@lovable.dev/mcp-js 0.28.0 → 0.29.0-rc.1

package/dist/{rest-BS7bBOd9.js → rest-Cr7NhxL3.js}

@@ -1,8 +1,8 @@
 import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
-import { f as methodNotAllowed, l as nowMs, n as createRequestAuthorizer, t as assertRestResourceBinding, u as JSON_HEADERS } from "./authorize--rUeMOGU.js";
-import { t as extractTextContent } from "./content-D5LJAHyM.js";
-import { t as createGatedHandler } from "./gate-BiM6EBeA.js";
-import "./list-tools-BLGr7mot.js";
+import { d as JSON_HEADERS, n as assertRestResourceBinding, p as methodNotAllowed, r as createRequestAuthorizer, u as nowMs } from "./cors-BDTQQJE2.js";
+import { n as extractTextContent, t as finalizeToolResult } from "./tool-result-DfCk445b.js";
+import { t as createGatedHandler } from "./gate-uCVrbDBb.js";
+import "./list-tools-C1OiTDR9.js";
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;
@@ -71,7 +71,8 @@ function createInvokeToolHandler(mcp, options = {}) {
 					outcome: "handler_error",
 					durationMs: nowMs() - start,
 					errorText: errorSummary(err),
-					endUserId
+					endUserId,
+					protocol: "rest"
 				});
 				return new Response(JSON.stringify({
 					error: "handler threw",
@@ -95,29 +96,29 @@ function createInvokeToolHandler(mcp, options = {}) {
 				method: "tools/call",
 				outcome: "handler_error",
 				durationMs: nowMs() - start,
-				endUserId
+				endUserId,
+				protocol: "rest"
 			});
 			return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
 				status: 500,
 				headers: JSON_HEADERS
 			});
 		}
+		result = await finalizeToolResult(tool, result);
 		await recorder.emit({
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
 			durationMs: nowMs() - start,
 			errorText: result.isError ? extractTextContent(result.content) : void 0,
-			endUserId
-		});
-		return Response.json({
-			content: result.content ?? [],
-			structuredContent: result.structuredContent,
-			isError: result.isError
+			endUserId,
+			protocol: "rest"
 		});
+		return Response.json(result);
 	};
 	const gated = createGatedHandler({
 		authorizer: createRequestAuthorizer(mcp, options),
+		allowedOrigins: mcp.allowedOrigins,
 		methods: ["POST"],
 		methodNotAllowed,
 		handle

package/dist/schema-CW1jKvio.js

@@ -0,0 +1,65 @@
+import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+//#region src/core/schema.ts
+function isZodSchema(definition) {
+	return (typeof definition === "object" || typeof definition === "function") && definition !== null && typeof definition.safeParse === "function";
+}
+function schemaFromDefinition(definition) {
+	return isZodSchema(definition) ? definition : objectFromShape(definition);
+}
+const NON_JSON_ZOD3_OUTPUTS = /* @__PURE__ */ new Set([
+	"ZodBigInt",
+	"ZodDate",
+	"ZodFunction",
+	"ZodMap",
+	"ZodNaN",
+	"ZodPromise",
+	"ZodSet",
+	"ZodSymbol",
+	"ZodUndefined",
+	"ZodVoid"
+]);
+function unsupportedZod3Output(schema, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(schema)) return void 0;
+	seen.add(schema);
+	const definition = schema._def;
+	if (!definition) return void 0;
+	if (definition.effect?.type === "transform") return "Transforms cannot be represented in JSON Schema";
+	const typeName = definition.typeName;
+	if (typeof typeName === "string" && NON_JSON_ZOD3_OUTPUTS.has(typeName)) return `${typeName} does not produce a JSON value`;
+	const shape = definition.shape;
+	if (typeof shape === "function") {
+		const fields = shape();
+		for (const field of Object.values(fields)) {
+			const issue = unsupportedZod3Output(field, seen);
+			if (issue) return issue;
+		}
+	}
+	const getter = definition.getter;
+	if (typeof getter === "function") {
+		const issue = unsupportedZod3Output(getter(), seen);
+		if (issue) return issue;
+	}
+	for (const value of Object.values(definition)) if (Array.isArray(value)) for (const entry of value) {
+		if (!isZodSchema(entry)) continue;
+		const issue = unsupportedZod3Output(entry, seen);
+		if (issue) return issue;
+	}
+	else if (value && typeof value === "object" && isZodSchema(value)) {
+		const issue = unsupportedZod3Output(value, seen);
+		if (issue) return issue;
+	}
+}
+function jsonSchemaFromDefinition(definition, pipeStrategy) {
+	const schema = schemaFromDefinition(definition);
+	if (pipeStrategy === "output") {
+		const issue = unsupportedZod3Output(schema);
+		if (issue) throw new Error(issue);
+	}
+	return toJsonSchemaCompat(schema, {
+		target: "draft-2020-12",
+		pipeStrategy
+	});
+}
+//#endregion
+export { schemaFromDefinition as n, jsonSchemaFromDefinition as t };

package/dist/schema-D3vClxb7.cjs

@@ -0,0 +1,76 @@
+let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+//#region src/core/schema.ts
+function isZodSchema(definition) {
+	return (typeof definition === "object" || typeof definition === "function") && definition !== null && typeof definition.safeParse === "function";
+}
+function schemaFromDefinition(definition) {
+	return isZodSchema(definition) ? definition : (0, _modelcontextprotocol_sdk_server_zod_compat_js.objectFromShape)(definition);
+}
+const NON_JSON_ZOD3_OUTPUTS = /* @__PURE__ */ new Set([
+	"ZodBigInt",
+	"ZodDate",
+	"ZodFunction",
+	"ZodMap",
+	"ZodNaN",
+	"ZodPromise",
+	"ZodSet",
+	"ZodSymbol",
+	"ZodUndefined",
+	"ZodVoid"
+]);
+function unsupportedZod3Output(schema, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(schema)) return void 0;
+	seen.add(schema);
+	const definition = schema._def;
+	if (!definition) return void 0;
+	if (definition.effect?.type === "transform") return "Transforms cannot be represented in JSON Schema";
+	const typeName = definition.typeName;
+	if (typeof typeName === "string" && NON_JSON_ZOD3_OUTPUTS.has(typeName)) return `${typeName} does not produce a JSON value`;
+	const shape = definition.shape;
+	if (typeof shape === "function") {
+		const fields = shape();
+		for (const field of Object.values(fields)) {
+			const issue = unsupportedZod3Output(field, seen);
+			if (issue) return issue;
+		}
+	}
+	const getter = definition.getter;
+	if (typeof getter === "function") {
+		const issue = unsupportedZod3Output(getter(), seen);
+		if (issue) return issue;
+	}
+	for (const value of Object.values(definition)) if (Array.isArray(value)) for (const entry of value) {
+		if (!isZodSchema(entry)) continue;
+		const issue = unsupportedZod3Output(entry, seen);
+		if (issue) return issue;
+	}
+	else if (value && typeof value === "object" && isZodSchema(value)) {
+		const issue = unsupportedZod3Output(value, seen);
+		if (issue) return issue;
+	}
+}
+function jsonSchemaFromDefinition(definition, pipeStrategy) {
+	const schema = schemaFromDefinition(definition);
+	if (pipeStrategy === "output") {
+		const issue = unsupportedZod3Output(schema);
+		if (issue) throw new Error(issue);
+	}
+	return (0, _modelcontextprotocol_sdk_server_zod_json_schema_compat_js.toJsonSchemaCompat)(schema, {
+		target: "draft-2020-12",
+		pipeStrategy
+	});
+}
+//#endregion
+Object.defineProperty(exports, "jsonSchemaFromDefinition", {
+	enumerable: true,
+	get: function() {
+		return jsonSchemaFromDefinition;
+	}
+});
+Object.defineProperty(exports, "schemaFromDefinition", {
+	enumerable: true,
+	get: function() {
+		return schemaFromDefinition;
+	}
+});

package/dist/stacks/supabase/index.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_authorize = require("../../authorize-ChY44o_1.cjs");
+const require_cors = require("../../cors-BRv5KXKQ.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-CUGwXkxb.cjs");
+const require_mcp = require("../../mcp-C9B7o75m.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
-const require_rest = require("../../rest-BE05MUNS.cjs");
-const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
+const require_list_tools = require("../../list-tools-DES10avA.cjs");
+const require_rest = require("../../rest-BBdfHMGh.cjs");
+const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -50,7 +50,7 @@ function dispatchFor(pathname) {
 */
 function createSupabaseHandler(mcp, options = {}) {
 	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) require_authorize.assertResourcePathShape(resourcePath);
+	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
 	const runtimeOptions = {
@@ -67,7 +67,7 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
-		const recorder = require_authorize.createRecorderForRuntime(mcp, { stack: "supabase" });
+		const recorder = require_cors.createRecorderForRuntime(mcp, { stack: "supabase" });
 		const target = dispatchFor(new URL(req.url).pathname);
 		switch (target.kind) {
 			case "metadata": return metadataHandler(req);

package/dist/stacks/supabase/index.d.cts

@@ -1,4 +1,4 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.d.ts

@@ -1,4 +1,4 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.js

@@ -1,11 +1,11 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
+import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-BDTQQJE2.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
+import { t as createMcpProtocolHandler } from "../../mcp-HDkUr85V.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
-import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
-import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
+import { n as createListToolsHandler } from "../../list-tools-C1OiTDR9.js";
+import { t as createInvokeToolHandler } from "../../rest-Cr7NhxL3.js";
+import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-CGLPZwz-.cjs");
+const require_package = require("../../package-ClCIqol1.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
+import { t as McpPluginApi } from "../../io-B_YLNWDL.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
+import { t as McpPluginApi } from "../../io-BYUyNFdn.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-DgiA0xuY.js";
+import { t as version } from "../../package-BI5r4uGM.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_authorize = require("../../authorize-ChY44o_1.cjs");
-const require_mcp = require("../../mcp-CUGwXkxb.cjs");
+const require_cors = require("../../cors-BRv5KXKQ.cjs");
+const require_mcp = require("../../mcp-C9B7o75m.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
-const require_rest = require("../../rest-BE05MUNS.cjs");
-const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
+const require_list_tools = require("../../list-tools-DES10avA.cjs");
+const require_rest = require("../../rest-BBdfHMGh.cjs");
+const require_forwarded = require("../../forwarded-BC_RHnn5.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**
@@ -13,7 +13,7 @@ const STACK = "tanstack";
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.mcp/list-tools`. Returns the
@@ -21,7 +21,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackListToolsHandler(mcp, options = {}) {
 	const handler = require_list_tools.createListToolsHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `POST /.mcp/invoke-tool/$tool`.
@@ -30,7 +30,7 @@ function createTanStackListToolsHandler(mcp, options = {}) {
 */
 function createTanStackInvokeToolHandler(mcp, options = {}) {
 	const handler = require_rest.createInvokeToolHandler(mcp, options);
-	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request, params }) => handler(require_forwarded.applyForwardedOrigin(request, options), params.tool, require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BzZFS0zi.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
+import { t as McpRuntimeOptions } from "../../authorize-BjNE3LPr.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,9 +1,9 @@
-import { s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
+import { c as createRecorderForRuntime } from "../../cors-BDTQQJE2.js";
+import { t as createMcpProtocolHandler } from "../../mcp-HDkUr85V.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
-import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
-import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
+import { n as createListToolsHandler } from "../../list-tools-C1OiTDR9.js";
+import { t as createInvokeToolHandler } from "../../rest-Cr7NhxL3.js";
+import { t as applyForwardedOrigin } from "../../forwarded-B3EBjHnA.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**

package/dist/stacks/tanstack/vite.cjs

@@ -79,14 +79,17 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath((0, node_path.relative)((0, node_path.dirname)(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath((0, node_path.relative)(projectRoot, route.file));
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
-	else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) {
+		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
+		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
+	} else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -193,6 +196,7 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
+	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = (0, node_path.resolve)(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile, listToolsLiteral, invokeToolLiteral } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
@@ -230,7 +234,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
+import { t as McpPluginApi } from "../../io-B_YLNWDL.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -77,6 +77,12 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
+  /**
+   * Derive the public scheme for same-origin checks and advertised OAuth URLs
+   * from `X-Forwarded-Proto`. Safe only behind an overwriting proxy.
+   * @default true
+   */
+  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
+import { t as McpPluginApi } from "../../io-BYUyNFdn.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -77,6 +77,12 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
+  /**
+   * Derive the public scheme for same-origin checks and advertised OAuth URLs
+   * from `X-Forwarded-Proto`. Safe only behind an overwriting proxy.
+   * @default true
+   */
+  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.js

@@ -75,14 +75,17 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath(relative(dirname(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath(relative(projectRoot, route.file));
 	const note = route.spaFallbackNote ? "      // ANY: TanStack returns SPA HTML for methods not in `handlers`; the SDK 405s instead.\n" : "";
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
-	else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) {
+		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
+		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
+	} else optionEntries.push("trustForwardedHost: true");
+	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -189,6 +192,7 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
+	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = resolve(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile, listToolsLiteral, invokeToolLiteral } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
@@ -226,7 +230,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/tool-result-CK6hXO43.cjs

@@ -0,0 +1,89 @@
+const require_schema = require("./schema-D3vClxb7.cjs");
+let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+//#region src/core/tool-result.ts
+function normalizeResourceLinkIcon(icon) {
+	if (typeof icon.sizes !== "string") return icon;
+	const { sizes, ...rest } = icon;
+	const normalized = sizes.trim();
+	return normalized === "" ? rest : {
+		...rest,
+		sizes: normalized.split(/\s+/)
+	};
+}
+function normalizeToolContent(content) {
+	return (content ?? []).map((block) => {
+		if (block.type !== "resource_link" || block.icons === void 0) return block;
+		return {
+			...block,
+			icons: block.icons.map(normalizeResourceLinkIcon)
+		};
+	});
+}
+function outputValidationError(text) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		isError: true
+	};
+}
+function isJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (typeof value !== "object" || ancestors.has(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null) return false;
+	ancestors.add(value);
+	const valid = Object.values(value).every((entry) => isJsonValue(entry, ancestors));
+	ancestors.delete(value);
+	return valid;
+}
+async function finalizeToolResult(tool, result) {
+	const content = normalizeToolContent(result.content);
+	let structuredContent = result.structuredContent;
+	if (tool.outputSchema && !result.isError) {
+		if (structuredContent === void 0) return outputValidationError(`Output validation error: Tool ${tool.name} has an output schema but no structured content was provided`);
+		try {
+			const parsed = await (0, _modelcontextprotocol_sdk_server_zod_compat_js.safeParseAsync)(require_schema.schemaFromDefinition(tool.outputSchema), structuredContent);
+			if (!parsed.success) return outputValidationError(`Output validation error: Invalid structured content for tool ${tool.name}: ${(0, _modelcontextprotocol_sdk_server_zod_compat_js.getParseErrorMessage)(parsed.error)}`);
+			structuredContent = parsed.data;
+		} catch {
+			return outputValidationError(`Output validation error: Could not validate structured content for tool ${tool.name}`);
+		}
+	}
+	if (structuredContent !== void 0 && !isJsonValue(structuredContent)) return outputValidationError(`Output validation error: Tool ${tool.name} returned a non-JSON structured value`);
+	if (structuredContent !== void 0 && (structuredContent === null || typeof structuredContent !== "object" || Array.isArray(structuredContent)) && !content.some((block) => block.type === "text")) content.push({
+		type: "text",
+		text: JSON.stringify(structuredContent)
+	});
+	return {
+		content,
+		structuredContent,
+		isError: result.isError
+	};
+}
+//#endregion
+Object.defineProperty(exports, "extractTextContent", {
+	enumerable: true,
+	get: function() {
+		return extractTextContent;
+	}
+});
+Object.defineProperty(exports, "finalizeToolResult", {
+	enumerable: true,
+	get: function() {
+		return finalizeToolResult;
+	}
+});