@lovable.dev/mcp-js 0.26.3 → 0.27.1

package/dist/{mcp-CG_9H8CN.cjs → mcp-ECo1Ixk8.cjs}

@@ -1,12 +1,12 @@
-const require_logger = require("./logger-BSKbuM66.cjs");
+const require_logger = require("./logger-BkMMCFTv.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_cors = require("./cors-CzTj3-nh.cjs");
+const require_authorize = require("./authorize-CB35c3Wg.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
+const require_gate = require("./gate-B9RSzvoI.cjs");
 let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
 //#region src/protocols/mcp/protocol.ts
-const STATELESS_ALLOW_METHODS = "POST, OPTIONS";
-function statelessMethodNotAllowed() {
+function statelessMethodNotAllowed(allow) {
 	return Response.json({
 		jsonrpc: "2.0",
 		id: null,
@@ -16,10 +16,7 @@ function statelessMethodNotAllowed() {
 		}
 	}, {
 		status: 405,
-		headers: {
-			Allow: STATELESS_ALLOW_METHODS,
-			"Cache-Control": "no-store"
-		}
+		headers: { Allow: allow }
 	});
 }
 /**
@@ -30,7 +27,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 	const endUserId = auth?.principal.sub;
 	return (async (first) => {
 		const args = tool.inputSchema ? first ?? {} : {};
-		const start = require_cors.nowMs();
+		const start = require_authorize.nowMs();
 		let result;
 		try {
 			result = await tool.handler(args, new require_errors.ToolContext(auth));
@@ -41,7 +38,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 					tool: tool.name,
 					method: "tools/call",
 					outcome: "handler_error",
-					durationMs: require_cors.nowMs() - start,
+					durationMs: require_authorize.nowMs() - start,
 					errorText: require_errors.errorSummary(err),
 					endUserId
 				});
@@ -66,7 +63,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 				tool: tool.name,
 				method: "tools/call",
 				outcome: "handler_error",
-				durationMs: require_cors.nowMs() - start,
+				durationMs: require_authorize.nowMs() - start,
 				endUserId
 			});
 			return {
@@ -81,7 +78,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
-			durationMs: require_cors.nowMs() - start,
+			durationMs: require_authorize.nowMs() - start,
 			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
 			endUserId
 		});
@@ -100,7 +97,7 @@ function adaptToolToSdkCallback(tool, auth, recorder) {
 * caller (the stack handler) so telemetry reads the runtime env in-flight.
 */
 function createMcpProtocolHandler(mcp, options = {}) {
-	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
+	const authorizer = require_authorize.createRequestAuthorizer(mcp, options);
 	const handle = async (request, authResult, recorder) => {
 		try {
 			const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
@@ -140,13 +137,12 @@ function createMcpProtocolHandler(mcp, options = {}) {
 			}, { status: 500 });
 		}
 	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse(STATELESS_ALLOW_METHODS);
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return require_cors.withCors(authResult.response);
-		if (request.method !== "POST") return require_cors.withCors(statelessMethodNotAllowed());
-		return require_cors.withCors(await handle(request, authResult, recorder));
-	};
+	return require_gate.createGatedHandler({
+		authorizer,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
 }
 //#endregion
 Object.defineProperty(exports, "createMcpProtocolHandler", {

package/dist/{package-oSicfX7m.cjs → package-BdaLbzEh.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.26.3";
+var version = "0.27.1";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/{package-Cr1oDeFn.js → package-dtiombMt.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.26.3";
+var version = "0.27.1";
 //#endregion
 export { version as t };

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-CG_9H8CN.cjs");
+const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
 import { t as MetricsRecorder } from "../../base-CReh7d3E.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-D3zzoTAG.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
 import { t as MetricsRecorder } from "../../base-CReh7d3E.js";
-import { t as McpRuntimeOptions } from "../../authorize-Y6Jm8GhR.js";
+import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-DlbNiP7o.js";
+import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,20 +1,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("../logger-BSKbuM66.cjs");
-const require_cors = require("../cors-CzTj3-nh.cjs");
+const require_logger = require("../logger-BkMMCFTv.cjs");
+const require_authorize = require("../authorize-CB35c3Wg.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
-	return require_cors.withCors(new Response(JSON.stringify({ error: "not found" }), {
+	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
-	}));
+	});
 }
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
 	const body = {
-		resource: require_cors.resolveProtectedResource(auth, request, options),
+		resource: require_authorize.resolveProtectedResource(auth, request, options),
 		authorization_servers: [issuer],
 		bearer_methods_supported: ["header"],
 		resource_name: auth.resourceName ?? mcp.title,
@@ -24,30 +24,38 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 	return body;
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-	const runtime = require_cors.getOAuthRuntime(mcp, options);
-	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0 && runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
-	return async (request) => {
+	const runtime = require_authorize.getOAuthRuntime(mcp, options);
+	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
+		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
+		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) require_logger.log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
+	}
+	const varyHeaders = ["Host"];
+	if (runtime.options.trustForwardedHost === true) varyHeaders.push("X-Forwarded-Host");
+	if (runtime.options.trustForwardedProto === true) varyHeaders.push("X-Forwarded-Proto");
+	const vary = varyHeaders.join(", ");
+	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse("GET, HEAD, OPTIONS");
-		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.withCors(require_cors.methodNotAllowed("GET, HEAD, OPTIONS"));
+		if (request.method !== "GET" && request.method !== "HEAD") return require_authorize.methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
-			Vary: "Host"
+			Vary: vary
 		};
 		try {
 			const metadata = await buildProtectedResourceMetadata(mcp, runtime.auth, request, runtime.options, runtime.discovery);
-			const response = require_cors.withCors(Response.json(metadata, { headers }));
-			return request.method === "HEAD" ? require_cors.headResponse(response) : response;
+			return Response.json(metadata, { headers });
 		} catch (err) {
 			require_logger.log.error("oauth.metadata.config_error", {
 				...require_logger.describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			const response = require_cors.withCors(require_cors.oauthConfigurationErrorResponse());
-			return request.method === "HEAD" ? require_cors.headResponse(response) : response;
+			return require_authorize.oauthConfigurationErrorResponse();
 		}
 	};
+	return async (request) => {
+		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse("GET, HEAD, OPTIONS");
+		return require_authorize.finalizeWireResponse(request, await respond(request));
+	};
 }
 //#endregion
 exports.createOAuthProtectedResourceMetadataHandler = createOAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.cts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../authorize-D3zzoTAG.cjs";
+import { t as McpRuntimeOptions } from "../authorize-BcNuNPtP.cjs";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.ts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../authorize-Y6Jm8GhR.js";
+import { t as McpRuntimeOptions } from "../authorize-Cs1yyLrq.js";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.js

@@ -1,14 +1,14 @@
-import { i as log, r as describeError } from "../logger-3-kwsF-5.js";
-import { a as getOAuthRuntime, c as resolveProtectedResource, f as JSON_HEADERS, m as methodNotAllowed, n as withCors, o as oauthConfigurationErrorResponse, p as headResponse, t as corsPreflightResponse } from "../cors-D1m2Ud44.js";
+import { i as log, r as describeError } from "../logger-rGakBvJ1.js";
+import { d as finalizeWireResponse, f as methodNotAllowed, i as oauthConfigurationErrorResponse, o as resolveProtectedResource, p as corsPreflightResponse, r as getOAuthRuntime, u as JSON_HEADERS } from "../authorize-FOlzhxrM.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
-	return withCors(new Response(JSON.stringify({ error: "not found" }), {
+	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
 			...JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
-	}));
+	});
 }
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
@@ -24,29 +24,37 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const runtime = getOAuthRuntime(mcp, options);
-	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0 && runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
-	return async (request) => {
+	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
+		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
+		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
+	}
+	const varyHeaders = ["Host"];
+	if (runtime.options.trustForwardedHost === true) varyHeaders.push("X-Forwarded-Host");
+	if (runtime.options.trustForwardedProto === true) varyHeaders.push("X-Forwarded-Proto");
+	const vary = varyHeaders.join(", ");
+	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
-		if (request.method !== "GET" && request.method !== "HEAD") return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
+		if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
 			...JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
-			Vary: "Host"
+			Vary: vary
 		};
 		try {
 			const metadata = await buildProtectedResourceMetadata(mcp, runtime.auth, request, runtime.options, runtime.discovery);
-			const response = withCors(Response.json(metadata, { headers }));
-			return request.method === "HEAD" ? headResponse(response) : response;
+			return Response.json(metadata, { headers });
 		} catch (err) {
 			log.error("oauth.metadata.config_error", {
 				...describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			const response = withCors(oauthConfigurationErrorResponse());
-			return request.method === "HEAD" ? headResponse(response) : response;
+			return oauthConfigurationErrorResponse();
 		}
 	};
+	return async (request) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
+		return finalizeWireResponse(request, await respond(request));
+	};
 }
 //#endregion
 export { createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/rest/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_list_tools = require("../../list-tools-wQ13O3WE.cjs");
-const require_rest = require("../../rest-B9OtLlIc.cjs");
+const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
+const require_rest = require("../../rest-1Pf9sYNU.cjs");
 exports.createInvokeToolHandler = require_rest.createInvokeToolHandler;
 exports.createListToolsHandler = require_list_tools.createListToolsHandler;

package/dist/protocols/rest/index.d.cts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
 import { t as MetricsRecorder } from "../../base-CReh7d3E.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-D3zzoTAG.cjs";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-DOBMd4AE.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-Cn7tpE0V.cjs";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.d.ts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
 import { t as MetricsRecorder } from "../../base-CReh7d3E.js";
-import { t as McpRuntimeOptions } from "../../authorize-Y6Jm8GhR.js";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-C6u8G4iq.js";
+import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-Bku6XkVc.js";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.js

@@ -1,3 +1,3 @@
-import { n as createListToolsHandler } from "../../list-tools-CTtFfDLi.js";
-import { t as createInvokeToolHandler } from "../../rest-BTK8v5-l.js";
+import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
+import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
 export { createInvokeToolHandler, createListToolsHandler };

package/dist/{rest-B9OtLlIc.cjs → rest-1Pf9sYNU.cjs}

@@ -1,7 +1,8 @@
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_cors = require("./cors-CzTj3-nh.cjs");
+const require_authorize = require("./authorize-CB35c3Wg.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
-require("./list-tools-wQ13O3WE.cjs");
+const require_gate = require("./gate-B9RSzvoI.cjs");
+require("./list-tools-DiMCRunS.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;
@@ -15,17 +16,13 @@ function isEmptyArgs(value) {
 	return Object.keys(value).length === 0;
 }
 function createInvokeToolHandler(mcp, options = {}) {
-	require_cors.assertRestResourceBinding(mcp, options);
-	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
-	const handle = async (request, toolName, recorder) => {
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
+	require_authorize.assertRestResourceBinding(mcp, options);
+	const handle = async (request, authResult, recorder, toolName) => {
 		const endUserId = authResult.auth?.principal.sub;
-		if (request.method !== "POST") return require_cors.methodNotAllowed("POST, OPTIONS");
 		const tool = mcp.tools.find((t) => t.name === toolName);
 		if (!tool) return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
 			status: 404,
-			headers: require_cors.JSON_HEADERS
+			headers: require_authorize.JSON_HEADERS
 		});
 		let rawArgs = {};
 		const text = await request.text();
@@ -34,7 +31,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 		} catch {
 			return new Response(JSON.stringify({ error: "invalid JSON body" }), {
 				status: 400,
-				headers: require_cors.JSON_HEADERS
+				headers: require_authorize.JSON_HEADERS
 			});
 		}
 		let args = rawArgs;
@@ -45,7 +42,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 				details: (0, _modelcontextprotocol_sdk_server_zod_compat_js.getParseErrorMessage)(parsed.error)
 			}), {
 				status: 400,
-				headers: require_cors.JSON_HEADERS
+				headers: require_authorize.JSON_HEADERS
 			});
 			args = parsed.data;
 		} catch {
@@ -54,15 +51,15 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: toolName
 			}), {
 				status: 500,
-				headers: require_cors.JSON_HEADERS
+				headers: require_authorize.JSON_HEADERS
 			});
 		}
 		else if (!isEmptyArgs(rawArgs)) return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
 			status: 400,
-			headers: require_cors.JSON_HEADERS
+			headers: require_authorize.JSON_HEADERS
 		});
 		let result;
-		const start = require_cors.nowMs();
+		const start = require_authorize.nowMs();
 		try {
 			result = await tool.handler(args, new require_errors.ToolContext(authResult.auth));
 		} catch (err) {
@@ -72,7 +69,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 					tool: tool.name,
 					method: "tools/call",
 					outcome: "handler_error",
-					durationMs: require_cors.nowMs() - start,
+					durationMs: require_authorize.nowMs() - start,
 					errorText: require_errors.errorSummary(err),
 					endUserId
 				});
@@ -81,7 +78,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 					tool: toolName
 				}), {
 					status: 500,
-					headers: require_cors.JSON_HEADERS
+					headers: require_authorize.JSON_HEADERS
 				});
 			}
 			result = {
@@ -97,19 +94,19 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: tool.name,
 				method: "tools/call",
 				outcome: "handler_error",
-				durationMs: require_cors.nowMs() - start,
+				durationMs: require_authorize.nowMs() - start,
 				endUserId
 			});
 			return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
 				status: 500,
-				headers: require_cors.JSON_HEADERS
+				headers: require_authorize.JSON_HEADERS
 			});
 		}
 		await recorder.emit({
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
-			durationMs: require_cors.nowMs() - start,
+			durationMs: require_authorize.nowMs() - start,
 			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
 			endUserId
 		});
@@ -119,10 +116,13 @@ function createInvokeToolHandler(mcp, options = {}) {
 			isError: result.isError
 		});
 	};
-	return async (request, toolName, recorder = require_cors.createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse("POST, OPTIONS");
-		return require_cors.withCors(await handle(request, toolName, recorder));
-	};
+	const gated = require_gate.createGatedHandler({
+		authorizer: require_authorize.createRequestAuthorizer(mcp, options),
+		methods: ["POST"],
+		methodNotAllowed: require_authorize.methodNotAllowed,
+		handle
+	});
+	return (request, toolName, recorder) => gated(request, recorder, toolName);
 }
 //#endregion
 Object.defineProperty(exports, "createInvokeToolHandler", {

package/dist/{rest-BTK8v5-l.js → rest-Cit2862S.js}

@@ -1,7 +1,8 @@
 import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
-import { d as nowMs, f as JSON_HEADERS, i as createRequestAuthorizer, m as methodNotAllowed, n as withCors, r as assertRestResourceBinding, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-D1m2Ud44.js";
+import { f as methodNotAllowed, l as nowMs, n as createRequestAuthorizer, t as assertRestResourceBinding, u as JSON_HEADERS } from "./authorize-FOlzhxrM.js";
 import { t as extractTextContent } from "./content-D5LJAHyM.js";
-import "./list-tools-CTtFfDLi.js";
+import { t as createGatedHandler } from "./gate-BeHmyGxk.js";
+import "./list-tools-Dt-mhh52.js";
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;
@@ -16,12 +17,8 @@ function isEmptyArgs(value) {
 }
 function createInvokeToolHandler(mcp, options = {}) {
 	assertRestResourceBinding(mcp, options);
-	const authorizer = createRequestAuthorizer(mcp, options);
-	const handle = async (request, toolName, recorder) => {
-		const authResult = await authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
+	const handle = async (request, authResult, recorder, toolName) => {
 		const endUserId = authResult.auth?.principal.sub;
-		if (request.method !== "POST") return methodNotAllowed("POST, OPTIONS");
 		const tool = mcp.tools.find((t) => t.name === toolName);
 		if (!tool) return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
 			status: 404,
@@ -119,10 +116,13 @@ function createInvokeToolHandler(mcp, options = {}) {
 			isError: result.isError
 		});
 	};
-	return async (request, toolName, recorder = createNoopRecorder()) => {
-		if (request.method === "OPTIONS") return corsPreflightResponse("POST, OPTIONS");
-		return withCors(await handle(request, toolName, recorder));
-	};
+	const gated = createGatedHandler({
+		authorizer: createRequestAuthorizer(mcp, options),
+		methods: ["POST"],
+		methodNotAllowed,
+		handle
+	});
+	return (request, toolName, recorder) => gated(request, recorder, toolName);
 }
 //#endregion
 export { createInvokeToolHandler as t };

package/dist/stacks/supabase/index.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("../../logger-BSKbuM66.cjs");
-const require_cors = require("../../cors-CzTj3-nh.cjs");
+const require_logger = require("../../logger-BkMMCFTv.cjs");
+const require_authorize = require("../../authorize-CB35c3Wg.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CG_9H8CN.cjs");
+const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-wQ13O3WE.cjs");
-const require_rest = require("../../rest-B9OtLlIc.cjs");
-const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
+const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
+const require_rest = require("../../rest-1Pf9sYNU.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -50,23 +50,24 @@ function dispatchFor(pathname) {
 */
 function createSupabaseHandler(mcp, options = {}) {
 	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
+	if (resourcePath !== void 0) require_authorize.assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
-	const runtimeOptions = resourcePath === void 0 ? {} : {
-		resourcePath,
-		...metadataPath ? { metadataPath } : {}
+	const runtimeOptions = {
+		...resourcePath === void 0 ? {} : {
+			resourcePath,
+			...metadataPath ? { metadataPath } : {}
+		},
+		...options.trustForwardedHost === true ? { trustForwardedHost: true } : {},
+		trustForwardedProto: true
 	};
 	const mcpHandler = require_mcp.createMcpProtocolHandler(mcp, runtimeOptions);
 	const listToolsHandler = require_list_tools.createListToolsHandler(mcp, runtimeOptions);
 	const invokeToolHandler = require_rest.createInvokeToolHandler(mcp, runtimeOptions);
 	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
-		const req = require_forwarded.applyForwardedOrigin(request, {
-			trustForwardedProto: true,
-			trustForwardedHost: options.trustForwardedHost
-		});
-		const recorder = require_cors.createRecorderForRuntime(mcp, { stack: "supabase" });
+		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
+		const recorder = require_authorize.createRecorderForRuntime(mcp, { stack: "supabase" });
 		const target = dispatchFor(new URL(req.url).pathname);
 		switch (target.kind) {
 			case "metadata": return metadataHandler(req);

package/dist/stacks/supabase/index.js

@@ -1,11 +1,11 @@
-import { s as trimTrailingSlash } from "../../logger-3-kwsF-5.js";
-import { l as createRecorderForRuntime, s as assertResourcePathShape } from "../../cors-D1m2Ud44.js";
+import { s as trimTrailingSlash } from "../../logger-rGakBvJ1.js";
+import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../authorize-FOlzhxrM.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DlbNiP7o.js";
+import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-CTtFfDLi.js";
-import { t as createInvokeToolHandler } from "../../rest-BTK8v5-l.js";
-import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
+import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
+import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -52,19 +52,20 @@ function createSupabaseHandler(mcp, options = {}) {
 	if (resourcePath !== void 0) assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
-	const runtimeOptions = resourcePath === void 0 ? {} : {
-		resourcePath,
-		...metadataPath ? { metadataPath } : {}
+	const runtimeOptions = {
+		...resourcePath === void 0 ? {} : {
+			resourcePath,
+			...metadataPath ? { metadataPath } : {}
+		},
+		...options.trustForwardedHost === true ? { trustForwardedHost: true } : {},
+		trustForwardedProto: true
 	};
 	const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
 	const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
 	const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
 	const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
-		const req = applyForwardedOrigin(request, {
-			trustForwardedProto: true,
-			trustForwardedHost: options.trustForwardedHost
-		});
+		const req = applyForwardedOrigin(request, runtimeOptions);
 		const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
 		const target = dispatchFor(new URL(req.url).pathname);
 		switch (target.kind) {

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-oSicfX7m.cjs");
+const require_package = require("../../package-BdaLbzEh.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-Bd58IeVb.cjs";
+import { t as McpPluginApi } from "../../io-BzTGjG_c.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-B-fV6rsM.js";
+import { t as McpPluginApi } from "../../io--MeYrWG7.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {