@lovable.dev/mcp-js 0.22.0 → 0.22.1-rc.1

package/dist/logger-2OXtfiIW.js

@@ -0,0 +1,141 @@
+//#region src/metrics/config.ts
+const DEFAULT_METRICS_ENDPOINT = "https://api.lovable.dev/v1/app-mcp-usage";
+const METRICS_API_KEY_ENV_VAR = "LOVABLE_API_KEY";
+/**
+* Validate the ingest endpoint at plugin-construction time so a malformed URL
+* fails the build rather than silently dropping every batch at runtime.
+*/
+function assertMetricsEndpoint(endpoint) {
+	let url;
+	try {
+		url = new URL(endpoint);
+	} catch {
+		throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be an absolute URL, got ${JSON.stringify(endpoint)}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be http(s), got ${JSON.stringify(endpoint)}`);
+}
+/**
+* Resolve `boolean | MetricsOptions` into a frozen config. Telemetry is on by
+* default and self-disables at runtime when `LOVABLE_API_KEY` is absent (so a
+* local `vite dev` stays silent); pass `false` to opt out entirely.
+*/
+function resolveMetricsConfig(config = true) {
+	const options = typeof config === "boolean" ? { enabled: config } : config;
+	const endpoint = options.endpoint ?? "https://api.lovable.dev/v1/app-mcp-usage";
+	assertMetricsEndpoint(endpoint);
+	return Object.freeze({
+		enabled: options.enabled ?? true,
+		endpoint,
+		headers: options.headers ?? {},
+		apiKeyEnvVar: METRICS_API_KEY_ENV_VAR
+	});
+}
+//#endregion
+//#region src/core/url.ts
+function trimTrailingSlash(value) {
+	return value.replace(/\/+$/, "");
+}
+function isLocalHTTPHost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* Shared scheme/credential/query checks for every absolute URL we accept or
+* discover. Returns the human-readable problem suffix so each call site can
+* prefix it with its own subject and throw its own error type.
+*/
+function urlSafetyProblem(url) {
+	const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
+	if (url.protocol !== "https:" && !isAllowedHTTP) return "must use https://, except localhost development URLs";
+	if (url.username || url.password) return "must not include credentials";
+	if (url.search || url.hash) return "must not include query or fragment";
+}
+//#endregion
+//#region src/core/validation.ts
+/**
+* Parse `raw` as an absolute URL and reject unsafe shapes (non-HTTPS except
+* localhost, embedded credentials, query/fragment). `subject` is the
+* fully-formed message prefix (e.g. `auth.issuer`, `managed OAuth issuer`) so
+* each call site keeps its own wording; `ErrorClass` selects the thrown type.
+*/
+function parseSafeUrl(subject, raw, ErrorClass = Error) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new ErrorClass(`${subject} must be an absolute URL`);
+	}
+	const problem = urlSafetyProblem(url);
+	if (problem) throw new ErrorClass(`${subject} ${problem}`);
+	return url;
+}
+//#endregion
+//#region src/core/logger.ts
+const LEVEL_RANK = {
+	silent: 0,
+	error: 1,
+	warn: 2,
+	info: 3,
+	debug: 4
+};
+function isLogLevel(value) {
+	return typeof value === "string" && value in LEVEL_RANK;
+}
+const LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
+function readEnvLevel() {
+	try {
+		const normalized = (typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0)?.trim().toLowerCase();
+		return isLogLevel(normalized) ? normalized : void 0;
+	} catch {
+		return;
+	}
+}
+let currentLevel = readEnvLevel() ?? "debug";
+/**
+* Set the runtime log level programmatically. Use this when the deployment can't
+* surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
+* passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+*/
+function setLogLevel(level) {
+	currentLevel = level;
+}
+/** Parse an env value into a LogLevel, or undefined if it names no valid level. */
+function parseLogLevel(raw) {
+	const normalized = raw?.trim().toLowerCase();
+	return isLogLevel(normalized) ? normalized : void 0;
+}
+/**
+* Apply the log level from an env value: use it when it names a valid level,
+* otherwise fall back to `debug` so the SDK's diagnostics are on by default.
+*/
+function applyLogLevelFromEnv(raw) {
+	setLogLevel(parseLogLevel(raw) ?? "debug");
+}
+function enabled(level) {
+	return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+	if (!enabled(level)) return;
+	const message = `[mcp-js] ${event}`;
+	if (fields) console[method](message, fields);
+	else console[method](message);
+}
+const log = {
+	error: (event, fields) => emit("error", "error", event, fields),
+	warn: (event, fields) => emit("warn", "warn", event, fields),
+	info: (event, fields) => emit("info", "info", event, fields),
+	debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+/** Non-secret error shape for logs: name, message, and a string `code` (jose carries one) when present. */
+function describeError(err) {
+	if (err instanceof Error) {
+		const code = err.code;
+		return {
+			name: err.name,
+			message: err.message,
+			...typeof code === "string" ? { code } : {}
+		};
+	}
+	return { value: String(err) };
+}
+//#endregion
+export { setLogLevel as a, DEFAULT_METRICS_ENDPOINT as c, log as i, resolveMetricsConfig as l, applyLogLevelFromEnv as n, parseSafeUrl as o, describeError as r, trimTrailingSlash as s, LOG_LEVEL_ENV_VAR as t };

package/dist/logger-BqPOa_E1.cjs

@@ -0,0 +1,194 @@
+//#region src/metrics/config.ts
+const DEFAULT_METRICS_ENDPOINT = "https://api.lovable.dev/v1/app-mcp-usage";
+const METRICS_API_KEY_ENV_VAR = "LOVABLE_API_KEY";
+/**
+* Validate the ingest endpoint at plugin-construction time so a malformed URL
+* fails the build rather than silently dropping every batch at runtime.
+*/
+function assertMetricsEndpoint(endpoint) {
+	let url;
+	try {
+		url = new URL(endpoint);
+	} catch {
+		throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be an absolute URL, got ${JSON.stringify(endpoint)}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be http(s), got ${JSON.stringify(endpoint)}`);
+}
+/**
+* Resolve `boolean | MetricsOptions` into a frozen config. Telemetry is on by
+* default and self-disables at runtime when `LOVABLE_API_KEY` is absent (so a
+* local `vite dev` stays silent); pass `false` to opt out entirely.
+*/
+function resolveMetricsConfig(config = true) {
+	const options = typeof config === "boolean" ? { enabled: config } : config;
+	const endpoint = options.endpoint ?? "https://api.lovable.dev/v1/app-mcp-usage";
+	assertMetricsEndpoint(endpoint);
+	return Object.freeze({
+		enabled: options.enabled ?? true,
+		endpoint,
+		headers: options.headers ?? {},
+		apiKeyEnvVar: METRICS_API_KEY_ENV_VAR
+	});
+}
+//#endregion
+//#region src/core/url.ts
+function trimTrailingSlash(value) {
+	return value.replace(/\/+$/, "");
+}
+function isLocalHTTPHost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* Shared scheme/credential/query checks for every absolute URL we accept or
+* discover. Returns the human-readable problem suffix so each call site can
+* prefix it with its own subject and throw its own error type.
+*/
+function urlSafetyProblem(url) {
+	const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
+	if (url.protocol !== "https:" && !isAllowedHTTP) return "must use https://, except localhost development URLs";
+	if (url.username || url.password) return "must not include credentials";
+	if (url.search || url.hash) return "must not include query or fragment";
+}
+//#endregion
+//#region src/core/validation.ts
+/**
+* Parse `raw` as an absolute URL and reject unsafe shapes (non-HTTPS except
+* localhost, embedded credentials, query/fragment). `subject` is the
+* fully-formed message prefix (e.g. `auth.issuer`, `managed OAuth issuer`) so
+* each call site keeps its own wording; `ErrorClass` selects the thrown type.
+*/
+function parseSafeUrl(subject, raw, ErrorClass = Error) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new ErrorClass(`${subject} must be an absolute URL`);
+	}
+	const problem = urlSafetyProblem(url);
+	if (problem) throw new ErrorClass(`${subject} ${problem}`);
+	return url;
+}
+//#endregion
+//#region src/core/logger.ts
+const LEVEL_RANK = {
+	silent: 0,
+	error: 1,
+	warn: 2,
+	info: 3,
+	debug: 4
+};
+function isLogLevel(value) {
+	return typeof value === "string" && value in LEVEL_RANK;
+}
+const LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
+function readEnvLevel() {
+	try {
+		const normalized = (typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0)?.trim().toLowerCase();
+		return isLogLevel(normalized) ? normalized : void 0;
+	} catch {
+		return;
+	}
+}
+let currentLevel = readEnvLevel() ?? "debug";
+/**
+* Set the runtime log level programmatically. Use this when the deployment can't
+* surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
+* passes vars via bindings): call `setLogLevel("debug")` once at server startup.
+*/
+function setLogLevel(level) {
+	currentLevel = level;
+}
+/** Parse an env value into a LogLevel, or undefined if it names no valid level. */
+function parseLogLevel(raw) {
+	const normalized = raw?.trim().toLowerCase();
+	return isLogLevel(normalized) ? normalized : void 0;
+}
+/**
+* Apply the log level from an env value: use it when it names a valid level,
+* otherwise fall back to `debug` so the SDK's diagnostics are on by default.
+*/
+function applyLogLevelFromEnv(raw) {
+	setLogLevel(parseLogLevel(raw) ?? "debug");
+}
+function enabled(level) {
+	return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+	if (!enabled(level)) return;
+	const message = `[mcp-js] ${event}`;
+	if (fields) console[method](message, fields);
+	else console[method](message);
+}
+const log = {
+	error: (event, fields) => emit("error", "error", event, fields),
+	warn: (event, fields) => emit("warn", "warn", event, fields),
+	info: (event, fields) => emit("info", "info", event, fields),
+	debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+/** Non-secret error shape for logs: name, message, and a string `code` (jose carries one) when present. */
+function describeError(err) {
+	if (err instanceof Error) {
+		const code = err.code;
+		return {
+			name: err.name,
+			message: err.message,
+			...typeof code === "string" ? { code } : {}
+		};
+	}
+	return { value: String(err) };
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_METRICS_ENDPOINT", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_METRICS_ENDPOINT;
+	}
+});
+Object.defineProperty(exports, "LOG_LEVEL_ENV_VAR", {
+	enumerable: true,
+	get: function() {
+		return LOG_LEVEL_ENV_VAR;
+	}
+});
+Object.defineProperty(exports, "applyLogLevelFromEnv", {
+	enumerable: true,
+	get: function() {
+		return applyLogLevelFromEnv;
+	}
+});
+Object.defineProperty(exports, "describeError", {
+	enumerable: true,
+	get: function() {
+		return describeError;
+	}
+});
+Object.defineProperty(exports, "log", {
+	enumerable: true,
+	get: function() {
+		return log;
+	}
+});
+Object.defineProperty(exports, "parseSafeUrl", {
+	enumerable: true,
+	get: function() {
+		return parseSafeUrl;
+	}
+});
+Object.defineProperty(exports, "resolveMetricsConfig", {
+	enumerable: true,
+	get: function() {
+		return resolveMetricsConfig;
+	}
+});
+Object.defineProperty(exports, "setLogLevel", {
+	enumerable: true,
+	get: function() {
+		return setLogLevel;
+	}
+});
+Object.defineProperty(exports, "trimTrailingSlash", {
+	enumerable: true,
+	get: function() {
+		return trimTrailingSlash;
+	}
+});

package/dist/mcp--iewDKrV.cjs

@@ -0,0 +1,128 @@
+const require_logger = require("./logger-BqPOa_E1.cjs");
+const require_context = require("./context-BweeEcoA.cjs");
+const require_cors = require("./cors-BxwVxCm3.cjs");
+const require_content = require("./content-NCYIGgOb.cjs");
+let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
+let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
+//#region src/protocols/mcp/protocol.ts
+/**
+* Adapt a Lovable tool to the SDK's tool callback. The boundary cast bridges
+* our SDK-decoupled content-block types to the SDK's; they match structurally.
+*/
+function adaptToolToSdkCallback(tool, auth, recorder) {
+	const endUserId = auth?.principal.sub;
+	return (async (first) => {
+		const args = tool.inputSchema ? first ?? {} : {};
+		const start = require_cors.nowMs();
+		let result;
+		try {
+			result = await tool.handler(args, new require_context.ToolContext(auth));
+		} catch {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: require_cors.nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: "tool execution failed"
+				}],
+				isError: true
+			};
+		}
+		if (result == null) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: require_cors.nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: `tool "${tool.name}" returned no result`
+				}],
+				isError: true
+			};
+		}
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: result.isError ? "tool_error" : "ok",
+			durationMs: require_cors.nowMs() - start,
+			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
+			endUserId
+		});
+		return {
+			content: result.content ?? [],
+			structuredContent: result.structuredContent,
+			isError: result.isError
+		};
+	});
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
+	const handle = async (request, recorder) => {
+		const authResult = await authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		try {
+			const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
+				name: mcp.name,
+				version: mcp.version,
+				title: mcp.title
+			}, { instructions: mcp.instructions });
+			for (const tool of mcp.tools) server.registerTool(tool.name, {
+				title: tool.title,
+				description: tool.description,
+				inputSchema: tool.inputSchema,
+				outputSchema: tool.outputSchema,
+				annotations: tool.annotations
+			}, adaptToolToSdkCallback(tool, authResult.auth, recorder));
+			const transport = new _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js.WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+			await server.connect(transport);
+			return await transport.handleRequest(request);
+		} catch (err) {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			require_logger.log.error("mcp.transport_error", {
+				...require_logger.describeError(err),
+				outcome: "500 internal error"
+			});
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return async (request, recorder = require_cors.createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return require_cors.corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+		return require_cors.withCors(await handle(request, recorder));
+	};
+}
+//#endregion
+Object.defineProperty(exports, "createMcpProtocolHandler", {
+	enumerable: true,
+	get: function() {
+		return createMcpProtocolHandler;
+	}
+});

package/dist/mcp-CALHyhDi.js

@@ -0,0 +1,123 @@
+import { i as log, r as describeError } from "./logger-2OXtfiIW.js";
+import { t as ToolContext } from "./context-CIpPzN7P.js";
+import { d as nowMs, i as createRequestAuthorizer, n as withCors, t as corsPreflightResponse, u as createNoopRecorder } from "./cors-CJRL7tyh.js";
+import { t as extractTextContent } from "./content-D5LJAHyM.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+//#region src/protocols/mcp/protocol.ts
+/**
+* Adapt a Lovable tool to the SDK's tool callback. The boundary cast bridges
+* our SDK-decoupled content-block types to the SDK's; they match structurally.
+*/
+function adaptToolToSdkCallback(tool, auth, recorder) {
+	const endUserId = auth?.principal.sub;
+	return (async (first) => {
+		const args = tool.inputSchema ? first ?? {} : {};
+		const start = nowMs();
+		let result;
+		try {
+			result = await tool.handler(args, new ToolContext(auth));
+		} catch {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: "tool execution failed"
+				}],
+				isError: true
+			};
+		}
+		if (result == null) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: nowMs() - start,
+				endUserId
+			});
+			return {
+				content: [{
+					type: "text",
+					text: `tool "${tool.name}" returned no result`
+				}],
+				isError: true
+			};
+		}
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: result.isError ? "tool_error" : "ok",
+			durationMs: nowMs() - start,
+			errorText: result.isError ? extractTextContent(result.content) : void 0,
+			endUserId
+		});
+		return {
+			content: result.content ?? [],
+			structuredContent: result.structuredContent,
+			isError: result.isError
+		};
+	});
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = createRequestAuthorizer(mcp, options);
+	const handle = async (request, recorder) => {
+		const authResult = await authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		try {
+			const server = new McpServer({
+				name: mcp.name,
+				version: mcp.version,
+				title: mcp.title
+			}, { instructions: mcp.instructions });
+			for (const tool of mcp.tools) server.registerTool(tool.name, {
+				title: tool.title,
+				description: tool.description,
+				inputSchema: tool.inputSchema,
+				outputSchema: tool.outputSchema,
+				annotations: tool.annotations
+			}, adaptToolToSdkCallback(tool, authResult.auth, recorder));
+			const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+			await server.connect(transport);
+			return await transport.handleRequest(request);
+		} catch (err) {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			log.error("mcp.transport_error", {
+				...describeError(err),
+				outcome: "500 internal error"
+			});
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return async (request, recorder = createNoopRecorder()) => {
+		if (request.method === "OPTIONS") return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+		return withCors(await handle(request, recorder));
+	};
+}
+//#endregion
+export { createMcpProtocolHandler as t };

package/dist/metadata-path-CAkNcfyY.js

@@ -0,0 +1,12 @@
+//#region src/auth/metadata-path.ts
+/**
+* Default RFC 9728 protected-resource metadata path. Used by the runtime 401
+* challenge (`authorize.ts`, which advertises this URL via the
+* `WWW-Authenticate: resource_metadata` param) and the Vite plugin (which emits
+* the route that serves it) when no `metadataPath` is configured. A configured
+* `metadataPath` overrides it; the plugin injects that same path into every
+* emitted handler, so the advertised URL and the served route still can't drift.
+*/
+const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+//#endregion
+export { OAUTH_PROTECTED_RESOURCE_METADATA_PATH as t };

package/dist/metadata-path-zd7NSNoa.cjs

@@ -0,0 +1,17 @@
+//#region src/auth/metadata-path.ts
+/**
+* Default RFC 9728 protected-resource metadata path. Used by the runtime 401
+* challenge (`authorize.ts`, which advertises this URL via the
+* `WWW-Authenticate: resource_metadata` param) and the Vite plugin (which emits
+* the route that serves it) when no `metadataPath` is configured. A configured
+* `metadataPath` overrides it; the plugin injects that same path into every
+* emitted handler, so the advertised URL and the served route still can't drift.
+*/
+const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+//#endregion
+Object.defineProperty(exports, "OAUTH_PROTECTED_RESOURCE_METADATA_PATH", {
+	enumerable: true,
+	get: function() {
+		return OAUTH_PROTECTED_RESOURCE_METADATA_PATH;
+	}
+});

package/dist/package-CLTXgGyU.cjs

@@ -0,0 +1,9 @@
+//#region package.json
+var version = "0.22.1-rc.1";
+//#endregion
+Object.defineProperty(exports, "version", {
+	enumerable: true,
+	get: function() {
+		return version;
+	}
+});

package/dist/package-g7-GHkOW.js

@@ -0,0 +1,4 @@
+//#region package.json
+var version = "0.22.1-rc.1";
+//#endregion
+export { version as t };

package/dist/paths-IS65L6TA.js

@@ -0,0 +1,7 @@
+//#region src/stacks/supabase/paths.ts
+const FUNCTIONS_MOUNT_PREFIX = "/functions/v1/";
+function assertFunctionName(value, label = "functionName") {
+	if (!/^[a-zA-Z0-9_-]+$/.test(value)) throw new Error(`@lovable.dev/mcp-js: ${label} must be a single path segment matching [A-Za-z0-9_-], got ${JSON.stringify(value)}`);
+}
+//#endregion
+export { assertFunctionName as n, FUNCTIONS_MOUNT_PREFIX as t };

package/dist/paths-OP318a6c.cjs

@@ -0,0 +1,18 @@
+//#region src/stacks/supabase/paths.ts
+const FUNCTIONS_MOUNT_PREFIX = "/functions/v1/";
+function assertFunctionName(value, label = "functionName") {
+	if (!/^[a-zA-Z0-9_-]+$/.test(value)) throw new Error(`@lovable.dev/mcp-js: ${label} must be a single path segment matching [A-Za-z0-9_-], got ${JSON.stringify(value)}`);
+}
+//#endregion
+Object.defineProperty(exports, "FUNCTIONS_MOUNT_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return FUNCTIONS_MOUNT_PREFIX;
+	}
+});
+Object.defineProperty(exports, "assertFunctionName", {
+	enumerable: true,
+	get: function() {
+		return assertFunctionName;
+	}
+});