@lovable.dev/mcp-js 0.12.1 → 0.13.0

package/dist/{authorize-HTd0GKmB.d.ts → authorize-BMeXd_Sh.d.ts}

@@ -13,6 +13,13 @@ interface McpRuntimeOptions {
      * an externally hosted document). Defaults to the well-known path when absent.
      */
     metadataPath?: string;
+    /**
+     * Derive the request origin (and thus the advertised `resource`/metadata URLs)
+     * from `X-Forwarded-Host` rather than the rewritten `Host`. Stack adapters read
+     * this before invoking the handler, so the OAuth runtime never sees it; safe
+     * only behind a proxy that overwrites the header (see `core/forwarded.ts`).
+     */
+    trustForwardedHost?: boolean;
 }
 
 export type { McpRuntimeOptions as M };

package/dist/{chunk-Y2FTHVL3.js → chunk-SIITHGUD.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.12.1";
+var version = "0.13.0";
 
 export {
   version

package/dist/chunk-UQK5UO6C.js

@@ -0,0 +1,26 @@
+// src/core/forwarded.ts
+function applyForwardedOrigin(request, options) {
+  const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
+  const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
+  if (proto === void 0 && host === void 0)
+    return request;
+  const url = new URL(request.url);
+  let changed = false;
+  if (proto !== void 0 && `${proto}:` !== url.protocol) {
+    url.protocol = `${proto}:`;
+    changed = true;
+  }
+  if (host !== void 0 && host !== url.host) {
+    url.host = host;
+    changed = true;
+  }
+  return changed ? new Request(url.href, request) : request;
+}
+function firstForwardedValue(request, header) {
+  const value = request.headers.get(header)?.split(",")[0]?.trim();
+  return value ? value : void 0;
+}
+
+export {
+  applyForwardedOrigin
+};

package/dist/cli/extract-manifest.cjs

@@ -13,7 +13,7 @@ function isFileMissing(err) {
 }
 
 // package.json
-var version = "0.12.1";
+var version = "0.13.0";
 
 // src/protocols/rest/list-tools.ts
 var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");

package/dist/cli/extract-manifest.js

@@ -7,7 +7,7 @@ import "../chunk-QC3DXQTH.js";
 import "../chunk-6DXGZZA4.js";
 import {
   version
-} from "../chunk-Y2FTHVL3.js";
+} from "../chunk-SIITHGUD.js";
 import {
   isFileMissing
 } from "../chunk-Y3ZFPEQH.js";

package/dist/protocols/mcp/index.d.cts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/protocols/mcp/index.d.ts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/protocols/oauth-metadata.d.cts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../types-BanzncFh.js';
 import 'zod';
 

package/dist/protocols/oauth-metadata.d.ts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../types-BanzncFh.js';
 import 'zod';
 

package/dist/protocols/rest/index.d.cts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/protocols/rest/index.d.ts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/stacks/supabase/index.cjs

@@ -72,6 +72,29 @@ function resolveResourcePath(resourcePath, request) {
   return resourcePath;
 }
 
+// src/core/forwarded.ts
+function applyForwardedOrigin(request, options) {
+  const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
+  const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
+  if (proto === void 0 && host === void 0)
+    return request;
+  const url = new URL(request.url);
+  let changed = false;
+  if (proto !== void 0 && `${proto}:` !== url.protocol) {
+    url.protocol = `${proto}:`;
+    changed = true;
+  }
+  if (host !== void 0 && host !== url.host) {
+    url.host = host;
+    changed = true;
+  }
+  return changed ? new Request(url.href, request) : request;
+}
+function firstForwardedValue(request, header) {
+  const value = request.headers.get(header)?.split(",")[0]?.trim();
+  return value ? value : void 0;
+}
+
 // src/protocols/mcp/protocol.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
@@ -924,16 +947,6 @@ function dispatchFor(pathname) {
   }
   return { kind: "mcp" };
 }
-function applyForwardedProto(request) {
-  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  if (!proto)
-    return request;
-  const url = new URL(request.url);
-  if (`${proto}:` === url.protocol)
-    return request;
-  url.protocol = `${proto}:`;
-  return new Request(url.href, request);
-}
 function createSupabaseHandler(mcp, options = {}) {
   const resourcePath = deriveResourcePath(options);
   if (resourcePath !== void 0)
@@ -946,7 +959,10 @@ function createSupabaseHandler(mcp, options = {}) {
   const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
   const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
   return async (request) => {
-    const req = applyForwardedProto(request);
+    const req = applyForwardedOrigin(request, {
+      trustForwardedProto: true,
+      trustForwardedHost: options.trustForwardedHost
+    });
     const target = dispatchFor(new URL(req.url).pathname);
     switch (target.kind) {
       case "metadata":

package/dist/stacks/supabase/index.d.cts

@@ -19,6 +19,15 @@ interface SupabaseHandlerOptions {
      * a Lovable Cloud–style host that rewrites the public URL.
      */
     resourcePath?: string;
+    /**
+     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+     * instead of the request `Host`, so a function fronted by a custom-domain
+     * proxy advertises the public host. Off by default: enable only behind a
+     * proxy that overwrites the header (an unsanitized one lets a client spoof
+     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+     * Supabase terminates TLS upstream and forwards over http.
+     */
+    trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from

package/dist/stacks/supabase/index.d.ts

@@ -19,6 +19,15 @@ interface SupabaseHandlerOptions {
      * a Lovable Cloud–style host that rewrites the public URL.
      */
     resourcePath?: string;
+    /**
+     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+     * instead of the request `Host`, so a function fronted by a custom-domain
+     * proxy advertises the public host. Off by default: enable only behind a
+     * proxy that overwrites the header (an unsanitized one lets a client spoof
+     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+     * Supabase terminates TLS upstream and forwards over http.
+     */
+    trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from

package/dist/stacks/supabase/index.js

@@ -1,3 +1,6 @@
+import {
+  applyForwardedOrigin
+} from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
 } from "../../chunk-WLNT2FX7.js";
@@ -54,16 +57,6 @@ function dispatchFor(pathname) {
   }
   return { kind: "mcp" };
 }
-function applyForwardedProto(request) {
-  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  if (!proto)
-    return request;
-  const url = new URL(request.url);
-  if (`${proto}:` === url.protocol)
-    return request;
-  url.protocol = `${proto}:`;
-  return new Request(url.href, request);
-}
 function createSupabaseHandler(mcp, options = {}) {
   const resourcePath = deriveResourcePath(options);
   if (resourcePath !== void 0)
@@ -76,7 +69,10 @@ function createSupabaseHandler(mcp, options = {}) {
   const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
   const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
   return async (request) => {
-    const req = applyForwardedProto(request);
+    const req = applyForwardedOrigin(request, {
+      trustForwardedProto: true,
+      trustForwardedHost: options.trustForwardedHost
+    });
     const target = dispatchFor(new URL(req.url).pathname);
     switch (target.kind) {
       case "metadata":

package/dist/stacks/supabase/vite.cjs

@@ -32,7 +32,7 @@ var import_node_fs = require("fs");
 var import_node_path = require("path");
 
 // package.json
-var version = "0.12.1";
+var version = "0.13.0";
 
 // src/core/fs-errors.ts
 function isFileMissing(err) {

package/dist/stacks/supabase/vite.js

@@ -1,6 +1,6 @@
 import {
   version
-} from "../../chunk-Y2FTHVL3.js";
+} from "../../chunk-SIITHGUD.js";
 import {
   isFileMissing
 } from "../../chunk-Y3ZFPEQH.js";

package/dist/stacks/tanstack/index.cjs

@@ -27,6 +27,29 @@ __export(tanstack_exports, {
 });
 module.exports = __toCommonJS(tanstack_exports);
 
+// src/core/forwarded.ts
+function applyForwardedOrigin(request, options) {
+  const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
+  const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
+  if (proto === void 0 && host === void 0)
+    return request;
+  const url = new URL(request.url);
+  let changed = false;
+  if (proto !== void 0 && `${proto}:` !== url.protocol) {
+    url.protocol = `${proto}:`;
+    changed = true;
+  }
+  if (host !== void 0 && host !== url.host) {
+    url.host = host;
+    changed = true;
+  }
+  return changed ? new Request(url.href, request) : request;
+}
+function firstForwardedValue(request, header) {
+  const value = request.headers.get(header)?.split(",")[0]?.trim();
+  return value ? value : void 0;
+}
+
 // src/protocols/mcp/protocol.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
@@ -889,21 +912,24 @@ function createInvokeToolHandler(mcp, options = {}) {
 }
 
 // src/stacks/tanstack/handlers.ts
+function forwarded(request, options) {
+  return applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
+}
 function createTanStackMcpHandler(mcp, options = {}) {
   const handler = createMcpProtocolHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 function createTanStackListToolsHandler(mcp, options = {}) {
   const handler = createListToolsHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 function createTanStackInvokeToolHandler(mcp, options = {}) {
   const handler = createInvokeToolHandler(mcp, options);
-  return ({ request, params }) => handler(request, params.tool);
+  return ({ request, params }) => handler(forwarded(request, options), params.tool);
 }
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/stacks/tanstack/index.d.cts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/stacks/tanstack/index.d.ts

@@ -1,4 +1,4 @@
-import { M as McpRuntimeOptions } from '../../authorize-HTd0GKmB.js';
+import { M as McpRuntimeOptions } from '../../authorize-BMeXd_Sh.js';
 import { d as McpDefinition } from '../../types-BanzncFh.js';
 import 'zod';
 

package/dist/stacks/tanstack/index.js

@@ -1,3 +1,6 @@
+import {
+  applyForwardedOrigin
+} from "../../chunk-UQK5UO6C.js";
 import {
   createMcpProtocolHandler
 } from "../../chunk-WLNT2FX7.js";
@@ -16,21 +19,24 @@ import "../../chunk-QC3DXQTH.js";
 import "../../chunk-6DXGZZA4.js";
 
 // src/stacks/tanstack/handlers.ts
+function forwarded(request, options) {
+  return applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
+}
 function createTanStackMcpHandler(mcp, options = {}) {
   const handler = createMcpProtocolHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 function createTanStackListToolsHandler(mcp, options = {}) {
   const handler = createListToolsHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 function createTanStackInvokeToolHandler(mcp, options = {}) {
   const handler = createInvokeToolHandler(mcp, options);
-  return ({ request, params }) => handler(request, params.tool);
+  return ({ request, params }) => handler(forwarded(request, options), params.tool);
 }
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-  return ({ request }) => handler(request);
+  return ({ request }) => handler(forwarded(request, options));
 }
 export {
   createTanStackInvokeToolHandler,

package/dist/stacks/tanstack/vite.cjs

@@ -116,11 +116,16 @@ function relativeImportSpecifier(routeFile, target) {
   const withoutExt = rel.replace(/\.ts$/, "");
   return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
   const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
   const routeRel = normalizePath((0, import_node_path.relative)(projectRoot, route.file));
   const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
-  const runtimeOptions = metadataPath === void 0 ? `{ resourcePath: "${resourcePath}" }` : `{ resourcePath: "${resourcePath}", metadataPath: "${metadataPath}" }`;
+  const optionEntries = [`resourcePath: "${resourcePath}"`];
+  if (metadataPath !== void 0)
+    optionEntries.push(`metadataPath: "${metadataPath}"`);
+  if (trustForwardedHost)
+    optionEntries.push("trustForwardedHost: true");
+  const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
   return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -223,6 +228,7 @@ function mcpPlugin(options = {}) {
   }
   const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
   const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
+  const trustForwardedHost = options.trustForwardedHost !== false;
   let projectRoot = process.cwd();
   let mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
   let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
@@ -270,7 +276,10 @@ function mcpPlugin(options = {}) {
       }
       for (const route of routes) {
         expected.add(route.file);
-        writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, mcpEntry, projectRoot));
+        writeIfChanged(
+          route.file,
+          buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot)
+        );
       }
     }
     for (const file of findAdoptedFiles(routesDir)) {

package/dist/stacks/tanstack/vite.d.cts

@@ -64,6 +64,17 @@ interface McpPluginOptions {
      * @default "/.well-known/oauth-protected-resource"
      */
     metadataPath?: string;
+    /**
+     * Derive the public origin of the advertised OAuth `resource`/metadata URLs
+     * from `X-Forwarded-Host` instead of the rewritten `Host`. Lovable's web-proxy
+     * serves a custom domain by rewriting `Host` to the internal backend and
+     * overwriting `X-Forwarded-Host` with the real public host, so the default is
+     * `true` to make custom domains work out of the box. Set `false` only when
+     * deploying behind a proxy that does not overwrite the header (a client could
+     * then spoof it to redirect the advertised resource).
+     * @default true
+     */
+    trustForwardedHost?: boolean;
 }
 
 declare function assertUrlPathShape(urlPath: string): string;

package/dist/stacks/tanstack/vite.d.ts

@@ -64,6 +64,17 @@ interface McpPluginOptions {
      * @default "/.well-known/oauth-protected-resource"
      */
     metadataPath?: string;
+    /**
+     * Derive the public origin of the advertised OAuth `resource`/metadata URLs
+     * from `X-Forwarded-Host` instead of the rewritten `Host`. Lovable's web-proxy
+     * serves a custom domain by rewriting `Host` to the internal backend and
+     * overwriting `X-Forwarded-Host` with the real public host, so the default is
+     * `true` to make custom domains work out of the box. Set `false` only when
+     * deploying behind a proxy that does not overwrite the header (a client could
+     * then spoof it to redirect the advertised resource).
+     * @default true
+     */
+    trustForwardedHost?: boolean;
 }
 
 declare function assertUrlPathShape(urlPath: string): string;

package/dist/stacks/tanstack/vite.js

@@ -85,11 +85,16 @@ function relativeImportSpecifier(routeFile, target) {
   const withoutExt = rel.replace(/\.ts$/, "");
   return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
   const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
   const routeRel = normalizePath(relative(projectRoot, route.file));
   const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
-  const runtimeOptions = metadataPath === void 0 ? `{ resourcePath: "${resourcePath}" }` : `{ resourcePath: "${resourcePath}", metadataPath: "${metadataPath}" }`;
+  const optionEntries = [`resourcePath: "${resourcePath}"`];
+  if (metadataPath !== void 0)
+    optionEntries.push(`metadataPath: "${metadataPath}"`);
+  if (trustForwardedHost)
+    optionEntries.push("trustForwardedHost: true");
+  const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
   return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -192,6 +197,7 @@ function mcpPlugin(options = {}) {
   }
   const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
   const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
+  const trustForwardedHost = options.trustForwardedHost !== false;
   let projectRoot = process.cwd();
   let mcpEntry = resolve(projectRoot, mcpEntryOption);
   let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
@@ -239,7 +245,10 @@ function mcpPlugin(options = {}) {
       }
       for (const route of routes) {
         expected.add(route.file);
-        writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, mcpEntry, projectRoot));
+        writeIfChanged(
+          route.file,
+          buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot)
+        );
       }
     }
     for (const file of findAdoptedFiles(routesDir)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {