@lovable.dev/mcp-js 0.26.3 → 0.27.1

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-Cr1oDeFn.js";
+import { t as version } from "../../package-dtiombMt.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,22 +1,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-CzTj3-nh.cjs");
-const require_mcp = require("../../mcp-CG_9H8CN.cjs");
+const require_authorize = require("../../authorize-CB35c3Wg.cjs");
+const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-wQ13O3WE.cjs");
-const require_rest = require("../../rest-B9OtLlIc.cjs");
-const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
+const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
+const require_rest = require("../../rest-1Pf9sYNU.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
-function forwarded(request, options) {
-	return require_forwarded.applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
-}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -24,7 +21,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = require_list_tools.createListToolsHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -33,7 +30,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = require_rest.createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(forwarded(request, options), params.tool, require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -41,7 +38,7 @@ function createTanStackInvokeToolHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options));
 }
 //#endregion
 exports.createTanStackInvokeToolHandler = createTanStackInvokeToolHandler;

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-D3zzoTAG.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../../authorize-Y6Jm8GhR.js";
+import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,21 +1,18 @@
-import { l as createRecorderForRuntime } from "../../cors-D1m2Ud44.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DlbNiP7o.js";
+import { s as createRecorderForRuntime } from "../../authorize-FOlzhxrM.js";
+import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-CTtFfDLi.js";
-import { t as createInvokeToolHandler } from "../../rest-BTK8v5-l.js";
-import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
+import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
+import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
-function forwarded(request, options) {
-	return applyForwardedOrigin(request, { trustForwardedHost: options.trustForwardedHost });
-}
 /**
 * Build a TanStack Start handler for the MCP protocol endpoint
 * (`POST /mcp`). Assignable directly to a route's `ANY` handler.
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -23,7 +20,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = createListToolsHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -32,7 +29,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(forwarded(request, options), params.tool, createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(applyForwardedOrigin(request, options), params.tool, createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -40,7 +37,7 @@ function createTanStackInvokeToolHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(forwarded(request, options));
+	return ({ request }) => handler(applyForwardedOrigin(request, options));
 }
 //#endregion
 export { createTanStackInvokeToolHandler, createTanStackListToolsHandler, createTanStackMcpHandler, createTanStackOAuthProtectedResourceMetadataHandler };

package/dist/stacks/tanstack/vite.cjs

@@ -11,6 +11,7 @@ let vite = require("vite");
 //#region src/stacks/tanstack/vite.ts
 const SUPABASE_PROJECT_REF_ENV = "VITE_SUPABASE_PROJECT_ID";
 const GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js — do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
+const OXFMT_PRINT_WIDTH = 120;
 function normalizePath(p) {
 	return p.split(node_path.sep).join("/");
 }
@@ -84,8 +85,11 @@ function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost,
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) optionEntries.push("trustForwardedHost: true");
-	const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
+	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
+	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
+	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
 	return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -96,10 +100,10 @@ import { ${route.handlerFactory} } from "@lovable.dev/mcp-js/stacks/tanstack";
 
 import mcp from "${mcpImport}";
 
-export const Route = createFileRoute("${route.routeLiteral}")({
+${routeOpen}
   server: {
     handlers: {
-${note}      ANY: ${route.handlerFactory}(mcp, ${runtimeOptions}),
+${note}      ANY: ${route.handlerFactory}(mcp, ${optionsObject}),
     },
   },
 });
@@ -210,7 +214,8 @@ function mcpPlugin(options = {}) {
 			if (emitProtectedResourceMetadataRoute) routes.push({
 				file: metadataRouteFile,
 				routeLiteral: metadataUrlPath,
-				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
+				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler",
+				attestsForwardedHost: true
 			});
 			if (emitRestRoutes) routes.push({
 				file: listToolsRouteFile,

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-Bd58IeVb.cjs";
+import { t as McpPluginApi } from "../../io-BzTGjG_c.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-B-fV6rsM.js";
+import { t as McpPluginApi } from "../../io--MeYrWG7.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.js

@@ -7,6 +7,7 @@ import { loadEnv } from "vite";
 //#region src/stacks/tanstack/vite.ts
 const SUPABASE_PROJECT_REF_ENV = "VITE_SUPABASE_PROJECT_ID";
 const GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js — do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
+const OXFMT_PRINT_WIDTH = 120;
 function normalizePath(p) {
 	return p.split(sep).join("/");
 }
@@ -80,8 +81,11 @@ function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost,
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) optionEntries.push("trustForwardedHost: true");
-	const runtimeOptions = `{ ${optionEntries.join(", ")} }`;
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
+	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
+	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
+	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
 	return `${GENERATED_BANNER}
 // route: ${route.routeLiteral}
 // emitted to: ${routeRel}
@@ -92,10 +96,10 @@ import { ${route.handlerFactory} } from "@lovable.dev/mcp-js/stacks/tanstack";
 
 import mcp from "${mcpImport}";
 
-export const Route = createFileRoute("${route.routeLiteral}")({
+${routeOpen}
   server: {
     handlers: {
-${note}      ANY: ${route.handlerFactory}(mcp, ${runtimeOptions}),
+${note}      ANY: ${route.handlerFactory}(mcp, ${optionsObject}),
     },
   },
 });
@@ -206,7 +210,8 @@ function mcpPlugin(options = {}) {
 			if (emitProtectedResourceMetadataRoute) routes.push({
 				file: metadataRouteFile,
 				routeLiteral: metadataUrlPath,
-				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler"
+				handlerFactory: "createTanStackOAuthProtectedResourceMetadataHandler",
+				attestsForwardedHost: true
 			});
 			if (emitRestRoutes) routes.push({
 				file: listToolsRouteFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.26.3",
+  "version": "0.27.1",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {