@lovable.dev/mcp-js 0.28.0 → 0.29.0-rc.0

package/dist/{rest-BE05MUNS.cjs → rest-P6XZWP42.cjs}

@@ -1,8 +1,8 @@
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_authorize = require("./authorize-ChY44o_1.cjs");
-const require_content = require("./content-NCYIGgOb.cjs");
-const require_gate = require("./gate-CGZl0gjJ.cjs");
-require("./list-tools-DCF6G4fn.cjs");
+const require_cors = require("./cors-CmKzDN7k.cjs");
+const require_tool_result = require("./tool-result-CK6hXO43.cjs");
+const require_gate = require("./gate-n_HX6eQ5.cjs");
+require("./list-tools-Dkyyje7j.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;
@@ -16,13 +16,13 @@ function isEmptyArgs(value) {
 	return Object.keys(value).length === 0;
 }
 function createInvokeToolHandler(mcp, options = {}) {
-	require_authorize.assertRestResourceBinding(mcp, options);
+	require_cors.assertRestResourceBinding(mcp, options);
 	const handle = async (request, authResult, recorder, toolName) => {
 		const endUserId = authResult.auth?.principal.sub;
 		const tool = mcp.tools.find((t) => t.name === toolName);
 		if (!tool) return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
 			status: 404,
-			headers: require_authorize.JSON_HEADERS
+			headers: require_cors.JSON_HEADERS
 		});
 		let rawArgs = {};
 		const text = await request.text();
@@ -31,7 +31,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 		} catch {
 			return new Response(JSON.stringify({ error: "invalid JSON body" }), {
 				status: 400,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
 		let args = rawArgs;
@@ -42,7 +42,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 				details: (0, _modelcontextprotocol_sdk_server_zod_compat_js.getParseErrorMessage)(parsed.error)
 			}), {
 				status: 400,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 			args = parsed.data;
 		} catch {
@@ -51,15 +51,15 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: toolName
 			}), {
 				status: 500,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
 		else if (!isEmptyArgs(rawArgs)) return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
 			status: 400,
-			headers: require_authorize.JSON_HEADERS
+			headers: require_cors.JSON_HEADERS
 		});
 		let result;
-		const start = require_authorize.nowMs();
+		const start = require_cors.nowMs();
 		try {
 			result = await tool.handler(args, new require_errors.ToolContext(authResult.auth));
 		} catch (err) {
@@ -69,16 +69,17 @@ function createInvokeToolHandler(mcp, options = {}) {
 					tool: tool.name,
 					method: "tools/call",
 					outcome: "handler_error",
-					durationMs: require_authorize.nowMs() - start,
+					durationMs: require_cors.nowMs() - start,
 					errorText: require_errors.errorSummary(err),
-					endUserId
+					endUserId,
+					protocol: "rest"
 				});
 				return new Response(JSON.stringify({
 					error: "handler threw",
 					tool: toolName
 				}), {
 					status: 500,
-					headers: require_authorize.JSON_HEADERS
+					headers: require_cors.JSON_HEADERS
 				});
 			}
 			result = {
@@ -94,32 +95,32 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: tool.name,
 				method: "tools/call",
 				outcome: "handler_error",
-				durationMs: require_authorize.nowMs() - start,
-				endUserId
+				durationMs: require_cors.nowMs() - start,
+				endUserId,
+				protocol: "rest"
 			});
 			return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
 				status: 500,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
+		result = await require_tool_result.finalizeToolResult(tool, result);
 		await recorder.emit({
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
-			durationMs: require_authorize.nowMs() - start,
-			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
-			endUserId
-		});
-		return Response.json({
-			content: result.content ?? [],
-			structuredContent: result.structuredContent,
-			isError: result.isError
+			durationMs: require_cors.nowMs() - start,
+			errorText: result.isError ? require_tool_result.extractTextContent(result.content) : void 0,
+			endUserId,
+			protocol: "rest"
 		});
+		return Response.json(result);
 	};
 	const gated = require_gate.createGatedHandler({
-		authorizer: require_authorize.createRequestAuthorizer(mcp, options),
+		authorizer: require_cors.createRequestAuthorizer(mcp, options),
+		allowedOrigins: mcp.allowedOrigins,
 		methods: ["POST"],
-		methodNotAllowed: require_authorize.methodNotAllowed,
+		methodNotAllowed: require_cors.methodNotAllowed,
 		handle
 	});
 	return (request, toolName, recorder) => gated(request, recorder, toolName);

package/dist/schema-CW1jKvio.js

@@ -0,0 +1,65 @@
+import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+//#region src/core/schema.ts
+function isZodSchema(definition) {
+	return (typeof definition === "object" || typeof definition === "function") && definition !== null && typeof definition.safeParse === "function";
+}
+function schemaFromDefinition(definition) {
+	return isZodSchema(definition) ? definition : objectFromShape(definition);
+}
+const NON_JSON_ZOD3_OUTPUTS = /* @__PURE__ */ new Set([
+	"ZodBigInt",
+	"ZodDate",
+	"ZodFunction",
+	"ZodMap",
+	"ZodNaN",
+	"ZodPromise",
+	"ZodSet",
+	"ZodSymbol",
+	"ZodUndefined",
+	"ZodVoid"
+]);
+function unsupportedZod3Output(schema, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(schema)) return void 0;
+	seen.add(schema);
+	const definition = schema._def;
+	if (!definition) return void 0;
+	if (definition.effect?.type === "transform") return "Transforms cannot be represented in JSON Schema";
+	const typeName = definition.typeName;
+	if (typeof typeName === "string" && NON_JSON_ZOD3_OUTPUTS.has(typeName)) return `${typeName} does not produce a JSON value`;
+	const shape = definition.shape;
+	if (typeof shape === "function") {
+		const fields = shape();
+		for (const field of Object.values(fields)) {
+			const issue = unsupportedZod3Output(field, seen);
+			if (issue) return issue;
+		}
+	}
+	const getter = definition.getter;
+	if (typeof getter === "function") {
+		const issue = unsupportedZod3Output(getter(), seen);
+		if (issue) return issue;
+	}
+	for (const value of Object.values(definition)) if (Array.isArray(value)) for (const entry of value) {
+		if (!isZodSchema(entry)) continue;
+		const issue = unsupportedZod3Output(entry, seen);
+		if (issue) return issue;
+	}
+	else if (value && typeof value === "object" && isZodSchema(value)) {
+		const issue = unsupportedZod3Output(value, seen);
+		if (issue) return issue;
+	}
+}
+function jsonSchemaFromDefinition(definition, pipeStrategy) {
+	const schema = schemaFromDefinition(definition);
+	if (pipeStrategy === "output") {
+		const issue = unsupportedZod3Output(schema);
+		if (issue) throw new Error(issue);
+	}
+	return toJsonSchemaCompat(schema, {
+		target: "draft-2020-12",
+		pipeStrategy
+	});
+}
+//#endregion
+export { schemaFromDefinition as n, jsonSchemaFromDefinition as t };

package/dist/schema-D3vClxb7.cjs

@@ -0,0 +1,76 @@
+let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+//#region src/core/schema.ts
+function isZodSchema(definition) {
+	return (typeof definition === "object" || typeof definition === "function") && definition !== null && typeof definition.safeParse === "function";
+}
+function schemaFromDefinition(definition) {
+	return isZodSchema(definition) ? definition : (0, _modelcontextprotocol_sdk_server_zod_compat_js.objectFromShape)(definition);
+}
+const NON_JSON_ZOD3_OUTPUTS = /* @__PURE__ */ new Set([
+	"ZodBigInt",
+	"ZodDate",
+	"ZodFunction",
+	"ZodMap",
+	"ZodNaN",
+	"ZodPromise",
+	"ZodSet",
+	"ZodSymbol",
+	"ZodUndefined",
+	"ZodVoid"
+]);
+function unsupportedZod3Output(schema, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(schema)) return void 0;
+	seen.add(schema);
+	const definition = schema._def;
+	if (!definition) return void 0;
+	if (definition.effect?.type === "transform") return "Transforms cannot be represented in JSON Schema";
+	const typeName = definition.typeName;
+	if (typeof typeName === "string" && NON_JSON_ZOD3_OUTPUTS.has(typeName)) return `${typeName} does not produce a JSON value`;
+	const shape = definition.shape;
+	if (typeof shape === "function") {
+		const fields = shape();
+		for (const field of Object.values(fields)) {
+			const issue = unsupportedZod3Output(field, seen);
+			if (issue) return issue;
+		}
+	}
+	const getter = definition.getter;
+	if (typeof getter === "function") {
+		const issue = unsupportedZod3Output(getter(), seen);
+		if (issue) return issue;
+	}
+	for (const value of Object.values(definition)) if (Array.isArray(value)) for (const entry of value) {
+		if (!isZodSchema(entry)) continue;
+		const issue = unsupportedZod3Output(entry, seen);
+		if (issue) return issue;
+	}
+	else if (value && typeof value === "object" && isZodSchema(value)) {
+		const issue = unsupportedZod3Output(value, seen);
+		if (issue) return issue;
+	}
+}
+function jsonSchemaFromDefinition(definition, pipeStrategy) {
+	const schema = schemaFromDefinition(definition);
+	if (pipeStrategy === "output") {
+		const issue = unsupportedZod3Output(schema);
+		if (issue) throw new Error(issue);
+	}
+	return (0, _modelcontextprotocol_sdk_server_zod_json_schema_compat_js.toJsonSchemaCompat)(schema, {
+		target: "draft-2020-12",
+		pipeStrategy
+	});
+}
+//#endregion
+Object.defineProperty(exports, "jsonSchemaFromDefinition", {
+	enumerable: true,
+	get: function() {
+		return jsonSchemaFromDefinition;
+	}
+});
+Object.defineProperty(exports, "schemaFromDefinition", {
+	enumerable: true,
+	get: function() {
+		return schemaFromDefinition;
+	}
+});

package/dist/stacks/supabase/index.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_authorize = require("../../authorize-ChY44o_1.cjs");
+const require_cors = require("../../cors-CmKzDN7k.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CUGwXkxb.cjs");
+const require_mcp = require("../../mcp-DQ1Vdv4v.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
-const require_rest = require("../../rest-BE05MUNS.cjs");
-const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
+const require_list_tools = require("../../list-tools-Dkyyje7j.cjs");
+const require_rest = require("../../rest-P6XZWP42.cjs");
+const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -50,7 +50,7 @@ function dispatchFor(pathname) {
 */
 function createSupabaseHandler(mcp, options = {}) {
 	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) require_authorize.assertResourcePathShape(resourcePath);
+	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
 	const runtimeOptions = {
@@ -67,7 +67,7 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
-		const recorder = require_authorize.createRecorderForRuntime(mcp, { stack: "supabase" });
+		const recorder = require_cors.createRecorderForRuntime(mcp, { stack: "supabase" });
 		const target = dispatchFor(new URL(req.url).pathname);
 		switch (target.kind) {
 			case "metadata": return metadataHandler(req);

package/dist/stacks/supabase/index.d.cts

@@ -1,4 +1,4 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.d.ts

@@ -1,4 +1,4 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.js

@@ -1,11 +1,11 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
+import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-D4YbODs-.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Cs4zfvSi.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
-import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
-import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
+import { n as createListToolsHandler } from "../../list-tools-ePP9tXND.js";
+import { t as createInvokeToolHandler } from "../../rest-DSclWpIt.js";
+import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-CGLPZwz-.cjs");
+const require_package = require("../../package-C3YVYgxp.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
+import { t as McpPluginApi } from "../../io-BEwvgN8s.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
+import { t as McpPluginApi } from "../../io-CvALf9NE.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-DgiA0xuY.js";
+import { t as version } from "../../package-DzB_5Hur.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_authorize = require("../../authorize-ChY44o_1.cjs");
-const require_mcp = require("../../mcp-CUGwXkxb.cjs");
+const require_cors = require("../../cors-CmKzDN7k.cjs");
+const require_mcp = require("../../mcp-DQ1Vdv4v.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
-const require_rest = require("../../rest-BE05MUNS.cjs");
-const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
+const require_list_tools = require("../../list-tools-Dkyyje7j.cjs");
+const require_rest = require("../../rest-P6XZWP42.cjs");
+const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**
@@ -13,7 +13,7 @@ const STACK = "tanstack";
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -21,7 +21,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = require_list_tools.createListToolsHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -30,7 +30,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = require_rest.createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BzZFS0zi.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
+import { t as McpRuntimeOptions } from "../../authorize-BjNE3LPr.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,9 +1,9 @@
-import { s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
+import { c as createRecorderForRuntime } from "../../cors-D4YbODs-.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Cs4zfvSi.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
-import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
-import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
+import { n as createListToolsHandler } from "../../list-tools-ePP9tXND.js";
+import { t as createInvokeToolHandler } from "../../rest-DSclWpIt.js";
+import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**

package/dist/stacks/tanstack/vite.cjs

@@ -79,14 +79,17 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath((0, node_path.relative)((0, node_path.dirname)(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath((0, node_path.relative)(projectRoot, route.file));
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
-	else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) {
+		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
+		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
+	} else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -193,6 +196,7 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
+	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = (0, node_path.resolve)(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile, listToolsLiteral, invokeToolLiteral } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
@@ -230,7 +234,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
+import { t as McpPluginApi } from "../../io-BEwvgN8s.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -77,6 +77,16 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
+  /**
+   * Derive the public scheme of same-origin CORS checks and advertised OAuth
+   * URLs from `X-Forwarded-Proto`. Lovable's preview proxy terminates TLS and
+   * forwards plain http to the dev server while overwriting
+   * `X-Forwarded-Proto`, so the default is `true` to keep same-origin browser
+   * requests and advertised `https` URLs working in previews. Set `false` only
+   * when deploying behind a proxy that does not overwrite the header.
+   * @default true
+   */
+  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
+import { t as McpPluginApi } from "../../io-CvALf9NE.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -77,6 +77,16 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
+  /**
+   * Derive the public scheme of same-origin CORS checks and advertised OAuth
+   * URLs from `X-Forwarded-Proto`. Lovable's preview proxy terminates TLS and
+   * forwards plain http to the dev server while overwriting
+   * `X-Forwarded-Proto`, so the default is `true` to keep same-origin browser
+   * requests and advertised `https` URLs working in previews. Set `false` only
+   * when deploying behind a proxy that does not overwrite the header.
+   * @default true
+   */
+  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.js

@@ -75,14 +75,17 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath(relative(dirname(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath(relative(projectRoot, route.file));
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
-	else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) {
+		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
+		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
+	} else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -189,6 +192,7 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
+	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = resolve(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile, listToolsLiteral, invokeToolLiteral } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
@@ -226,7 +230,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {