@lovable.dev/mcp-js 0.21.1-rc.1 → 0.22.0

package/dist/stacks/supabase/index.d.cts

@@ -1,32 +1,33 @@
-import { c as McpDefinition } from "../../types-BYdYYTjk.cjs";
-//#region src/stacks/supabase/handler.d.ts
+import { d as McpDefinition } from '../../types-qqrmJ736.js';
+import 'zod';
+
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {
-  /**
-   * Supabase function directory name (the segment under `supabase/functions/`).
-   * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
-   * protected-resource metadata binds to the canonical public MCP URL rather
-   * than the request path the dispatcher was reached through.
-   *
-   * Either `functionName` or `resourcePath` is required when OAuth auth is
-   * configured and `auth.resource` is not pinned.
-   */
-  functionName?: string;
-  /**
-   * Explicit override for the public MCP route path. Wins over `functionName`
-   * when both are set. Use when the function is fronted by a custom router or
-   * a Lovable Cloud–style host that rewrites the public URL.
-   */
-  resourcePath?: string;
-  /**
-   * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
-   * instead of the request `Host`, so a function fronted by a custom-domain
-   * proxy advertises the public host. Off by default: enable only behind a
-   * proxy that overwrites the header (an unsanitized one lets a client spoof
-   * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
-   * Supabase terminates TLS upstream and forwards over http.
-   */
-  trustForwardedHost?: boolean;
+    /**
+     * Supabase function directory name (the segment under `supabase/functions/`).
+     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+     * protected-resource metadata binds to the canonical public MCP URL rather
+     * than the request path the dispatcher was reached through.
+     *
+     * Either `functionName` or `resourcePath` is required when OAuth auth is
+     * configured and `auth.resource` is not pinned.
+     */
+    functionName?: string;
+    /**
+     * Explicit override for the public MCP route path. Wins over `functionName`
+     * when both are set. Use when the function is fronted by a custom router or
+     * a Lovable Cloud–style host that rewrites the public URL.
+     */
+    resourcePath?: string;
+    /**
+     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+     * instead of the request `Host`, so a function fronted by a custom-domain
+     * proxy advertises the public host. Off by default: enable only behind a
+     * proxy that overwrites the header (an unsanitized one lets a client spoof
+     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+     * Supabase terminates TLS upstream and forwards over http.
+     */
+    trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from
@@ -43,5 +44,5 @@ interface SupabaseHandlerOptions {
  * The same OAuth bearer gate protects every dispatch target.
  */
 declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
-//#endregion
-export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };
+
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.d.ts

@@ -1,32 +1,33 @@
-import { c as McpDefinition } from "../../types-BYdYYTjk.js";
-//#region src/stacks/supabase/handler.d.ts
+import { d as McpDefinition } from '../../types-qqrmJ736.js';
+import 'zod';
+
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {
-  /**
-   * Supabase function directory name (the segment under `supabase/functions/`).
-   * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
-   * protected-resource metadata binds to the canonical public MCP URL rather
-   * than the request path the dispatcher was reached through.
-   *
-   * Either `functionName` or `resourcePath` is required when OAuth auth is
-   * configured and `auth.resource` is not pinned.
-   */
-  functionName?: string;
-  /**
-   * Explicit override for the public MCP route path. Wins over `functionName`
-   * when both are set. Use when the function is fronted by a custom router or
-   * a Lovable Cloud–style host that rewrites the public URL.
-   */
-  resourcePath?: string;
-  /**
-   * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
-   * instead of the request `Host`, so a function fronted by a custom-domain
-   * proxy advertises the public host. Off by default: enable only behind a
-   * proxy that overwrites the header (an unsanitized one lets a client spoof
-   * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
-   * Supabase terminates TLS upstream and forwards over http.
-   */
-  trustForwardedHost?: boolean;
+    /**
+     * Supabase function directory name (the segment under `supabase/functions/`).
+     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+     * protected-resource metadata binds to the canonical public MCP URL rather
+     * than the request path the dispatcher was reached through.
+     *
+     * Either `functionName` or `resourcePath` is required when OAuth auth is
+     * configured and `auth.resource` is not pinned.
+     */
+    functionName?: string;
+    /**
+     * Explicit override for the public MCP route path. Wins over `functionName`
+     * when both are set. Use when the function is fronted by a custom router or
+     * a Lovable Cloud–style host that rewrites the public URL.
+     */
+    resourcePath?: string;
+    /**
+     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+     * instead of the request `Host`, so a function fronted by a custom-domain
+     * proxy advertises the public host. Off by default: enable only behind a
+     * proxy that overwrites the header (an unsanitized one lets a client spoof
+     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+     * Supabase terminates TLS upstream and forwards over http.
+     */
+    trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from
@@ -43,5 +44,5 @@ interface SupabaseHandlerOptions {
  * The same OAuth bearer gate protects every dispatch target.
  */
 declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
-//#endregion
-export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };
+
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.js

@@ -1,79 +1,95 @@
-import { s as trimTrailingSlash } from "../../logger-2OXtfiIW.js";
-import { l as createRecorderForRuntime, s as assertResourcePathShape } from "../../cors-B7CTXIHD.js";
-import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-GngXbcqN.js";
-import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-D75RGtgs.js";
-import { t as createInvokeToolHandler } from "../../rest-CXH6-zv9.js";
-import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
-import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
-//#region src/stacks/supabase/handler.ts
+import {
+  applyForwardedOrigin
+} from "../../chunk-UQK5UO6C.js";
+import {
+  createMcpProtocolHandler
+} from "../../chunk-P43FIUMZ.js";
+import {
+  createOAuthProtectedResourceMetadataHandler
+} from "../../chunk-6KNM7RGD.js";
+import {
+  createInvokeToolHandler
+} from "../../chunk-4EHZUUS5.js";
+import {
+  createListToolsHandler
+} from "../../chunk-RLE4UE63.js";
+import "../../chunk-6QFZYYUV.js";
+import "../../chunk-MA5H6PSF.js";
+import {
+  assertResourcePathShape,
+  createRecorderForRuntime
+} from "../../chunk-RK62EMPY.js";
+import {
+  trimTrailingSlash
+} from "../../chunk-H37EB22A.js";
+import {
+  OAUTH_PROTECTED_RESOURCE_METADATA_PATH
+} from "../../chunk-6DXGZZA4.js";
+import {
+  FUNCTIONS_MOUNT_PREFIX,
+  assertFunctionName
+} from "../../chunk-XQWJN6DC.js";
+import "../../chunk-EOFPMSND.js";
+
+// src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
-	if (options.resourcePath !== void 0) return options.resourcePath;
-	if (options.functionName === void 0) return void 0;
-	assertFunctionName(options.functionName);
-	return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
+  if (options.resourcePath !== void 0)
+    return options.resourcePath;
+  if (options.functionName === void 0)
+    return void 0;
+  assertFunctionName(options.functionName);
+  return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
 }
 function dispatchFor(pathname) {
-	const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
-	if (path.endsWith("/.well-known/oauth-protected-resource")) return { kind: "metadata" };
-	if (path.endsWith("/.mcp/list-tools")) return { kind: "list-tools" };
-	const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
-	if (invokeMatch) {
-		let toolName;
-		try {
-			toolName = decodeURIComponent(invokeMatch[1]);
-		} catch {
-			return { kind: "mcp" };
-		}
-		return {
-			kind: "invoke-tool",
-			toolName
-		};
-	}
-	return { kind: "mcp" };
+  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  if (path.endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
+    return { kind: "metadata" };
+  }
+  if (path.endsWith("/.mcp/list-tools")) {
+    return { kind: "list-tools" };
+  }
+  const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
+  if (invokeMatch) {
+    let toolName;
+    try {
+      toolName = decodeURIComponent(invokeMatch[1]);
+    } catch {
+      return { kind: "mcp" };
+    }
+    return { kind: "invoke-tool", toolName };
+  }
+  return { kind: "mcp" };
 }
-/**
-* Build a single Web-Standard handler that serves the full MCP surface from
-* one Supabase Edge Function. The returned handler dispatches by URL suffix:
-*
-* | Suffix | Target |
-* | --- | --- |
-* | `/.well-known/oauth-protected-resource` | RFC 9728 metadata |
-* | `/.mcp/list-tools` | REST tool catalog |
-* | `/.mcp/invoke-tool/<tool>` | REST tool dispatcher |
-* | (anything else) | MCP streamable-HTTP protocol |
-*
-* Pass the handler to `Deno.serve(...)` in the emitted function entry.
-* The same OAuth bearer gate protects every dispatch target.
-*/
 function createSupabaseHandler(mcp, options = {}) {
-	const resourcePath = deriveResourcePath(options);
-	if (resourcePath !== void 0) assertResourcePathShape(resourcePath);
-	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
-	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
-	const runtimeOptions = resourcePath === void 0 ? {} : {
-		resourcePath,
-		...metadataPath ? { metadataPath } : {}
-	};
-	const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
-	const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
-	const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
-	const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
-	return async (request) => {
-		const req = applyForwardedOrigin(request, {
-			trustForwardedProto: true,
-			trustForwardedHost: options.trustForwardedHost
-		});
-		const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
-		const target = dispatchFor(new URL(req.url).pathname);
-		switch (target.kind) {
-			case "metadata": return metadataHandler(req);
-			case "list-tools": return listToolsHandler(req, recorder);
-			case "invoke-tool": return invokeToolHandler(req, target.toolName, recorder);
-			case "mcp": return mcpHandler(req, recorder);
-		}
-	};
+  const resourcePath = deriveResourcePath(options);
+  if (resourcePath !== void 0)
+    assertResourcePathShape(resourcePath);
+  const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
+  const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
+  const runtimeOptions = resourcePath === void 0 ? {} : { resourcePath, ...metadataPath ? { metadataPath } : {} };
+  const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
+  const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
+  const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
+  const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
+  return async (request) => {
+    const req = applyForwardedOrigin(request, {
+      trustForwardedProto: true,
+      trustForwardedHost: options.trustForwardedHost
+    });
+    const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
+    const target = dispatchFor(new URL(req.url).pathname);
+    switch (target.kind) {
+      case "metadata":
+        return metadataHandler(req);
+      case "list-tools":
+        return listToolsHandler(req, recorder);
+      case "invoke-tool":
+        return invokeToolHandler(req, target.toolName, recorder);
+      case "mcp":
+        return mcpHandler(req, recorder);
+    }
+  };
 }
-//#endregion
-export { createSupabaseHandler };
+export {
+  createSupabaseHandler
+};