@lovable.dev/mcp-js 0.26.3 → 0.27.0

package/dist/stacks/tanstack/index.cjs

@@ -1,22 +1,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-CzTj3-nh.cjs");
-const require_mcp = require("../../mcp-CG_9H8CN.cjs");
+const require_authorize = require("../../authorize-FZydvyMU.cjs");
+const require_mcp = require("../../mcp-BLYbUCO5.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-wQ13O3WE.cjs");
-const require_rest = require("../../rest-B9OtLlIc.cjs");
-const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
+const require_list_tools = require("../../list-tools-DDhzQZRL.cjs");
+const require_rest = require("../../rest-Hr1H57re.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
-function forwarded(request, options) {
-	return require_forwarded.applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
-}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -24,7 +21,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = require_list_tools.createListToolsHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -33,7 +30,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = require_rest.createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(forwarded(request, options), params.tool, require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -41,7 +38,7 @@ function createTanStackInvokeToolHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options));
 }
 //#endregion
 exports.createTanStackInvokeToolHandler = createTanStackInvokeToolHandler;

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-D3zzoTAG.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../../authorize-Y6Jm8GhR.js";
+import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,21 +1,18 @@
-import { l as createRecorderForRuntime } from "../../cors-D1m2Ud44.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DlbNiP7o.js";
+import { s as createRecorderForRuntime } from "../../authorize-KzrdWb2-.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Di8hVnwC.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-CTtFfDLi.js";
-import { t as createInvokeToolHandler } from "../../rest-BTK8v5-l.js";
-import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
+import { n as createListToolsHandler } from "../../list-tools-CCGzOMpC.js";
+import { t as createInvokeToolHandler } from "../../rest-DUQqIlzT.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
-function forwarded(request, options) {
-	return applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
-}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -23,7 +20,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = createListToolsHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -32,7 +29,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(forwarded(request, options), params.tool, createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(applyForwardedOrigin(request, options), params.tool, createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -40,7 +37,7 @@ function createTanStackInvokeToolHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options));
+	return ({ request }) => handler(applyForwardedOrigin(request, options));
 }
 //#endregion
 export { createTanStackInvokeToolHandler, createTanStackListToolsHandler, createTanStackMcpHandler, createTanStackOAuthProtectedResourceMetadataHandler };

package/dist/stacks/tanstack/vite.cjs

@@ -84,7 +84,10 @@ function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost,
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) {
+		optionEntries.push("trustForwardedHost: true");
+		if (route.attestsForwardedHost) optionEntries.push("forwardedHostTrustedByPlatform: true");
+	}
 	const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
 	return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
@@ -210,7 +213,8 @@ function mcpPlugin(options = {}) {
 			if (emitProtectedResourceMetadataRoute) routes.push({
 				file: metadataRouteFile,
 				routeLiteral: metadataUrlPath,
-				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
+				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler",
+				attestsForwardedHost: true
 			});
 			if (emitRestRoutes) routes.push({
 				file: listToolsRouteFile,

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-Bd58IeVb.cjs";
+import { t as McpPluginApi } from "../../io-BzTGjG_c.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-B-fV6rsM.js";
+import { t as McpPluginApi } from "../../io--MeYrWG7.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.js

@@ -80,7 +80,10 @@ function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost,
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) {
+		optionEntries.push("trustForwardedHost: true");
+		if (route.attestsForwardedHost) optionEntries.push("forwardedHostTrustedByPlatform: true");
+	}
 	const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
 	return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
@@ -206,7 +209,8 @@ function mcpPlugin(options = {}) {
 			if (emitProtectedResourceMetadataRoute) routes.push({
 				file: metadataRouteFile,
 				routeLiteral: metadataUrlPath,
-				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
+				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler",
+				attestsForwardedHost: true
 			});
 			if (emitRestRoutes) routes.push({
 				file: listToolsRouteFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.26.3",
+  "version": "0.27.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {