@lovable.dev/mcp-js 0.30.0-rc.0 → 1.0.0

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,36 @@
-import { d as McpDefinition } from "../../types-3CZPz364.cjs";
-import { t as MetricsRecorder } from "../../base-CHNFFrMG.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-9hTTG-qJ.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-DIYS7zBP.cjs";
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
+   *  summary (`handler_error`). Local log only — never sent to the collector. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,36 @@
-import { d as McpDefinition } from "../../types-3CZPz364.js";
-import { t as MetricsRecorder } from "../../base-7cq6HCPO.js";
-import { t as McpRuntimeOptions } from "../../authorize-DNUlPT7k.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../../authorize-CqYsQYfa.js";
+//#region src/metrics/impl/base.d.ts
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+/** One recorded MCP call. Carries no arguments or response payloads — only the
+ *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
+ *  `errorText` is the sole exception: it is logged locally for debugging and
+ *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
+interface InvocationRecord {
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
+  tool: string | null;
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
+  method: string;
+  outcome: InvocationOutcome;
+  durationMs: number;
+  reqBytes?: number;
+  resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
+  /** The app end-user that made the call (the access token `sub`), or
+   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
+  endUserId?: string;
+  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
+   *  summary (`handler_error`). Local log only — never sent to the collector. */
+  errorText?: string;
+}
+/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
+ *  single OTLP POST, awaited so it lands before the request ends. */
+interface MetricsRecorder {
+  emit(ev: InvocationRecord): Promise<void>;
+}
+//#endregion
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-Cb5SavFT.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BDsG9I0t.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_cors = require("../cors-DIQIXIHY.cjs");
+const require_authorize = require("../authorize-DBk5GkN_.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
 	});
@@ -14,7 +14,7 @@ function notFound() {
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
 	const body = {
-		resource: require_cors.resolveProtectedResource(auth, request, options),
+		resource: require_authorize.resolveProtectedResource(auth, request, options),
 		authorization_servers: [issuer],
 		bearer_methods_supported: ["header"],
 		resource_name: auth.resourceName ?? mcp.title,
@@ -24,7 +24,7 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 	return body;
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-	const runtime = require_cors.getOAuthRuntime(mcp, options);
+	const runtime = require_authorize.getOAuthRuntime(mcp, options);
 	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
 		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
 		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) require_logger.log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
@@ -35,9 +35,9 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const vary = varyHeaders.join(", ");
 	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
+		if (request.method !== "GET" && request.method !== "HEAD") return require_authorize.methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
-			...require_cors.JSON_HEADERS,
+			...require_authorize.JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
 			Vary: vary
 		};
@@ -49,29 +49,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				...require_logger.describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			return require_cors.oauthConfigurationErrorResponse();
+			return require_authorize.oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request, recorder = require_cors.createNoopRecorder()) => {
-		const cors = require_cors.evaluateCors(request, mcp.allowedOrigins);
-		if (!cors.ok) {
-			const httpMethod = require_cors.normalizeHttpMethod(request.method);
-			require_logger.log.info("cors.origin_rejected", {
-				origin: request.headers.get("Origin"),
-				httpMethod,
-				route: "oauth-metadata"
-			});
-			await recorder.emit({
-				tool: null,
-				method: "authorize",
-				outcome: "origin_rejected",
-				httpMethod,
-				durationMs: 0
-			});
-			return require_cors.finalizeWireResponse(request, cors.response);
-		}
-		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
-		return require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request)));
+	return async (request) => {
+		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse("GET, HEAD, OPTIONS");
+		return require_authorize.finalizeWireResponse(request, await respond(request));
 	};
 }
 //#endregion

package/dist/protocols/oauth-metadata.d.cts

@@ -1,8 +1,7 @@
-import { d as McpDefinition } from "../types-3CZPz364.cjs";
-import { t as MetricsRecorder } from "../base-CHNFFrMG.cjs";
-import { t as McpRuntimeOptions } from "../authorize-9hTTG-qJ.cjs";
+import { c as McpDefinition } from "../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../authorize-DIYS7zBP.cjs";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.d.ts

@@ -1,8 +1,7 @@
-import { d as McpDefinition } from "../types-3CZPz364.js";
-import { t as MetricsRecorder } from "../base-7cq6HCPO.js";
-import { t as McpRuntimeOptions } from "../authorize-DNUlPT7k.js";
+import { c as McpDefinition } from "../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../authorize-CqYsQYfa.js";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { a as oauthConfigurationErrorResponse, d as JSON_HEADERS, f as finalizeWireResponse, i as normalizeHttpMethod, l as createNoopRecorder, p as methodNotAllowed, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors } from "../cors-5P69YRDK.js";
+import { a as resolveProtectedResource, d as methodNotAllowed, f as corsPreflightResponse, l as JSON_HEADERS, n as getOAuthRuntime, r as oauthConfigurationErrorResponse, u as finalizeWireResponse } from "../authorize-9wHgaqeQ.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -51,26 +51,9 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 			return oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request, recorder = createNoopRecorder()) => {
-		const cors = evaluateCors(request, mcp.allowedOrigins);
-		if (!cors.ok) {
-			const httpMethod = normalizeHttpMethod(request.method);
-			log.info("cors.origin_rejected", {
-				origin: request.headers.get("Origin"),
-				httpMethod,
-				route: "oauth-metadata"
-			});
-			await recorder.emit({
-				tool: null,
-				method: "authorize",
-				outcome: "origin_rejected",
-				httpMethod,
-				durationMs: 0
-			});
-			return finalizeWireResponse(request, cors.response);
-		}
-		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
-		return finalizeWireResponse(request, cors.withHeaders(await respond(request)));
+	return async (request) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
+		return finalizeWireResponse(request, await respond(request));
 	};
 }
 //#endregion

package/dist/stacks/supabase/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../../logger-CN1q-KNn.cjs");
-const require_cors = require("../../cors-DIQIXIHY.cjs");
+const require_authorize = require("../../authorize-DBk5GkN_.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-Dq6dXUKT.cjs");
+const require_mcp = require("../../mcp-CS1MF39p.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_forwarded = require("../../forwarded-zNAIofM2.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -29,7 +29,7 @@ function isMetadataPath(pathname) {
 */
 function createSupabaseHandler(mcp, options = {}) {
 	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
+	if (resourcePath !== void 0) require_authorize.assertResourcePathShape(resourcePath);
 	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
 	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
 	const runtimeOptions = {
@@ -44,8 +44,8 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = require_forwarded.applyForwardedOrigin(request, runtimeOptions);
-		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }));
-		return mcpHandler(req, require_cors.createRecorderForRuntime(mcp, { stack: "supabase" }));
+		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req);
+		return mcpHandler(req, require_authorize.createRecorderForRuntime(mcp, { stack: "supabase" }));
 	};
 }
 //#endregion

package/dist/stacks/supabase/index.d.cts

@@ -1,4 +1,4 @@
-import { d as McpDefinition } from "../../types-3CZPz364.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.d.ts

@@ -1,4 +1,4 @@
-import { d as McpDefinition } from "../../types-3CZPz364.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
 //#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {

package/dist/stacks/supabase/index.js

@@ -1,9 +1,9 @@
 import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
-import { c as createRecorderForRuntime, o as assertResourcePathShape } from "../../cors-5P69YRDK.js";
+import { i as assertResourcePathShape, o as createRecorderForRuntime } from "../../authorize-9wHgaqeQ.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Cb5SavFT.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BDsG9I0t.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { t as applyForwardedOrigin } from "../../forwarded-DG83ubwT.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
@@ -43,7 +43,7 @@ function createSupabaseHandler(mcp, options = {}) {
 	const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
 	return async (request) => {
 		const req = applyForwardedOrigin(request, runtimeOptions);
-		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }));
+		if (isMetadataPath(new URL(req.url).pathname)) return metadataHandler(req);
 		return mcpHandler(req, createRecorderForRuntime(mcp, { stack: "supabase" }));
 	};
 }

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-QViIguII.cjs");
+const require_package = require("../../package-C_8WAZRS.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-CDV3mud0.cjs";
+import { t as McpPluginApi } from "../../io-Dx0nPc1-.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-D_5cuaEL.js";
+import { t as McpPluginApi } from "../../io-DP3icuxa.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-ZFJI6B7S.js";
+import { t as version } from "../../package-CLhOKbJP.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cors = require("../../cors-DIQIXIHY.cjs");
-const require_mcp = require("../../mcp-Dq6dXUKT.cjs");
+const require_authorize = require("../../authorize-DBk5GkN_.cjs");
+const require_mcp = require("../../mcp-CS1MF39p.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_forwarded = require("../../forwarded-zNAIofM2.cjs");
+const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**
@@ -11,7 +11,7 @@ const STACK = "tanstack";
 */
 function createTanStackMcpHandler(mcp, options = {}) {
 	const handler = require_mcp.createMcpProtocolHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_authorize.createRecorderForRuntime(mcp, { stack: STACK }));
 }
 /**
 * Build a TanStack Start handler for `GET /.well-known/oauth-protected-resource`.
@@ -19,7 +19,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options), require_cors.createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(require_forwarded.applyForwardedOrigin(request, options));
 }
 //#endregion
 exports.createTanStackMcpHandler = createTanStackMcpHandler;

package/dist/stacks/tanstack/index.d.cts

@@ -1,5 +1,5 @@
-import { d as McpDefinition } from "../../types-3CZPz364.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-9hTTG-qJ.cjs";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-DIYS7zBP.cjs";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.d.ts

@@ -1,5 +1,5 @@
-import { d as McpDefinition } from "../../types-3CZPz364.js";
-import { t as McpRuntimeOptions } from "../../authorize-DNUlPT7k.js";
+import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
+import { t as McpRuntimeOptions } from "../../authorize-CqYsQYfa.js";
 //#region src/stacks/tanstack/handlers.d.ts
 interface TanStackRouteCtx {
   request: Request;

package/dist/stacks/tanstack/index.js

@@ -1,7 +1,7 @@
-import { c as createRecorderForRuntime } from "../../cors-5P69YRDK.js";
-import { t as createMcpProtocolHandler } from "../../mcp-Cb5SavFT.js";
+import { o as createRecorderForRuntime } from "../../authorize-9wHgaqeQ.js";
+import { t as createMcpProtocolHandler } from "../../mcp-BDsG9I0t.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { t as applyForwardedOrigin } from "../../forwarded-DG83ubwT.js";
+import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";
 /**
@@ -18,7 +18,7 @@ function createTanStackMcpHandler(mcp, options = {}) {
 */
 function createTanStackOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const handler = createOAuthProtectedResourceMetadataHandler(mcp, options);
-	return ({ request }) => handler(applyForwardedOrigin(request, options), createRecorderForRuntime(mcp, { stack: STACK }));
+	return ({ request }) => handler(applyForwardedOrigin(request, options));
 }
 //#endregion
 export { createTanStackMcpHandler, createTanStackOAuthProtectedResourceMetadataHandler };

package/dist/stacks/tanstack/vite.cjs

@@ -64,16 +64,13 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath((0, node_path.relative)((0, node_path.dirname)(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath((0, node_path.relative)(projectRoot, route.file));
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) {
-		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
-		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
-	} else optionEntries.push("trustForwardedHost: true");
-	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -179,7 +176,6 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
-	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = (0, node_path.resolve)(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath);
@@ -206,7 +202,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-CDV3mud0.cjs";
+import { t as McpPluginApi } from "../../io-Dx0nPc1-.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -57,9 +57,6 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
-  /** Derive the public scheme from `X-Forwarded-Proto`; safe only behind an
-   * overwriting proxy. @default true */
-  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-D_5cuaEL.js";
+import { t as McpPluginApi } from "../../io-DP3icuxa.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {
@@ -57,9 +57,6 @@ interface McpPluginOptions {
    * @default true
    */
   trustForwardedHost?: boolean;
-  /** Derive the public scheme from `X-Forwarded-Proto`; safe only behind an
-   * overwriting proxy. @default true */
-  trustForwardedProto?: boolean;
 }
 declare function assertUrlPathShape(urlPath: string): string;
 declare function deriveRouteFileName(urlPath: string): string;

package/dist/stacks/tanstack/vite.js

@@ -60,16 +60,13 @@ function relativeImportSpecifier(routeFile, target) {
 	const withoutExt = normalizePath(relative(dirname(routeFile), target)).replace(/\.ts$/, "");
 	return withoutExt.startsWith(".") ? withoutExt : `./${withoutExt}`;
 }
-function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot) {
+function buildRouteSource(route, resourcePath, metadataPath, trustForwardedHost, mcpEntry, projectRoot) {
 	const mcpImport = relativeImportSpecifier(route.file, mcpEntry);
 	const routeRel = normalizePath(relative(projectRoot, route.file));
 	const optionEntries = [`resourcePath: "${resourcePath}"`];
 	if (metadataPath !== void 0) optionEntries.push(`metadataPath: "${metadataPath}"`);
-	if (trustForwardedHost) if (route.attestsForwardedHost) {
-		const trustNote = trustForwardedProto ? "// Trusting X-Forwarded-Host/-Proto is safe on Lovable hosting only (its\n        // proxies overwrite both headers); remove these options behind other proxies." : "// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.";
-		optionEntries.push(`${trustNote}\n        trustForwardedHost: true`, "forwardedHostTrustedByPlatform: true");
-	} else optionEntries.push("trustForwardedHost: true");
-	if (trustForwardedProto) optionEntries.push("trustForwardedProto: true");
+	if (trustForwardedHost) if (route.attestsForwardedHost) optionEntries.push("// Trusting X-Forwarded-Host is safe on Lovable hosting only (its proxy\n        // overwrites the header); remove both options behind other proxies.\n        trustForwardedHost: true", "forwardedHostTrustedByPlatform: true");
+	else optionEntries.push("trustForwardedHost: true");
 	const optionsObject = `{\n${optionEntries.map((entry) => `        ${entry},`).join("\n")}\n      }`;
 	const inlineRouteOpen = `export const Route = createFileRoute("${route.routeLiteral}")({`;
 	const routeOpen = inlineRouteOpen.length <= OXFMT_PRINT_WIDTH ? inlineRouteOpen : `export const Route = createFileRoute(\n  "${route.routeLiteral}",\n)({`;
@@ -175,7 +172,6 @@ function mcpPlugin(options = {}) {
 	const metadataUrlPath = canonicalUrlPath(options.metadataPath ?? "/.well-known/oauth-protected-resource");
 	const injectedMetadataPath = emitProtectedResourceMetadataRoute ? metadataUrlPath : void 0;
 	const trustForwardedHost = options.trustForwardedHost !== false;
-	const trustForwardedProto = options.trustForwardedProto !== false;
 	let projectRoot = process.cwd();
 	let mcpEntry = resolve(projectRoot, mcpEntryOption);
 	let { routesDir, mcpRouteFile, metadataRouteFile } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath);
@@ -202,7 +198,7 @@ function mcpPlugin(options = {}) {
 			});
 			for (const route of routes) {
 				expected.add(route.file);
-				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, trustForwardedProto, mcpEntry, projectRoot));
+				writeIfChanged(route.file, buildRouteSource(route, urlPath, injectedMetadataPath, trustForwardedHost, mcpEntry, projectRoot));
 			}
 		}
 		for (const file of findAdoptedFiles(routesDir)) if (!expected.has(file)) try {