@lovable.dev/mcp-js 2.1.0 → 2.2.0-rc.0

package/dist/errors-DGcJ8jPK.js

@@ -0,0 +1,261 @@
+import { o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-CpLgYbCG.js";
+import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
+//#region src/core/define.ts
+function toolRequiresAppContext(tool) {
+	return "requiresAppContext" in tool && tool.requiresAppContext === true;
+}
+function assertUniqueNames(mcp) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const tool of mcp.tools) {
+		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
+		seen.add(tool.name);
+	}
+}
+function assertAppContextConfiguration(mcp) {
+	if (mcp.createAppContext && !mcp.auth) throw new Error(`@lovable.dev/mcp-js: createAppContext requires auth`);
+	if (!mcp.createAppContext && mcp.tools.some((tool) => tool.enabled || toolRequiresAppContext(tool))) throw new Error(`@lovable.dev/mcp-js: app-context or conditional tools require createAppContext`);
+}
+function assertNonEmptyString(label, value) {
+	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
+	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
+}
+function assertHttpsUrlField(name, value) {
+	assertNonEmptyString(`auth.${name}`, value);
+	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
+}
+function assertScope(scope) {
+	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
+}
+function assertJwtAlgorithm(algorithm) {
+	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
+	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
+}
+const MAX_CLOCK_TOLERANCE_SECONDS = 300;
+function assertClockToleranceSeconds(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
+}
+function assertOAuthConfig(auth) {
+	if (auth.type !== "oauth") {
+		const authType = String(auth.type);
+		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
+	}
+	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
+	assertHttpsUrlField("issuer", auth.issuer);
+	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
+	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
+	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
+	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
+	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
+	if (auth.acceptedAudiences !== void 0) {
+		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
+		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
+		for (const audience of auth.acceptedAudiences) {
+			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
+			assertNonEmptyString("auth.acceptedAudiences", audience);
+			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
+		}
+	}
+	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
+	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
+	if (auth.requiredScopes !== void 0) {
+		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
+		for (const scope of auth.requiredScopes) assertScope(scope);
+	}
+	if (auth.algorithms !== void 0) {
+		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
+		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
+		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
+	}
+	if (auth.accessTokenTyp !== void 0) {
+		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
+		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
+		for (const typ of auth.accessTokenTyp) {
+			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
+			assertNonEmptyString("auth.accessTokenTyp", typ);
+		}
+	}
+	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
+	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
+}
+function freezeAuth(auth) {
+	if (!auth) return;
+	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
+	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
+	if (auth.algorithms) Object.freeze(auth.algorithms);
+	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
+	Object.freeze(auth);
+}
+function assertAllowedOrigins(allowedOrigins) {
+	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
+	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
+	for (const origin of allowedOrigins) {
+		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
+	}
+}
+function assertToolSchemas(mcp) {
+	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
+		"inputSchema",
+		tool.inputSchema,
+		"input"
+	], [
+		"outputSchema",
+		tool.outputSchema,
+		"output"
+	]]) {
+		if (!definition) continue;
+		try {
+			jsonSchemaFromDefinition(definition, strategy);
+		} catch (error) {
+			const detail = error instanceof Error ? `: ${error.message}` : "";
+			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
+		}
+	}
+}
+const defineStaticTool = (def) => def;
+const defineTool = Object.assign(defineStaticTool, { withAppContext: () => (def) => {
+	return {
+		...def,
+		requiresAppContext: true
+	};
+} });
+/**
+* Declare the MCP server. `export default` the result from your MCP
+* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
+* emit the framework-specific route(s) at build time.
+*/
+function defineMcp(def) {
+	assertNonEmptyString("name", def.name);
+	assertNonEmptyString("title", def.title);
+	assertNonEmptyString("version", def.version);
+	assertUniqueNames(def);
+	assertAppContextConfiguration(def);
+	if (def.auth) assertOAuthConfig(def.auth);
+	assertAllowedOrigins(def.allowedOrigins);
+	assertToolSchemas(def);
+	resolveMetricsConfig(def.metrics);
+	freezeAuth(def.auth);
+	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
+	Object.freeze(def.tools);
+	for (const tool of def.tools) Object.freeze(tool);
+	return def;
+}
+//#endregion
+//#region src/auth/context.ts
+const NEVER_ABORTED = new AbortController().signal;
+/** Verified caller identity exposed to the app-context factory.
+* `getToken()` is the sole bearer escape hatch. */
+var AuthContext = class {
+	#auth;
+	constructor(auth) {
+		this.#auth = auth;
+	}
+	/** Whether the in-flight tool call carries a verified auth context. */
+	isAuthenticated() {
+		return this.#auth !== void 0;
+	}
+	/** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
+	getToken() {
+		return this.#auth?.bearer.token;
+	}
+	/** The verified user id (the token `sub`), or `undefined`. */
+	getUserId() {
+		return this.#auth?.principal.sub;
+	}
+	/** The verified user email, or `undefined` when absent. */
+	getUserEmail() {
+		return this.#auth?.principal.email;
+	}
+	/** The verified OAuth `client_id`, or `undefined`. */
+	getClientId() {
+		return this.#auth?.principal.clientId;
+	}
+	/** The verified OAuth scopes, or `undefined` when unauthenticated. */
+	getScopes() {
+		return this.#auth?.principal.scopes;
+	}
+	/** The verified token issuer, or `undefined`. */
+	getIssuer() {
+		return this.#auth?.principal.issuer;
+	}
+	/**
+	* The full verified JWT claims, or `undefined`. Use this for app/business
+	* authorization on issuer-specific claims that have no dedicated accessor.
+	*/
+	getClaims() {
+		return this.#auth?.principal.claims;
+	}
+};
+/** The per-request context passed to every tool handler as its second argument. */
+var ToolContext = class extends AuthContext {
+	#appContext;
+	#signal;
+	#client;
+	#sendProgress;
+	constructor(auth, request = {}, appContext) {
+		super(auth);
+		this.#appContext = appContext;
+		this.#signal = request.signal ?? NEVER_ABORTED;
+		this.#client = request.client ?? { protocol: "legacy" };
+		this.#sendProgress = request.sendProgress;
+	}
+	/** App-defined context created for this tool call. */
+	get appContext() {
+		return this.#appContext;
+	}
+	/** Aborts when the client cancels the request or disconnects. */
+	get signal() {
+		return this.#signal;
+	}
+	/** What the client declared about itself on this request. Unverified input. */
+	get client() {
+		return this.#client;
+	}
+	/** Send a progress notification for this call. A no-op when the client
+	* didn't request progress (no `progressToken` on the request). */
+	async progress(update) {
+		await this.#sendProgress?.(update);
+	}
+};
+//#endregion
+//#region src/core/errors.ts
+const TOOL_ERROR_BRAND = Symbol.for("@lovable.dev/mcp-js/tool-error");
+/** Error whose message is meant for the remote MCP caller; thrown from a handler
+*  it becomes an `isError` result carrying exactly `message`. */
+var ToolError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ToolError";
+		Object.defineProperty(this, TOOL_ERROR_BRAND, { value: true });
+	}
+};
+function isToolError(err) {
+	return err instanceof Error && Object.getOwnPropertyDescriptor(err, TOOL_ERROR_BRAND)?.value === true;
+}
+/** The caller-visible message of a thrown ToolError, or undefined for anything
+*  else — including when inspecting the value itself throws (fail closed). */
+function resolveToolErrorMessage(err) {
+	try {
+		return isToolError(err) ? String(err.message) : void 0;
+	} catch {
+		return;
+	}
+}
+const MAX_ERROR_SUMMARY = 500;
+/** Bounded name+message line for local logs; never for wire responses. */
+function errorSummary(err) {
+	try {
+		const text = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+		return text.length > MAX_ERROR_SUMMARY ? `${text.slice(0, MAX_ERROR_SUMMARY)}…` : text;
+	} catch {
+		return "unprintable error";
+	}
+}
+//#endregion
+export { ToolContext as a, toolRequiresAppContext as c, AuthContext as i, errorSummary as n, defineMcp as o, resolveToolErrorMessage as r, defineTool as s, ToolError as t };

package/dist/index.cjs

@@ -1,150 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("./logger-CN1q-KNn.cjs");
-const require_schema = require("./schema-D3vClxb7.cjs");
-const require_errors = require("./errors-Cr95rSkB.cjs");
-//#region src/core/define.ts
-function assertUniqueNames(mcp) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const tool of mcp.tools) {
-		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-		seen.add(tool.name);
-	}
-}
-function assertNonEmptyString(label, value) {
-	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
-}
-function assertHttpsUrlField(name, value) {
-	assertNonEmptyString(`auth.${name}`, value);
-	require_logger.parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
-}
-function assertScope(scope) {
-	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
-}
-function assertJwtAlgorithm(algorithm) {
-	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
-}
-const MAX_CLOCK_TOLERANCE_SECONDS = 300;
-function assertClockToleranceSeconds(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
-}
-function assertOAuthConfig(auth) {
-	if (auth.type !== "oauth") {
-		const authType = String(auth.type);
-		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-	}
-	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-	assertHttpsUrlField("issuer", auth.issuer);
-	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
-	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
-	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
-	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
-	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
-	if (auth.acceptedAudiences !== void 0) {
-		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-		for (const audience of auth.acceptedAudiences) {
-			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-			assertNonEmptyString("auth.acceptedAudiences", audience);
-			if (require_logger.trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-		}
-	}
-	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-	if (auth.requiredScopes !== void 0) {
-		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-		for (const scope of auth.requiredScopes) assertScope(scope);
-	}
-	if (auth.algorithms !== void 0) {
-		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
-	}
-	if (auth.accessTokenTyp !== void 0) {
-		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-		for (const typ of auth.accessTokenTyp) {
-			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-			assertNonEmptyString("auth.accessTokenTyp", typ);
-		}
-	}
-	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
-	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
-}
-function freezeAuth(auth) {
-	if (!auth) return;
-	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
-	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
-	if (auth.algorithms) Object.freeze(auth.algorithms);
-	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
-	Object.freeze(auth);
-}
-function assertAllowedOrigins(allowedOrigins) {
-	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
-	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
-	for (const origin of allowedOrigins) {
-		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch {
-			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
-	}
-}
-function assertToolSchemas(mcp) {
-	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
-		"inputSchema",
-		tool.inputSchema,
-		"input"
-	], [
-		"outputSchema",
-		tool.outputSchema,
-		"output"
-	]]) {
-		if (!definition) continue;
-		try {
-			require_schema.jsonSchemaFromDefinition(definition, strategy);
-		} catch (error) {
-			const detail = error instanceof Error ? `: ${error.message}` : "";
-			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
-		}
-	}
-}
-/**
-* Declare a single MCP tool. Import the result into your MCP definition's
-* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
-*
-* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
-* full `z.object(...)` — the MCP SDK builds the object wrapper internally
-* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
-*/
-function defineTool(def) {
-	return def;
-}
-/**
-* Declare the MCP server. `export default` the result from your MCP
-* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
-* emit the framework-specific route(s) at build time.
-*/
-function defineMcp(def) {
-	assertNonEmptyString("name", def.name);
-	assertNonEmptyString("title", def.title);
-	assertNonEmptyString("version", def.version);
-	assertUniqueNames(def);
-	if (def.auth) assertOAuthConfig(def.auth);
-	assertAllowedOrigins(def.allowedOrigins);
-	assertToolSchemas(def);
-	require_logger.resolveMetricsConfig(def.metrics);
-	freezeAuth(def.auth);
-	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
-	Object.freeze(def.tools);
-	for (const tool of def.tools) Object.freeze(tool);
-	return def;
-}
-//#endregion
+const require_logger = require("./logger-C-Hdu57K.cjs");
+const require_errors = require("./errors-CpTdzogX.cjs");
 //#region src/auth/config.ts
 function frozenArray(value) {
 	return value === void 0 ? void 0 : Object.freeze([...value]);
@@ -179,9 +35,10 @@ function issuer(options) {
 const oauth = Object.freeze({ issuer });
 const auth = Object.freeze({ oauth });
 //#endregion
+exports.AuthContext = require_errors.AuthContext;
 exports.ToolContext = require_errors.ToolContext;
 exports.ToolError = require_errors.ToolError;
 exports.auth = auth;
-exports.defineMcp = defineMcp;
-exports.defineTool = defineTool;
+exports.defineMcp = require_errors.defineMcp;
+exports.defineTool = require_errors.defineTool;
 exports.setLogLevel = require_logger.setLogLevel;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { A as McpAuthConfig, C as MetricsConfig, D as ProgressUpdate, E as McpProtocolEra, O as ToolContext, S as ZodSchema, T as McpClientInfo, _ as ToolContent, a as EmbeddedResource, b as ZodOutputSchema, c as JsonValue, d as McpDefinition, f as McpDefinitionInput, g as ToolAnnotations, h as TextContent, i as EmbeddedBlobResource, k as JwtClaims, l as JsonValueInput, m as ResourceLinkIcon, n as ContentAnnotations, o as EmbeddedTextResource, p as ResourceLink, r as ContentBlock, s as ImageContent, t as AudioContent, u as McpAllowedOrigins, v as ToolDefinition, w as MetricsOptions, x as ZodRawShape, y as ToolHandlerResult } from "./types-B3_lX-L1.cjs";
+import { A as McpClientInfo, C as ToolVisibilityContext, D as MetricsConfig, E as ZodSchema, F as McpAuthConfig, M as ProgressUpdate, N as ToolContext, O as MetricsOptions, P as JwtClaims, S as ToolHandlerResult, T as ZodRawShape, _ as ResourceLinkIcon, a as ContentBlock, b as ToolContent, c as EmbeddedResource, d as JsonValue, f as JsonValueInput, g as ResourceLink, h as McpDefinitionInput, i as ContentAnnotations, j as McpProtocolEra, k as AuthContext, l as EmbeddedTextResource, m as McpDefinition, n as AppContextToolDefinitionInput, o as CreateAppContextInput, p as McpAllowedOrigins, r as AudioContent, s as EmbeddedBlobResource, t as AppContextToolDefinition, u as ImageContent, v as TextContent, w as ZodOutputSchema, x as ToolDefinition, y as ToolAnnotations } from "./types-BCKyT2wb.cjs";
 //#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
@@ -8,13 +8,18 @@ import { A as McpAuthConfig, C as MetricsConfig, D as ProgressUpdate, E as McpPr
  * full `z.object(...)` — the MCP SDK builds the object wrapper internally
  * and the raw shape is what the JSON-RPC `tools/list` payload exposes.
  */
-declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+interface DefineTool {
+  <TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+  /** Bind app context once while retaining input/output inference for every tool. */
+  withAppContext<TAppContext>(): <TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: AppContextToolDefinitionInput<TInput, TOutput, TAppContext>) => AppContextToolDefinition<TInput, TOutput, TAppContext>;
+}
+declare const defineTool: DefineTool;
 /**
  * Declare the MCP server. `export default` the result from your MCP
  * entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
  * emit the framework-specific route(s) at build time.
  */
-declare function defineMcp(def: McpDefinitionInput): McpDefinition;
+declare function defineMcp<TAppContext = undefined>(def: McpDefinitionInput<TAppContext>): McpDefinition<TAppContext>;
 //#endregion
 //#region src/auth/config.d.ts
 type IssuerAcceptedAudiences = string | readonly string[];
@@ -71,4 +76,4 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  */
 declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
-export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JsonValueInput, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpClientInfo, type McpDefinitionInput, type McpProtocolEra, type MetricsConfig, type MetricsOptions, type ProgressUpdate, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };
+export { type AppContextToolDefinition, type AppContextToolDefinitionInput, type AudioContent, AuthContext, type ContentAnnotations, type ContentBlock, type CreateAppContextInput, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JsonValueInput, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpClientInfo, type McpDefinitionInput, type McpProtocolEra, type MetricsConfig, type MetricsOptions, type ProgressUpdate, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ToolVisibilityContext, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as McpAuthConfig, C as MetricsConfig, D as ProgressUpdate, E as McpProtocolEra, O as ToolContext, S as ZodSchema, T as McpClientInfo, _ as ToolContent, a as EmbeddedResource, b as ZodOutputSchema, c as JsonValue, d as McpDefinition, f as McpDefinitionInput, g as ToolAnnotations, h as TextContent, i as EmbeddedBlobResource, k as JwtClaims, l as JsonValueInput, m as ResourceLinkIcon, n as ContentAnnotations, o as EmbeddedTextResource, p as ResourceLink, r as ContentBlock, s as ImageContent, t as AudioContent, u as McpAllowedOrigins, v as ToolDefinition, w as MetricsOptions, x as ZodRawShape, y as ToolHandlerResult } from "./types-B3_lX-L1.js";
+import { A as McpClientInfo, C as ToolVisibilityContext, D as MetricsConfig, E as ZodSchema, F as McpAuthConfig, M as ProgressUpdate, N as ToolContext, O as MetricsOptions, P as JwtClaims, S as ToolHandlerResult, T as ZodRawShape, _ as ResourceLinkIcon, a as ContentBlock, b as ToolContent, c as EmbeddedResource, d as JsonValue, f as JsonValueInput, g as ResourceLink, h as McpDefinitionInput, i as ContentAnnotations, j as McpProtocolEra, k as AuthContext, l as EmbeddedTextResource, m as McpDefinition, n as AppContextToolDefinitionInput, o as CreateAppContextInput, p as McpAllowedOrigins, r as AudioContent, s as EmbeddedBlobResource, t as AppContextToolDefinition, u as ImageContent, v as TextContent, w as ZodOutputSchema, x as ToolDefinition, y as ToolAnnotations } from "./types-BCKyT2wb.js";
 //#region src/core/define.d.ts
 /**
  * Declare a single MCP tool. Import the result into your MCP definition's
@@ -8,13 +8,18 @@ import { A as McpAuthConfig, C as MetricsConfig, D as ProgressUpdate, E as McpPr
  * full `z.object(...)` — the MCP SDK builds the object wrapper internally
  * and the raw shape is what the JSON-RPC `tools/list` payload exposes.
  */
-declare function defineTool<TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+interface DefineTool {
+  <TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
+  /** Bind app context once while retaining input/output inference for every tool. */
+  withAppContext<TAppContext>(): <TInput extends ZodRawShape | undefined = undefined, TOutput extends ZodOutputSchema | undefined = undefined>(def: AppContextToolDefinitionInput<TInput, TOutput, TAppContext>) => AppContextToolDefinition<TInput, TOutput, TAppContext>;
+}
+declare const defineTool: DefineTool;
 /**
  * Declare the MCP server. `export default` the result from your MCP
  * entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
  * emit the framework-specific route(s) at build time.
  */
-declare function defineMcp(def: McpDefinitionInput): McpDefinition;
+declare function defineMcp<TAppContext = undefined>(def: McpDefinitionInput<TAppContext>): McpDefinition<TAppContext>;
 //#endregion
 //#region src/auth/config.d.ts
 type IssuerAcceptedAudiences = string | readonly string[];
@@ -71,4 +76,4 @@ type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
  */
 declare function setLogLevel(level: LogLevel): LogLevel;
 //#endregion
-export { type AudioContent, type ContentAnnotations, type ContentBlock, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JsonValueInput, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpClientInfo, type McpDefinitionInput, type McpProtocolEra, type MetricsConfig, type MetricsOptions, type ProgressUpdate, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };
+export { type AppContextToolDefinition, type AppContextToolDefinitionInput, type AudioContent, AuthContext, type ContentAnnotations, type ContentBlock, type CreateAppContextInput, type EmbeddedBlobResource, type EmbeddedResource, type EmbeddedTextResource, type ImageContent, type IssuerOAuthOptions, type JsonValue, type JsonValueInput, type JwtClaims, type LogLevel, type McpAllowedOrigins, type McpClientInfo, type McpDefinitionInput, type McpProtocolEra, type MetricsConfig, type MetricsOptions, type ProgressUpdate, type ResourceLink, type ResourceLinkIcon, type TextContent, type ToolAnnotations, type ToolContent, ToolContext, type ToolDefinition, ToolError, type ToolHandlerResult, type ToolVisibilityContext, type ZodOutputSchema, type ZodRawShape, type ZodSchema, auth, defineMcp, defineTool, setLogLevel };

package/dist/index.js

@@ -1,149 +1,5 @@
-import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
-import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { i as ToolContext, t as ToolError } from "./errors-Bwd1L0Rf.js";
-//#region src/core/define.ts
-function assertUniqueNames(mcp) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const tool of mcp.tools) {
-		if (seen.has(tool.name)) throw new Error(`@lovable.dev/mcp-js: duplicate tool name "${tool.name}"`);
-		seen.add(tool.name);
-	}
-}
-function assertNonEmptyString(label, value) {
-	if (value.trim() === "") throw new Error(`@lovable.dev/mcp-js: ${label} must not be empty`);
-	if (value !== value.trim()) throw new Error(`@lovable.dev/mcp-js: ${label} must not have leading or trailing whitespace`);
-}
-function assertHttpsUrlField(name, value) {
-	assertNonEmptyString(`auth.${name}`, value);
-	parseSafeUrl(`@lovable.dev/mcp-js: auth.${name}`, value);
-}
-function assertScope(scope) {
-	if (scope.trim() === "" || /\s/.test(scope)) throw new Error(`@lovable.dev/mcp-js: OAuth scopes must be non-empty space-free tokens`);
-}
-function assertJwtAlgorithm(algorithm) {
-	if (algorithm.trim() === "" || /\s/.test(algorithm)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must contain non-empty space-free tokens`);
-	if (/^HS\d+$/i.test(algorithm) || algorithm.toLowerCase() === "none") throw new Error(`@lovable.dev/mcp-js: auth.algorithms cannot include "${algorithm}"; this verifier is JWKS-only`);
-}
-const MAX_CLOCK_TOLERANCE_SECONDS = 300;
-function assertClockToleranceSeconds(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_CLOCK_TOLERANCE_SECONDS) throw new Error(`@lovable.dev/mcp-js: auth.clockToleranceSeconds must be a non-negative number of seconds no greater than ${MAX_CLOCK_TOLERANCE_SECONDS}`);
-}
-function assertOAuthConfig(auth) {
-	if (auth.type !== "oauth") {
-		const authType = String(auth.type);
-		throw new Error(`@lovable.dev/mcp-js: unsupported auth type "${authType}"`);
-	}
-	if (auth.issuer === void 0) throw new Error(`@lovable.dev/mcp-js: auth.issuer is required`);
-	assertHttpsUrlField("issuer", auth.issuer);
-	if (auth.jwksUri !== void 0) assertHttpsUrlField("jwksUri", auth.jwksUri);
-	if (auth.resource !== void 0) assertHttpsUrlField("resource", auth.resource);
-	if (auth.resourceName !== void 0) assertNonEmptyString("auth.resourceName", auth.resourceName);
-	if (auth.resourceDocumentation !== void 0) assertHttpsUrlField("resourceDocumentation", auth.resourceDocumentation);
-	if (auth.protectedResourceMetadataUrl !== void 0) assertHttpsUrlField("protectedResourceMetadataUrl", auth.protectedResourceMetadataUrl);
-	if (auth.acceptedAudiences !== void 0) {
-		if (!Array.isArray(auth.acceptedAudiences)) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must be an array`);
-		if (auth.acceptedAudiences.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must not be empty`);
-		for (const audience of auth.acceptedAudiences) {
-			if (typeof audience !== "string") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences must contain strings`);
-			assertNonEmptyString("auth.acceptedAudiences", audience);
-			if (trimTrailingSlash(audience) === "") throw new Error(`@lovable.dev/mcp-js: auth.acceptedAudiences entries must not be only slashes`);
-		}
-	}
-	if (auth.requireOAuthClientClaim !== void 0 && typeof auth.requireOAuthClientClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.requireOAuthClientClaim must be a boolean`);
-	if (auth.acceptResourceClaim !== void 0 && typeof auth.acceptResourceClaim !== "boolean") throw new Error(`@lovable.dev/mcp-js: auth.acceptResourceClaim must be a boolean`);
-	if (auth.requiredScopes !== void 0) {
-		if (!Array.isArray(auth.requiredScopes)) throw new Error(`@lovable.dev/mcp-js: auth.requiredScopes must be an array`);
-		for (const scope of auth.requiredScopes) assertScope(scope);
-	}
-	if (auth.algorithms !== void 0) {
-		if (!Array.isArray(auth.algorithms)) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must be an array`);
-		if (auth.algorithms.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.algorithms must not be empty`);
-		for (const algorithm of auth.algorithms) assertJwtAlgorithm(algorithm);
-	}
-	if (auth.accessTokenTyp !== void 0) {
-		if (!Array.isArray(auth.accessTokenTyp)) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must be an array`);
-		if (auth.accessTokenTyp.length === 0) throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must not be empty`);
-		for (const typ of auth.accessTokenTyp) {
-			if (typeof typ !== "string") throw new Error(`@lovable.dev/mcp-js: auth.accessTokenTyp must contain strings`);
-			assertNonEmptyString("auth.accessTokenTyp", typ);
-		}
-	}
-	if (auth.clockToleranceSeconds !== void 0) assertClockToleranceSeconds(auth.clockToleranceSeconds);
-	if (auth.resource === void 0 && auth.acceptedAudiences === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or auth.acceptedAudiences is required`);
-}
-function freezeAuth(auth) {
-	if (!auth) return;
-	if (auth.acceptedAudiences) Object.freeze(auth.acceptedAudiences);
-	if (auth.requiredScopes) Object.freeze(auth.requiredScopes);
-	if (auth.algorithms) Object.freeze(auth.algorithms);
-	if (auth.accessTokenTyp) Object.freeze(auth.accessTokenTyp);
-	Object.freeze(auth);
-}
-function assertAllowedOrigins(allowedOrigins) {
-	if (allowedOrigins === void 0 || allowedOrigins === "any") return;
-	if (!Array.isArray(allowedOrigins)) throw new Error(`@lovable.dev/mcp-js: allowedOrigins must be "any" or an array of exact origins`);
-	for (const origin of allowedOrigins) {
-		if (typeof origin !== "string") throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain strings`);
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch {
-			throw new Error(`@lovable.dev/mcp-js: allowedOrigins must contain valid exact origins`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`@lovable.dev/mcp-js: allowedOrigins entry "${origin}" must be an exact http(s) origin without a path, query, fragment, or trailing slash`);
-	}
-}
-function assertToolSchemas(mcp) {
-	for (const tool of mcp.tools) for (const [name, definition, strategy] of [[
-		"inputSchema",
-		tool.inputSchema,
-		"input"
-	], [
-		"outputSchema",
-		tool.outputSchema,
-		"output"
-	]]) {
-		if (!definition) continue;
-		try {
-			jsonSchemaFromDefinition(definition, strategy);
-		} catch (error) {
-			const detail = error instanceof Error ? `: ${error.message}` : "";
-			throw new Error(`@lovable.dev/mcp-js: tool "${tool.name}" ${name} cannot be represented as JSON Schema${detail}`);
-		}
-	}
-}
-/**
-* Declare a single MCP tool. Import the result into your MCP definition's
-* `tools` array — `defineMcp({ tools: [echoTool, ...] })`.
-*
-* `inputSchema` is a raw zod shape (e.g. `{ text: z.string() }`), not a
-* full `z.object(...)` — the MCP SDK builds the object wrapper internally
-* and the raw shape is what the JSON-RPC `tools/list` payload exposes.
-*/
-function defineTool(def) {
-	return def;
-}
-/**
-* Declare the MCP server. `export default` the result from your MCP
-* entrypoint (default `lib/mcp/index.ts`); the Vite plugin reads it to
-* emit the framework-specific route(s) at build time.
-*/
-function defineMcp(def) {
-	assertNonEmptyString("name", def.name);
-	assertNonEmptyString("title", def.title);
-	assertNonEmptyString("version", def.version);
-	assertUniqueNames(def);
-	if (def.auth) assertOAuthConfig(def.auth);
-	assertAllowedOrigins(def.allowedOrigins);
-	assertToolSchemas(def);
-	resolveMetricsConfig(def.metrics);
-	freezeAuth(def.auth);
-	if (Array.isArray(def.allowedOrigins)) Object.freeze(def.allowedOrigins);
-	Object.freeze(def.tools);
-	for (const tool of def.tools) Object.freeze(tool);
-	return def;
-}
-//#endregion
+import { a as setLogLevel } from "./logger-CpLgYbCG.js";
+import { a as ToolContext, i as AuthContext, o as defineMcp, s as defineTool, t as ToolError } from "./errors-DGcJ8jPK.js";
 //#region src/auth/config.ts
 function frozenArray(value) {
 	return value === void 0 ? void 0 : Object.freeze([...value]);
@@ -178,4 +34,4 @@ function issuer(options) {
 const oauth = Object.freeze({ issuer });
 const auth = Object.freeze({ oauth });
 //#endregion
-export { ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };
+export { AuthContext, ToolContext, ToolError, auth, defineMcp, defineTool, setLogLevel };