));
 	} catch (err) {
 		const callerMessage = resolveToolErrorMessage(err);
 		if (callerMessage === void 0) {
@@ -300,10 +254,10 @@ async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx, appConte
 	});
 	return result;
 }
-function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
+function adaptToolCallback(tool, auth, recorder, protocol) {
 	return async (first, second) => {
 		const sdkCtx = tool.inputSchema ? second : first;
-		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx, appContext);
+		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx);
 		return {
 			content: result.content ?? [],
 			structuredContent: result.structuredContent,
@@ -311,52 +265,23 @@ function adaptToolCallback(tool, auth, recorder, protocol, appContext) {
 		};
 	};
 }
-async function buildServer(mcp, auth, recorder, era, signal, operations) {
-	const calledTools = operations ? mcp.tools.filter((tool) => operations.calledTools.has(tool.name)) : mcp.tools;
-	const selectedTools = !operations || operations.listTools ? mcp.tools : calledTools;
-	const hasConditionalTools = mcp.tools.some((tool) => tool.enabled !== void 0);
-	const needsAppContext = operations?.listTools === true && hasConditionalTools || calledTools.some((tool) => tool.enabled !== void 0 || toolRequiresAppContext(tool));
-	const { createAppContext } = mcp;
-	const appContext = needsAppContext && createAppContext ? await withAppContextError(() => createAppContext({
-		auth: new AuthContext(auth),
-		signal
-	})) : void 0;
-	const visibilityContext = Object.freeze({ appContext });
-	const cacheHint = hasConditionalTools ? {
-		cacheScope: "private",
-		ttlMs: 12 * HOUR_MS
-	} : {
-		cacheScope: "public",
-		ttlMs: 24 * HOUR_MS
-	};
+function buildServer(mcp, auth, recorder, era) {
 	const server = new McpServer({
 		name: mcp.name,
 		version: mcp.version,
 		title: mcp.title
 	}, {
 		instructions: mcp.instructions,
-		capabilities: { tools: { listChanged: false } },
-		cacheHints: {
-			"tools/list": cacheHint,
-			"server/discover": cacheHint
-		}
+		capabilities: { tools: { listChanged: false } }
 	});
-	for (const tool of selectedTools) {
-		if (tool.enabled) {
-			const { enabled } = tool;
-			if (!await withAppContextError(() => {
-				const value = enabled(visibilityContext);
-				if (typeof value !== "boolean") throw new TypeError(`@lovable.dev/mcp-js: tool "${tool.name}" enabled must return a boolean synchronously`);
-				return value;
-			})) continue;
-		}
+	for (const tool of mcp.tools) {
 		const config = {
 			title: tool.title,
 			description: tool.description,
 			annotations: tool.annotations,
 			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
 		};
-		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION, appContext);
+		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION);
 		if (tool.inputSchema) server.registerTool(tool.name, {
 			...config,
 			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
@@ -377,28 +302,26 @@ function createMcpProtocolHandler(mcp, options = {}) {
 	const handle = async (request, authResult, recorder) => {
 		let protocolError;
 		const reportTransportError = async (error) => {
-			const appContextFailure = error instanceof AppContextError;
 			await recorder.emit({
 				tool: null,
 				method: "transport",
-				outcome: appContextFailure ? "app_context_error" : "transport_error",
+				outcome: "transport_error",
 				durationMs: 0,
 				endUserId: authResult.auth?.principal.sub
 			});
-			log.error(appContextFailure ? "mcp.app_context_error" : "mcp.transport_error", {
-				...error === void 0 ? {} : describeError(appContextFailure ? error.cause : error),
+			log.error("mcp.transport_error", {
+				...error === void 0 ? {} : describeError(error),
 				outcome: "500 internal error"
 			});
 		};
 		try {
-			const classified = mcp.createAppContext ? await classifyRequest(request) : void 0;
-			const response = await createMcpHandler(({ era, requestInfo }) => buildServer(mcp, authResult.auth, recorder, era, requestInfo?.signal ?? request.signal, classified?.operations), {
+			const response = await createMcpHandler(({ era }) => buildServer(mcp, authResult.auth, recorder, era), {
 				legacy: "stateless",
 				maxSubscriptions: 0,
 				onerror: (error) => {
 					protocolError = error;
 				}
-			}).fetch(request, classified?.parsedBody === void 0 ? void 0 : { parsedBody: classified.parsedBody });
+			}).fetch(request);
 			if (response.status >= 500) await reportTransportError(protocolError);
 			return response;
 		} catch (err) {

package/dist/{package-BAYb-3dX.js → package-BNFIhH0F.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "2.1.0-rc.0";
+var version = "2.1.0";
 //#endregion
 export { version as t };

package/dist/{package-DlouusYQ.cjs → package-CFVl3oIe.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.1.0-rc.0";
+var version = "2.1.0";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-Q_rjpR99.cjs");
+const require_mcp = require("../../mcp-Bx3LUn5O.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
-import { p as McpDefinition } from "../../types-S6J_QTXw.cjs";
-import { t as MetricsRecorder } from "../../base-4G2k3bMl.cjs";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-BC4TM__8.cjs";
+import { d as McpDefinition } from "../../types-B3_lX-L1.cjs";
+import { t as MetricsRecorder } from "../../base-DD4MCXZ6.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-CzyL7nmF.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
-import { p as McpDefinition } from "../../types-S6J_QTXw.js";
-import { t as MetricsRecorder } from "../../base-BnlJz6TE.js";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-DEsM-zTN.js";
+import { d as McpDefinition } from "../../types-B3_lX-L1.js";
+import { t as MetricsRecorder } from "../../base-COwtdWE8.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../../authorize-Drz_eJ7O.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-CuHyVOZK.js";
+import { t as createMcpProtocolHandler } from "../../mcp-DcmfehoI.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_cors = require("../cors-0ZCwmwyK.cjs");
+const require_cors = require("../cors-D-X0aP4O.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/oauth-metadata.d.cts

@@ -1,6 +1,6 @@
-import { p as McpDefinition } from "../types-S6J_QTXw.cjs";
-import { t as MetricsRecorder } from "../base-4G2k3bMl.cjs";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-BC4TM__8.cjs";
+import { d as McpDefinition } from "../types-B3_lX-L1.cjs";
+import { t as MetricsRecorder } from "../base-DD4MCXZ6.cjs";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-CzyL7nmF.cjs";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.ts

@@ -1,6 +1,6 @@
-import { p as McpDefinition } from "../types-S6J_QTXw.js";
-import { t as MetricsRecorder } from "../base-BnlJz6TE.js";
-import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-DEsM-zTN.js";
+import { d as McpDefinition } from "../types-B3_lX-L1.js";
+import { t as MetricsRecorder } from "../base-COwtdWE8.js";
+import { n as ScheduleBackground, t as McpRuntimeOptions } from "../authorize-Drz_eJ7O.js";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder, scheduleBackground?: ScheduleBackground) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { a as oauthConfigurationErrorResponse, f as JSON_HEADERS, i as normalizeHttpMethod, l as emitBeforeResponse, m as methodNotAllowed, p as finalizeWireResponse, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors, u as createNoopRecorder } from "../cors-D4BjUpgU.js";
+import { a as oauthConfigurationErrorResponse, f as JSON_HEADERS, i as normalizeHttpMethod, l as emitBeforeResponse, m as methodNotAllowed, p as finalizeWireResponse, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors, u as createNoopRecorder } from "../cors-BaRKDl4r.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {