@lovable.dev/mcp-js 0.22.1 → 0.22.2-rc.0

package/dist/stacks/supabase/index.d.cts

@@ -1,33 +1,32 @@
-import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import 'zod';
-
+import { c as McpDefinition } from "../../types-BYdYYTjk.cjs";
+//#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {
-    /**
-     * Supabase function directory name (the segment under `supabase/functions/`).
-     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
-     * protected-resource metadata binds to the canonical public MCP URL rather
-     * than the request path the dispatcher was reached through.
-     *
-     * Either `functionName` or `resourcePath` is required when OAuth auth is
-     * configured and `auth.resource` is not pinned.
-     */
-    functionName?: string;
-    /**
-     * Explicit override for the public MCP route path. Wins over `functionName`
-     * when both are set. Use when the function is fronted by a custom router or
-     * a Lovable Cloud–style host that rewrites the public URL.
-     */
-    resourcePath?: string;
-    /**
-     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
-     * instead of the request `Host`, so a function fronted by a custom-domain
-     * proxy advertises the public host. Off by default: enable only behind a
-     * proxy that overwrites the header (an unsanitized one lets a client spoof
-     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
-     * Supabase terminates TLS upstream and forwards over http.
-     */
-    trustForwardedHost?: boolean;
+  /**
+   * Supabase function directory name (the segment under `supabase/functions/`).
+   * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+   * protected-resource metadata binds to the canonical public MCP URL rather
+   * than the request path the dispatcher was reached through.
+   *
+   * Either `functionName` or `resourcePath` is required when OAuth auth is
+   * configured and `auth.resource` is not pinned.
+   */
+  functionName?: string;
+  /**
+   * Explicit override for the public MCP route path. Wins over `functionName`
+   * when both are set. Use when the function is fronted by a custom router or
+   * a Lovable Cloud–style host that rewrites the public URL.
+   */
+  resourcePath?: string;
+  /**
+   * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+   * instead of the request `Host`, so a function fronted by a custom-domain
+   * proxy advertises the public host. Off by default: enable only behind a
+   * proxy that overwrites the header (an unsanitized one lets a client spoof
+   * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+   * Supabase terminates TLS upstream and forwards over http.
+   */
+  trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from
@@ -44,5 +43,5 @@ interface SupabaseHandlerOptions {
  * The same OAuth bearer gate protects every dispatch target.
  */
 declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
-
-export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };
+//#endregion
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.d.ts

@@ -1,33 +1,32 @@
-import { d as McpDefinition } from '../../types-qqrmJ736.js';
-import 'zod';
-
+import { c as McpDefinition } from "../../types-BYdYYTjk.js";
+//#region src/stacks/supabase/handler.d.ts
 type SupabaseHandler = (request: Request) => Promise<Response>;
 interface SupabaseHandlerOptions {
-    /**
-     * Supabase function directory name (the segment under `supabase/functions/`).
-     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
-     * protected-resource metadata binds to the canonical public MCP URL rather
-     * than the request path the dispatcher was reached through.
-     *
-     * Either `functionName` or `resourcePath` is required when OAuth auth is
-     * configured and `auth.resource` is not pinned.
-     */
-    functionName?: string;
-    /**
-     * Explicit override for the public MCP route path. Wins over `functionName`
-     * when both are set. Use when the function is fronted by a custom router or
-     * a Lovable Cloud–style host that rewrites the public URL.
-     */
-    resourcePath?: string;
-    /**
-     * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
-     * instead of the request `Host`, so a function fronted by a custom-domain
-     * proxy advertises the public host. Off by default: enable only behind a
-     * proxy that overwrites the header (an unsanitized one lets a client spoof
-     * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
-     * Supabase terminates TLS upstream and forwards over http.
-     */
-    trustForwardedHost?: boolean;
+  /**
+   * Supabase function directory name (the segment under `supabase/functions/`).
+   * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+   * protected-resource metadata binds to the canonical public MCP URL rather
+   * than the request path the dispatcher was reached through.
+   *
+   * Either `functionName` or `resourcePath` is required when OAuth auth is
+   * configured and `auth.resource` is not pinned.
+   */
+  functionName?: string;
+  /**
+   * Explicit override for the public MCP route path. Wins over `functionName`
+   * when both are set. Use when the function is fronted by a custom router or
+   * a Lovable Cloud–style host that rewrites the public URL.
+   */
+  resourcePath?: string;
+  /**
+   * Derive the advertised `resource`/metadata host from `X-Forwarded-Host`
+   * instead of the request `Host`, so a function fronted by a custom-domain
+   * proxy advertises the public host. Off by default: enable only behind a
+   * proxy that overwrites the header (an unsanitized one lets a client spoof
+   * the advertised resource). `X-Forwarded-Proto` is trusted regardless —
+   * Supabase terminates TLS upstream and forwards over http.
+   */
+  trustForwardedHost?: boolean;
 }
 /**
  * Build a single Web-Standard handler that serves the full MCP surface from
@@ -44,5 +43,5 @@ interface SupabaseHandlerOptions {
  * The same OAuth bearer gate protects every dispatch target.
  */
 declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
-
-export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };
+//#endregion
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.js

@@ -1,95 +1,79 @@
-import {
-  applyForwardedOrigin
-} from "../../chunk-UQK5UO6C.js";
-import {
-  createMcpProtocolHandler
-} from "../../chunk-5HVSJCKE.js";
-import {
-  createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-IXZIFYO6.js";
-import {
-  createInvokeToolHandler
-} from "../../chunk-TJN33K5U.js";
-import {
-  createListToolsHandler
-} from "../../chunk-6SZOFKGH.js";
-import "../../chunk-6QFZYYUV.js";
-import "../../chunk-MA5H6PSF.js";
-import {
-  assertResourcePathShape,
-  createRecorderForRuntime
-} from "../../chunk-IFDWUM7L.js";
-import {
-  trimTrailingSlash
-} from "../../chunk-H37EB22A.js";
-import {
-  OAUTH_PROTECTED_RESOURCE_METADATA_PATH
-} from "../../chunk-6DXGZZA4.js";
-import {
-  FUNCTIONS_MOUNT_PREFIX,
-  assertFunctionName
-} from "../../chunk-XQWJN6DC.js";
-import "../../chunk-ZQXSWTPU.js";
-
-// src/stacks/supabase/handler.ts
+import { s as trimTrailingSlash } from "../../logger-2OXtfiIW.js";
+import { l as createRecorderForRuntime, s as assertResourcePathShape } from "../../cors-rWp_tbLZ.js";
+import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Bx3bJHzH.js";
+import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
+import { n as createListToolsHandler } from "../../list-tools-DVJrjtmH.js";
+import { t as createInvokeToolHandler } from "../../rest-BRshnow2.js";
+import { t as applyForwardedOrigin } from "../../forwarded--h4efJy-.js";
+import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
+//#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
-  if (options.resourcePath !== void 0)
-    return options.resourcePath;
-  if (options.functionName === void 0)
-    return void 0;
-  assertFunctionName(options.functionName);
-  return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
+	if (options.resourcePath !== void 0) return options.resourcePath;
+	if (options.functionName === void 0) return void 0;
+	assertFunctionName(options.functionName);
+	return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
 }
 function dispatchFor(pathname) {
-  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
-  if (path.endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
-    return { kind: "metadata" };
-  }
-  if (path.endsWith("/.mcp/list-tools")) {
-    return { kind: "list-tools" };
-  }
-  const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
-  if (invokeMatch) {
-    let toolName;
-    try {
-      toolName = decodeURIComponent(invokeMatch[1]);
-    } catch {
-      return { kind: "mcp" };
-    }
-    return { kind: "invoke-tool", toolName };
-  }
-  return { kind: "mcp" };
+	const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+	if (path.endsWith("/.well-known/oauth-protected-resource")) return { kind: "metadata" };
+	if (path.endsWith("/.mcp/list-tools")) return { kind: "list-tools" };
+	const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
+	if (invokeMatch) {
+		let toolName;
+		try {
+			toolName = decodeURIComponent(invokeMatch[1]);
+		} catch {
+			return { kind: "mcp" };
+		}
+		return {
+			kind: "invoke-tool",
+			toolName
+		};
+	}
+	return { kind: "mcp" };
 }
+/**
+* Build a single Web-Standard handler that serves the full MCP surface from
+* one Supabase Edge Function. The returned handler dispatches by URL suffix:
+*
+* | Suffix | Target |
+* | --- | --- |
+* | `/.well-known/oauth-protected-resource` | RFC 9728 metadata |
+* | `/.mcp/list-tools` | REST tool catalog |
+* | `/.mcp/invoke-tool/<tool>` | REST tool dispatcher |
+* | (anything else) | MCP streamable-HTTP protocol |
+*
+* Pass the handler to `Deno.serve(...)` in the emitted function entry.
+* The same OAuth bearer gate protects every dispatch target.
+*/
 function createSupabaseHandler(mcp, options = {}) {
-  const resourcePath = deriveResourcePath(options);
-  if (resourcePath !== void 0)
-    assertResourcePathShape(resourcePath);
-  const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
-  const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
-  const runtimeOptions = resourcePath === void 0 ? {} : { resourcePath, ...metadataPath ? { metadataPath } : {} };
-  const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
-  const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
-  const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
-  const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
-  return async (request) => {
-    const req = applyForwardedOrigin(request, {
-      trustForwardedProto: true,
-      trustForwardedHost: options.trustForwardedHost
-    });
-    const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
-    const target = dispatchFor(new URL(req.url).pathname);
-    switch (target.kind) {
-      case "metadata":
-        return metadataHandler(req);
-      case "list-tools":
-        return listToolsHandler(req, recorder);
-      case "invoke-tool":
-        return invokeToolHandler(req, target.toolName, recorder);
-      case "mcp":
-        return mcpHandler(req, recorder);
-    }
-  };
+	const resourcePath = deriveResourcePath(options);
+	if (resourcePath !== void 0) assertResourcePathShape(resourcePath);
+	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
+	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
+	const runtimeOptions = resourcePath === void 0 ? {} : {
+		resourcePath,
+		...metadataPath ? { metadataPath } : {}
+	};
+	const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
+	const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
+	const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
+	const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
+	return async (request) => {
+		const req = applyForwardedOrigin(request, {
+			trustForwardedProto: true,
+			trustForwardedHost: options.trustForwardedHost
+		});
+		const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
+		const target = dispatchFor(new URL(req.url).pathname);
+		switch (target.kind) {
+			case "metadata": return metadataHandler(req);
+			case "list-tools": return listToolsHandler(req, recorder);
+			case "invoke-tool": return invokeToolHandler(req, target.toolName, recorder);
+			case "mcp": return mcpHandler(req, recorder);
+		}
+	};
 }
-export {
-  createSupabaseHandler
-};
+//#endregion
+export { createSupabaseHandler };