@lovable.dev/mcp-js 0.22.1 → 0.22.2-rc.1

package/dist/stacks/supabase/index.cjs

@@ -1,1322 +1,80 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/stacks/supabase/index.ts
-var supabase_exports = {};
-__export(supabase_exports, {
-  createSupabaseHandler: () => createSupabaseHandler
-});
-module.exports = __toCommonJS(supabase_exports);
-
-// src/auth/metadata-path.ts
-var OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
-
-// src/core/url.ts
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function isLocalHTTPHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function urlSafetyProblem(url) {
-  const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
-  if (url.protocol !== "https:" && !isAllowedHTTP) {
-    return "must use https://, except localhost development URLs";
-  }
-  if (url.username || url.password) {
-    return "must not include credentials";
-  }
-  if (url.search || url.hash) {
-    return "must not include query or fragment";
-  }
-  return void 0;
-}
-
-// src/auth/resource.ts
-function resolveProtectedResource(auth, request, options) {
-  if (auth.resource)
-    return trimTrailingSlash(auth.resource);
-  const path = resolveResourcePath(options.resourcePath, request);
-  const resourceURL = new URL(path, request.url);
-  resourceURL.search = "";
-  resourceURL.hash = "";
-  return trimTrailingSlash(resourceURL.toString());
-}
-function assertResourcePathShape(resourcePath, label = "resourcePath") {
-  if (!resourcePath.startsWith("/") || resourcePath.startsWith("//") || resourcePath.includes("\\") || /(^|\/)\.\.(\/|$)/.test(resourcePath)) {
-    throw new Error(
-      `@lovable.dev/mcp-js: ${label} must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
-    );
-  }
-}
-function resolveResourcePath(resourcePath, request) {
-  if (resourcePath === void 0)
-    return new URL(request.url).pathname;
-  assertResourcePathShape(resourcePath);
-  return resourcePath;
-}
-
-// src/core/forwarded.ts
-function applyForwardedOrigin(request, options) {
-  const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
-  const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
-  if (proto === void 0 && host === void 0)
-    return request;
-  const url = new URL(request.url);
-  let changed = false;
-  if (proto !== void 0 && `${proto}:` !== url.protocol) {
-    url.protocol = `${proto}:`;
-    changed = true;
-  }
-  if (host !== void 0 && host !== url.host) {
-    url.host = host;
-    changed = true;
-  }
-  return changed ? new Request(url.href, request) : request;
-}
-function firstForwardedValue(request, header) {
-  const value = request.headers.get(header)?.split(",")[0]?.trim();
-  return value ? value : void 0;
-}
-
-// src/metrics/config.ts
-var DEFAULT_METRICS_ENDPOINT = "https://api.lovable.dev/v1/app-mcp-usage";
-var METRICS_API_KEY_ENV_VAR = "LOVABLE_API_KEY";
-function assertMetricsEndpoint(endpoint) {
-  let url;
-  try {
-    url = new URL(endpoint);
-  } catch {
-    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be an absolute URL, got ${JSON.stringify(endpoint)}`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new Error(`@lovable.dev/mcp-js: metrics.endpoint must be http(s), got ${JSON.stringify(endpoint)}`);
-  }
-}
-function resolveMetricsConfig(config = true) {
-  const options = typeof config === "boolean" ? { enabled: config } : config;
-  const endpoint = options.endpoint ?? DEFAULT_METRICS_ENDPOINT;
-  assertMetricsEndpoint(endpoint);
-  return Object.freeze({
-    enabled: options.enabled ?? true,
-    endpoint,
-    headers: options.headers ?? {},
-    apiKeyEnvVar: METRICS_API_KEY_ENV_VAR
-  });
-}
-
-// src/core/logger.ts
-var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
-function isLogLevel(value) {
-  return typeof value === "string" && value in LEVEL_RANK;
-}
-var LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
-function readEnvLevel() {
-  try {
-    const raw = typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0;
-    const normalized = raw?.trim().toLowerCase();
-    return isLogLevel(normalized) ? normalized : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var currentLevel = readEnvLevel() ?? "debug";
-function setLogLevel(level) {
-  currentLevel = level;
-}
-function parseLogLevel(raw) {
-  const normalized = raw?.trim().toLowerCase();
-  return isLogLevel(normalized) ? normalized : void 0;
-}
-function applyLogLevelFromEnv(raw) {
-  setLogLevel(parseLogLevel(raw) ?? "debug");
-}
-function enabled(level) {
-  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
-}
-function emit(level, method, event, fields) {
-  if (!enabled(level))
-    return;
-  const message = `[mcp-js] ${event}`;
-  if (fields)
-    console[method](message, fields);
-  else
-    console[method](message);
-}
-var log = {
-  error: (event, fields) => emit("error", "error", event, fields),
-  warn: (event, fields) => emit("warn", "warn", event, fields),
-  info: (event, fields) => emit("info", "info", event, fields),
-  debug: (event, fields) => emit("debug", "debug", event, fields)
-};
-function describeError(err) {
-  if (err instanceof Error) {
-    const code = err.code;
-    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
-  }
-  return { value: String(err) };
-}
-
-// package.json
-var version = "0.22.1";
-
-// src/metrics/otlp.ts
-var SCOPE_NAME = "@lovable.dev/mcp-js";
-var EVENT_NAME = "mcp.tool.invocation";
-var SEVERITY_INFO = 9;
-function strAttr(key, value) {
-  return { key, value: { stringValue: value } };
-}
-function intAttr(key, value) {
-  return { key, value: { intValue: String(Math.round(value)) } };
-}
-function toLogRecord(rec) {
-  const attributes = [
-    strAttr("event.name", EVENT_NAME),
-    strAttr("mcp.method", rec.method),
-    strAttr("mcp.outcome", rec.outcome),
-    intAttr("mcp.duration_ms", rec.durationMs)
-  ];
-  if (rec.tool !== null)
-    attributes.push(strAttr("mcp.tool", rec.tool));
-  if (rec.reqBytes !== void 0)
-    attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
-  if (rec.resBytes !== void 0)
-    attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
-  attributes.push(strAttr("mcp.stack", rec.stack));
-  if (rec.endUserId !== void 0)
-    attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
-  return {
-    timeUnixNano: rec.timeUnixNano,
-    observedTimeUnixNano: rec.timeUnixNano,
-    severityNumber: SEVERITY_INFO,
-    severityText: "INFO",
-    body: { stringValue: EVENT_NAME },
-    attributes
-  };
-}
-function buildLogsPayload(records, server) {
-  return JSON.stringify({
-    resourceLogs: [
-      {
-        resource: {
-          attributes: [
-            strAttr("service.name", server.name),
-            strAttr("service.version", server.version),
-            strAttr("telemetry.sdk.name", SCOPE_NAME),
-            strAttr("telemetry.sdk.version", version),
-            strAttr("telemetry.sdk.language", "webjs")
-          ]
-        },
-        scopeLogs: [
-          {
-            scope: { name: SCOPE_NAME, version },
-            logRecords: records.map(toLogRecord)
-          }
-        ]
-      }
-    ]
-  });
-}
-function nowUnixNano() {
-  return `${Date.now()}000000`;
-}
-
-// src/metrics/impl/base.ts
-function nowMs() {
-  return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
-}
-var NOOP_RECORDER = { async emit() {
-} };
-function createNoopRecorder() {
-  return NOOP_RECORDER;
-}
-function readProcessEnv(name) {
-  try {
-    return typeof process !== "undefined" ? process.env?.[name] || void 0 : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var BaseMetricRecorder = class {
-  constructor(config, server, deps = {}) {
-    this.config = config;
-    this.server = server;
-    this.deps = deps;
-    this.doFetch = deps.fetch ?? (typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : void 0);
-    this.usesLovableEndpoint = config.endpoint === DEFAULT_METRICS_ENDPOINT;
-    const headers = {};
-    if (!this.usesLovableEndpoint) {
-      for (const [key, value] of Object.entries(config.headers)) {
-        if (key.toLowerCase() !== "content-type")
-          headers[key] = value;
-      }
-    }
-    headers["content-type"] = "application/json";
-    this.baseHeaders = headers;
-  }
-  doFetch;
-  usesLovableEndpoint;
-  baseHeaders;
-  apiKey;
-  lazyLogLevelApplied = false;
-  async emit(ev) {
-    await this.applyLazyLogLevel();
-    log.info("tool.invoked", {
-      tool: ev.tool,
-      method: ev.method,
-      outcome: ev.outcome,
-      durationMs: ev.durationMs,
-      stack: this.stack,
-      ...ev.errorText !== void 0 && { errorText: ev.errorText }
-    });
-    if (!this.config.enabled)
-      return;
-    if (!this.doFetch) {
-      log.warn("metrics.disabled_no_fetch", { endpoint: this.config.endpoint });
-      return;
-    }
-    const headers = { ...this.baseHeaders };
-    if (this.usesLovableEndpoint) {
-      const key = await this.resolveApiKey();
-      if (!key) {
-        log.warn("metrics.disabled_no_api_key", { envVar: this.config.apiKeyEnvVar, endpoint: this.config.endpoint });
-        return;
-      }
-      headers.authorization = `Bearer ${key}`;
-    }
-    const body = buildLogsPayload([{ ...ev, timeUnixNano: nowUnixNano(), stack: this.stack }], this.server);
-    try {
-      const res = await this.doFetch(this.config.endpoint, { method: "POST", headers, body, keepalive: true });
-      if (!res.ok)
-        log.warn("metrics.rejected", { status: res.status, endpoint: this.config.endpoint });
-    } catch (err) {
-      log.warn("metrics.failed", { ...describeError(err), endpoint: this.config.endpoint });
-    }
-  }
-  // Cache only a successful resolution so a miss is retried on the next emit (the
-  // Cloudflare binding may not be readable on the very first attempt in an isolate).
-  async resolveApiKey() {
-    if (this.apiKey)
-      return this.apiKey;
-    this.apiKey = this.deps.getApiKey ? this.deps.getApiKey() : await this.readEnv(this.config.apiKeyEnvVar);
-    return this.apiKey;
-  }
-  async applyLazyLogLevel() {
-    if (this.lazyLogLevelApplied)
-      return;
-    this.lazyLogLevelApplied = true;
-    applyLogLevelFromEnv(await this.readEnv(LOG_LEVEL_ENV_VAR));
-  }
-};
-
-// src/metrics/impl/cloudflare.ts
-var cloudflareEnvPromise;
-async function readCloudflareEnv(name) {
-  try {
-    const moduleSpecifier = "cloudflare:workers";
-    cloudflareEnvPromise ??= import(
-      /* @vite-ignore */
-      moduleSpecifier
-    ).then((m) => m.env).catch((err) => {
-      log.debug("metrics.cloudflare_env_import_failed", describeError(err));
-      return void 0;
-    });
-    const env = await cloudflareEnvPromise;
-    const raw = env?.[name];
-    const value = typeof raw === "string" && raw ? raw : void 0;
-    log.debug("metrics.read_cloudflare_env", { name, hasEnvBinding: !!env, found: value !== void 0 });
-    return value;
-  } catch (err) {
-    log.debug("metrics.read_cloudflare_env_error", { name, ...describeError(err) });
-    return void 0;
-  }
-}
-var TanStackMetricRecorder = class extends BaseMetricRecorder {
-  stack = "tanstack";
-  async readEnv(name) {
-    return readProcessEnv(name) ?? await readCloudflareEnv(name);
-  }
-};
-
-// src/metrics/impl/supabase.ts
-function readDenoEnv(name) {
-  try {
-    const denoEnv = globalThis.Deno?.env;
-    const value = denoEnv?.get?.(name) || void 0;
-    log.debug("metrics.read_deno_env", { name, hasDenoEnv: !!denoEnv, found: !!value });
-    return value;
-  } catch (err) {
-    log.debug("metrics.read_deno_env_error", { name, ...describeError(err) });
-    return void 0;
-  }
-}
-var SupabaseMetricRecorder = class extends BaseMetricRecorder {
-  stack = "supabase";
-  async readEnv(name) {
-    return readDenoEnv(name) ?? readProcessEnv(name);
-  }
-};
-
-// src/metrics/recorder.ts
-function createRecorderForRuntime(mcp, opts) {
-  const config = resolveMetricsConfig(mcp.metrics);
-  const server = { name: mcp.name, version: mcp.version };
-  if (!config.enabled)
-    return createNoopRecorder();
-  return opts.stack === "tanstack" ? new TanStackMetricRecorder(config, server) : new SupabaseMetricRecorder(config, server);
-}
-
-// src/protocols/mcp/protocol.ts
-var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
-var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
-
-// src/core/http.ts
-var JSON_HEADERS = { "Content-Type": "application/json" };
-function headResponse(response) {
-  return new Response(null, { status: response.status, statusText: response.statusText, headers: response.headers });
-}
-function methodNotAllowed(allow) {
-  return new Response(JSON.stringify({ error: "method not allowed" }), {
-    status: 405,
-    headers: { ...JSON_HEADERS, Allow: allow }
-  });
-}
-
-// src/core/promise.ts
-function cachedPromise(load, label) {
-  let settled = false;
-  let value;
-  return async () => {
-    if (settled) {
-      if (label)
-        log.debug(`${label}.cache_hit`);
-      return value;
-    }
-    if (label)
-      log.debug(`${label}.load_start`);
-    try {
-      const loaded = await load();
-      settled = true;
-      value = loaded;
-      if (label)
-        log.debug(`${label}.settled`);
-      return loaded;
-    } catch (err) {
-      if (label)
-        log.debug(`${label}.load_failed`, describeError(err));
-      throw err;
-    }
-  };
-}
-
-// src/core/validation.ts
-function parseSafeUrl(subject, raw, ErrorClass = Error) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new ErrorClass(`${subject} must be an absolute URL`);
-  }
-  const problem = urlSafetyProblem(url);
-  if (problem) {
-    throw new ErrorClass(`${subject} ${problem}`);
-  }
-  return url;
-}
-
-// src/auth/discovery.ts
-var OAuthConfigurationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OAuthConfigurationError";
-  }
-};
-var METADATA_FETCH_TIMEOUT_MS = 5e3;
-function issuerPath(url) {
-  const path = trimTrailingSlash(url.pathname);
-  return path === "" ? void 0 : path;
-}
-function pathInsertedOAuthMetadataUrls(url, path) {
-  return [
-    `${url.origin}/.well-known/oauth-authorization-server${path}`,
-    `${url.origin}/.well-known/openid-configuration${path}`
-  ];
-}
-function oauthMetadataUrlsForIssuer(issuer) {
-  const normalizedIssuer = trimTrailingSlash(issuer);
-  const url = new URL(normalizedIssuer);
-  const path = issuerPath(url);
-  if (!path) {
-    return [
-      `${normalizedIssuer}/.well-known/oauth-authorization-server`,
-      `${normalizedIssuer}/.well-known/openid-configuration`
-    ];
-  }
-  return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
-}
-async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
-  const errors = [];
-  for (const url of metadataUrls) {
-    try {
-      return await fetchOAuthServerMetadata(url, expectedIssuer);
-    } catch (err) {
-      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
-      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
-  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
-}
-async function fetchOAuthServerMetadata(url, expectedIssuer) {
-  log.debug("oauth.discovery.fetch", { url });
-  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
-  if (!response.ok) {
-    throw new Error(String(response.status));
-  }
-  const json = await response.json();
-  if (typeof json.issuer !== "string") {
-    throw new Error("missing issuer");
-  }
-  parseSafeUrl("discovered issuer", json.issuer);
-  if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
-    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
-    throw new Error("issuer mismatch");
-  }
-  if (typeof json.jwks_uri !== "string") {
-    throw new Error("missing jwks_uri");
-  }
-  parseSafeUrl("discovered jwks_uri", json.jwks_uri);
-  return { issuer: json.issuer, jwks_uri: json.jwks_uri };
-}
-async function fetchIssuerOAuthServerMetadata(issuer) {
-  try {
-    return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
-  } catch (err) {
-    log.error("oauth.discovery.config_error", {
-      issuer,
-      ...describeError(err),
-      outcome: "500 oauth configuration error"
-    });
-    throw new OAuthConfigurationError(
-      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-function createOAuthDiscoveryResolver(auth) {
-  const configuredIssuer = trimTrailingSlash(auth.issuer);
-  const oauthServerMetadata = cachedPromise(
-    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
-    "oauth.discovery.metadata"
-  );
-  return {
-    resolveIssuer: async () => configuredIssuer,
-    resolveJwksUri: async () => {
-      if (auth.jwksUri) {
-        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
-        return auth.jwksUri;
-      }
-      const jwksUri = (await oauthServerMetadata()).jwks_uri;
-      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
-      return jwksUri;
-    }
-  };
-}
-
-// src/auth/verifier.ts
-var import_jose = require("jose");
-
-// src/auth/claims.ts
-function readString(value) {
-  return typeof value === "string" ? value : void 0;
-}
-function splitScopes(value) {
-  if (typeof value === "string")
-    return value.split(/\s+/).filter(Boolean);
-  return stringClaimList(value);
-}
-function stringClaim(claims, name) {
-  return readString(claims[name]);
-}
-function stringClaimList(value) {
-  if (typeof value === "string")
-    return value === "" ? [] : [value];
-  if (Array.isArray(value))
-    return value.filter((entry) => typeof entry === "string" && entry !== "");
-  return [];
-}
-
-// src/auth/verifier.ts
-var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
-var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
-var DEFAULT_ACCESS_TOKEN_TYPS = ["at+jwt", "JWT"];
-var JWKS_FETCH_TIMEOUT_MS = 5e3;
-var OAuthTokenError = class extends Error {
-  constructor(status, oauthError, message) {
-    super(message);
-    this.status = status;
-    this.oauthError = oauthError;
-    this.name = "OAuthTokenError";
-  }
-};
-function resolveAcceptedAudiences(auth, resource) {
-  return auth.acceptedAudiences ?? [resource];
-}
-function tokenHeaderFields(token) {
-  try {
-    const header = (0, import_jose.decodeProtectedHeader)(token);
-    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
-  } catch {
-    return { tokenLength: token.length };
-  }
-}
-async function fetchVerificationKeySet(jwksUri) {
-  try {
-    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
-    if (!response.ok)
-      throw new Error(`JWKS endpoint returned ${response.status}`);
-    const json = await response.json();
-    return (0, import_jose.createLocalJWKSet)(json);
-  } catch (err) {
-    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
-    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-function assertAccessTokenTyp(token, allowed) {
-  let header;
-  try {
-    header = (0, import_jose.decodeProtectedHeader)(token);
-  } catch (err) {
-    log.debug("oauth.verify.bad_header", { ...describeError(err), outcome: "401 invalid_token" });
-    throw new OAuthTokenError(401, "invalid_token", "Malformed JWT header");
-  }
-  const typ = header.typ;
-  if (typeof typ !== "string" || !allowed.includes(typ)) {
-    log.debug("oauth.verify.bad_typ", { jwtTyp: typ, allowed, outcome: "401 invalid_token" });
-    throw new OAuthTokenError(401, "invalid_token", "Access token typ header is not accepted");
-  }
-}
-async function verifyJwtClaims(token, keySet, issuer, auth) {
-  try {
-    const { payload } = await (0, import_jose.jwtVerify)(token, keySet, {
-      // `issuer` is trimmed of any trailing slash; accept both forms so a token whose
-      // `iss` carries the slash the AS publishes still verifies.
-      issuer: [issuer, `${issuer}/`],
-      algorithms: auth.algorithms ? [...auth.algorithms] : DEFAULT_JWT_ALGORITHMS,
-      requiredClaims: ["sub", "exp"],
-      clockTolerance: auth.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS
-    });
-    return payload;
-  } catch (err) {
-    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
-    throw err;
-  }
-}
-function checkAcceptedAudience(claims, accepted, auth) {
-  const audPopulated = claims.aud !== void 0 && !(Array.isArray(claims.aud) && claims.aud.length === 0);
-  if (audPopulated) {
-    if (stringClaimList(claims.aud).some((audience) => accepted.includes(audience)))
-      return "aud";
-    log.debug("oauth.verify.bad_audience", { tokenAud: claims.aud, accepted, outcome: "401 invalid_token" });
-  } else if (auth.acceptResourceClaim !== false) {
-    const acceptedTrimmed = accepted.map(trimTrailingSlash);
-    if (stringClaimList(claims.resource).some((resource) => acceptedTrimmed.includes(trimTrailingSlash(resource))))
-      return "resource";
-    log.debug("oauth.verify.bad_resource", { tokenResource: claims.resource, accepted, outcome: "401 invalid_token" });
-  } else {
-    log.debug("oauth.verify.empty_audience", { accepted, outcome: "401 invalid_token" });
-  }
-  throw new OAuthTokenError(401, "invalid_token", "token audience is not accepted");
-}
-function assertNonEmptySubject(claims) {
-  const sub = claims["sub"];
-  if (typeof sub !== "string" || sub.trim() === "") {
-    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
-    throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
-  }
-}
-function assertOAuthClientClaim(auth, clientId) {
-  if (auth.requireOAuthClientClaim !== false && !clientId) {
-    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
-    throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
-  }
-}
-function makeBearer(token) {
-  return Object.defineProperty({}, "token", { value: token, enumerable: false });
-}
-function buildMcpAuthContext(args) {
-  const { claims } = args;
-  return {
-    type: "oauth",
-    principal: {
-      claims,
-      issuer: args.issuer,
-      resource: args.resource,
-      acceptedAudiences: args.acceptedAudiences,
-      scopes: splitScopes(claims.scope),
-      sub: stringClaim(claims, "sub"),
-      email: stringClaim(claims, "email"),
-      clientId: stringClaim(claims, "client_id") ?? stringClaim(claims, "azp")
-    },
-    bearer: makeBearer(args.token)
-  };
-}
-function createOAuthTokenVerifier(auth, discovery) {
-  const allowedTyps = auth.accessTokenTyp ?? DEFAULT_ACCESS_TOKEN_TYPS;
-  return async (token, request, options) => {
-    const resource = resolveProtectedResource(auth, request, options);
-    const issuer = await discovery.resolveIssuer();
-    const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
-    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
-    const jwksUri = await discovery.resolveJwksUri();
-    log.debug("oauth.jwks.fetch", { jwksUri });
-    const keySet = await fetchVerificationKeySet(jwksUri);
-    assertAccessTokenTyp(token, allowedTyps);
-    const claims = await verifyJwtClaims(token, keySet, issuer, auth);
-    const audienceVia = checkAcceptedAudience(claims, acceptedAudiences, auth);
-    assertNonEmptySubject(claims);
-    const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
-    assertOAuthClientClaim(auth, context.principal.clientId);
-    log.info("oauth.verify.ok", {
-      sub: context.principal.sub,
-      clientId: context.principal.clientId,
-      scopes: context.principal.scopes,
-      audienceVia
-    });
-    return context;
-  };
-}
-
-// src/auth/authorize.ts
-function quoteAuthenticateParam(value) {
-  const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
-  return `"${sanitized.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function resolveProtectedResourceMetadataUrl(auth, request, options) {
-  if (auth.protectedResourceMetadataUrl !== void 0)
-    return auth.protectedResourceMetadataUrl;
-  const base = auth.resource ?? request.url;
-  return new URL(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
-}
-function wwwAuthenticateHeader(auth, request, options, params = {}) {
-  const values = [
-    `realm=${quoteAuthenticateParam("mcp")}`,
-    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request, options))}`
-  ];
-  if (auth.requiredScopes && auth.requiredScopes.length > 0) {
-    values.push(`scope=${quoteAuthenticateParam(auth.requiredScopes.join(" "))}`);
-  }
-  if (params.error)
-    values.push(`error=${quoteAuthenticateParam(params.error)}`);
-  if (params.errorDescription)
-    values.push(`error_description=${quoteAuthenticateParam(params.errorDescription)}`);
-  return `Bearer ${values.join(", ")}`;
-}
-function challengeResponse(auth, request, options, status, oauthError, errorDescription) {
-  const headers = new Headers(JSON_HEADERS);
-  headers.set(
-    "WWW-Authenticate",
-    wwwAuthenticateHeader(auth, request, options, { error: oauthError, errorDescription })
-  );
-  headers.set("Cache-Control", "no-store");
-  return new Response(JSON.stringify({ error: status === 403 ? "forbidden" : "unauthorized" }), {
-    status,
-    headers
-  });
-}
-function oauthConfigurationErrorResponse() {
-  return new Response(JSON.stringify({ error: "oauth configuration error" }), {
-    status: 500,
-    headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
-  });
-}
-function parseBearerToken(request) {
-  const header = request.headers.get("Authorization");
-  if (!header)
-    return void 0;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  if (!match)
-    return void 0;
-  const token = match[1].trim();
-  if (token === "" || /\s/.test(token))
-    return void 0;
-  return token;
-}
-function getOAuthRuntime(mcp, options = {}) {
-  if (options.resourcePath !== void 0)
-    assertResourcePathShape(options.resourcePath);
-  if (options.metadataPath !== void 0)
-    assertResourcePathShape(options.metadataPath, "metadataPath");
-  const stableOptions = { resourcePath: options.resourcePath, metadataPath: options.metadataPath };
-  const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
-  if (!auth)
-    return { kind: "unconfigured", options: stableOptions };
-  if (options.metadataPath !== void 0 && auth.protectedResourceMetadataUrl !== void 0) {
-    throw new Error(
-      `@lovable.dev/mcp-js: the Vite plugin generates protected-resource metadata (metadataPath set), so auth.protectedResourceMetadataUrl must not also be set. Drop protectedResourceMetadataUrl, or set protectedResourceMetadataRoute: false in mcpPlugin(...) to host the document yourself.`
-    );
-  }
-  const discovery = createOAuthDiscoveryResolver(auth);
-  return {
-    kind: "configured",
-    auth,
-    discovery,
-    verify: createOAuthTokenVerifier(auth, discovery),
-    options: stableOptions
-  };
-}
-function assertRestResourceBinding(mcp, options = {}) {
-  const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
-  if (auth && auth.resource === void 0 && options.resourcePath === void 0) {
-    throw new Error(
-      `@lovable.dev/mcp-js: REST companion handlers require auth.resource or a resourcePath so principal.resource binds to the public MCP route, not the internal /.mcp/* request path`
-    );
-  }
-}
-function missingRequiredScopes(auth, scopes) {
-  const requiredScopes = auth.requiredScopes ?? [];
-  if (requiredScopes.length === 0)
-    return [];
-  const granted = new Set(scopes);
-  return requiredScopes.filter((scope) => !granted.has(scope));
-}
-function assertRequiredScopes(auth, context) {
-  if (missingRequiredScopes(auth, context.principal.scopes).length > 0) {
-    throw new OAuthTokenError(403, "insufficient_scope", "Additional OAuth scope is required");
-  }
-}
-function createRequestAuthorizer(mcp, options = {}) {
-  const runtime = getOAuthRuntime(mcp, options);
-  return {
-    async authorize(request, recorder) {
-      if (runtime.kind === "unconfigured")
-        return { ok: true };
-      const startedAt = nowMs();
-      const token = parseBearerToken(request);
-      if (!token) {
-        log.info("auth.no_bearer_token", { outcome: "401" });
-        return { ok: false, response: challengeResponse(runtime.auth, request, runtime.options, 401) };
-      }
-      try {
-        const auth = await runtime.verify(token, request, runtime.options);
-        assertRequiredScopes(runtime.auth, auth);
-        return { ok: true, auth };
-      } catch (err) {
-        if (err instanceof OAuthConfigurationError) {
-          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
-          await recorder?.emit({
-            tool: null,
-            method: "authorize",
-            outcome: "auth_config_error",
-            durationMs: nowMs() - startedAt
-          });
-          return { ok: false, response: oauthConfigurationErrorResponse() };
-        }
-        if (err instanceof OAuthTokenError) {
-          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
-          return {
-            ok: false,
-            response: challengeResponse(
-              runtime.auth,
-              request,
-              runtime.options,
-              err.status,
-              err.oauthError,
-              err.message
-            )
-          };
-        }
-        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
-        return {
-          ok: false,
-          response: challengeResponse(
-            runtime.auth,
-            request,
-            runtime.options,
-            401,
-            "invalid_token",
-            "Invalid access token"
-          )
-        };
-      }
-    }
-  };
-}
-
-// src/auth/context.ts
-var ToolContext = class {
-  #auth;
-  constructor(auth) {
-    this.#auth = auth;
-  }
-  /** Whether the in-flight tool call carries a verified auth context. */
-  isAuthenticated() {
-    return this.#auth !== void 0;
-  }
-  /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
-  getToken() {
-    return this.#auth?.bearer.token;
-  }
-  /** The verified user id (the token `sub`), or `undefined`. */
-  getUserId() {
-    return this.#auth?.principal.sub;
-  }
-  /** The verified user email, or `undefined` when absent. */
-  getUserEmail() {
-    return this.#auth?.principal.email;
-  }
-  /** The verified OAuth `client_id`, or `undefined`. */
-  getClientId() {
-    return this.#auth?.principal.clientId;
-  }
-  /** The verified OAuth scopes, or `undefined` when unauthenticated. */
-  getScopes() {
-    return this.#auth?.principal.scopes;
-  }
-  /** The verified token issuer, or `undefined`. */
-  getIssuer() {
-    return this.#auth?.principal.issuer;
-  }
-  /**
-   * The full verified JWT claims, or `undefined`. Use this for app/business
-   * authorization on issuer-specific claims that have no dedicated accessor.
-   */
-  getClaims() {
-    return this.#auth?.principal.claims;
-  }
-};
-
-// src/core/content.ts
-function extractTextContent(content) {
-  if (!content)
-    return void 0;
-  const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
-  return text.length > 0 ? text : void 0;
-}
-
-// src/core/cors.ts
-var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
-var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
-function withCors(response) {
-  response.headers.set("Access-Control-Allow-Origin", "*");
-  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
-  return response;
-}
-function corsPreflightResponse(allowMethods) {
-  return new Response(null, {
-    status: 204,
-    headers: {
-      "Access-Control-Allow-Origin": "*",
-      "Access-Control-Allow-Methods": allowMethods,
-      "Access-Control-Allow-Headers": ALLOW_HEADERS,
-      "Access-Control-Max-Age": "86400"
-    }
-  });
-}
-
-// src/protocols/mcp/protocol.ts
-function adaptToolToSdkCallback(tool, auth, recorder) {
-  const endUserId = auth?.principal.sub;
-  return async (first) => {
-    const args = tool.inputSchema ? first ?? {} : {};
-    const start = nowMs();
-    let result;
-    try {
-      result = await tool.handler(args, new ToolContext(auth));
-    } catch {
-      await recorder.emit({
-        tool: tool.name,
-        method: "tools/call",
-        outcome: "handler_error",
-        durationMs: nowMs() - start,
-        endUserId
-      });
-      return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
-    }
-    if (result == null) {
-      await recorder.emit({
-        tool: tool.name,
-        method: "tools/call",
-        outcome: "handler_error",
-        durationMs: nowMs() - start,
-        endUserId
-      });
-      return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
-    }
-    await recorder.emit({
-      tool: tool.name,
-      method: "tools/call",
-      outcome: result.isError ? "tool_error" : "ok",
-      durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0,
-      endUserId
-    });
-    return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
-  };
-}
-function createMcpProtocolHandler(mcp, options = {}) {
-  const authorizer = createRequestAuthorizer(mcp, options);
-  const handle = async (request, recorder) => {
-    const authResult = await authorizer.authorize(request, recorder);
-    if (!authResult.ok)
-      return authResult.response;
-    try {
-      const server = new import_mcp.McpServer(
-        { name: mcp.name, version: mcp.version, title: mcp.title },
-        { instructions: mcp.instructions }
-      );
-      for (const tool of mcp.tools) {
-        server.registerTool(
-          tool.name,
-          {
-            title: tool.title,
-            description: tool.description,
-            inputSchema: tool.inputSchema,
-            outputSchema: tool.outputSchema,
-            annotations: tool.annotations
-          },
-          adaptToolToSdkCallback(tool, authResult.auth, recorder)
-        );
-      }
-      const transport = new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
-        sessionIdGenerator: void 0
-      });
-      await server.connect(transport);
-      return await transport.handleRequest(request);
-    } catch (err) {
-      await recorder.emit({
-        tool: null,
-        method: "transport",
-        outcome: "transport_error",
-        durationMs: 0,
-        endUserId: authResult.auth?.principal.sub
-      });
-      log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
-      return Response.json(
-        { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
-        { status: 500 }
-      );
-    }
-  };
-  return async (request, recorder = createNoopRecorder()) => {
-    if (request.method === "OPTIONS")
-      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
-    return withCors(await handle(request, recorder));
-  };
-}
-
-// src/protocols/oauth-metadata.ts
-function notFound() {
-  return withCors(
-    new Response(JSON.stringify({ error: "not found" }), {
-      status: 404,
-      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
-      // then served past a later deploy that enables OAuth and starts returning 200.
-      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
-    })
-  );
-}
-async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
-  const issuer = await discovery.resolveIssuer();
-  const body = {
-    resource: resolveProtectedResource(auth, request, options),
-    authorization_servers: [issuer],
-    bearer_methods_supported: ["header"],
-    resource_name: auth.resourceName ?? mcp.title,
-    resource_documentation: auth.resourceDocumentation
-  };
-  if (auth.requiredScopes && auth.requiredScopes.length > 0)
-    body.scopes_supported = auth.requiredScopes;
-  return body;
-}
-function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-  const runtime = getOAuthRuntime(mcp, options);
-  if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0 && runtime.options.resourcePath === void 0) {
-    throw new Error(
-      `@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`
-    );
-  }
-  return async (request) => {
-    if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
-      return notFound();
-    if (request.method === "OPTIONS")
-      return corsPreflightResponse("GET, HEAD, OPTIONS");
-    if (request.method !== "GET" && request.method !== "HEAD")
-      return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
-    const headers = {
-      ...JSON_HEADERS,
-      "Cache-Control": "public, max-age=300",
-      Vary: "Host"
-    };
-    try {
-      const metadata = await buildProtectedResourceMetadata(
-        mcp,
-        runtime.auth,
-        request,
-        runtime.options,
-        runtime.discovery
-      );
-      const response = withCors(Response.json(metadata, { headers }));
-      return request.method === "HEAD" ? headResponse(response) : response;
-    } catch (err) {
-      log.error("oauth.metadata.config_error", { ...describeError(err), outcome: "500 oauth configuration error" });
-      const response = withCors(oauthConfigurationErrorResponse());
-      return request.method === "HEAD" ? headResponse(response) : response;
-    }
-  };
-}
-
-// src/protocols/rest/list-tools.ts
-var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
-var import_zod_json_schema_compat = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
-function shapeToJsonSchema(shape) {
-  if (!shape)
-    return null;
-  try {
-    return (0, import_zod_json_schema_compat.toJsonSchemaCompat)((0, import_zod_compat.objectFromShape)(shape));
-  } catch {
-    return null;
-  }
-}
-function buildMcpListing(mcp) {
-  return {
-    server: { name: mcp.name, version: mcp.version, title: mcp.title },
-    tools: mcp.tools.map((tool) => ({
-      name: tool.name,
-      title: tool.title,
-      description: tool.description,
-      annotations: tool.annotations,
-      inputSchema: shapeToJsonSchema(tool.inputSchema),
-      outputSchema: shapeToJsonSchema(tool.outputSchema)
-    }))
-  };
-}
-function createListToolsHandler(mcp, options = {}) {
-  assertRestResourceBinding(mcp, options);
-  const authorizer = createRequestAuthorizer(mcp, options);
-  const handle = async (request, recorder) => {
-    const authResult = await authorizer.authorize(request, recorder);
-    if (!authResult.ok)
-      return authResult.response;
-    if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD, OPTIONS");
-    const response = Response.json(buildMcpListing(mcp));
-    return request.method === "HEAD" ? headResponse(response) : response;
-  };
-  return async (request, recorder = createNoopRecorder()) => {
-    if (request.method === "OPTIONS")
-      return corsPreflightResponse("GET, HEAD, OPTIONS");
-    return withCors(await handle(request, recorder));
-  };
-}
-
-// src/protocols/rest/invoke-tool.ts
-var import_zod_compat2 = require("@modelcontextprotocol/sdk/server/zod-compat.js");
-var MAX_REFLECTED_TOOL_NAME = 256;
-function safeReflectName(name) {
-  const text = String(name);
-  return text.length > MAX_REFLECTED_TOOL_NAME ? `${text.slice(0, MAX_REFLECTED_TOOL_NAME)}\u2026` : text;
-}
-function isEmptyArgs(value) {
-  if (value == null)
-    return true;
-  if (typeof value !== "object" || Array.isArray(value))
-    return false;
-  return Object.keys(value).length === 0;
-}
-function createInvokeToolHandler(mcp, options = {}) {
-  assertRestResourceBinding(mcp, options);
-  const authorizer = createRequestAuthorizer(mcp, options);
-  const handle = async (request, toolName, recorder) => {
-    const authResult = await authorizer.authorize(request, recorder);
-    if (!authResult.ok)
-      return authResult.response;
-    const endUserId = authResult.auth?.principal.sub;
-    if (request.method !== "POST")
-      return methodNotAllowed("POST, OPTIONS");
-    const tool = mcp.tools.find((t) => t.name === toolName);
-    if (!tool) {
-      return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
-        status: 404,
-        headers: JSON_HEADERS
-      });
-    }
-    let rawArgs = {};
-    const text = await request.text();
-    if (text) {
-      try {
-        rawArgs = JSON.parse(text);
-      } catch {
-        return new Response(JSON.stringify({ error: "invalid JSON body" }), {
-          status: 400,
-          headers: JSON_HEADERS
-        });
-      }
-    }
-    let args = rawArgs;
-    if (tool.inputSchema) {
-      try {
-        const schema = (0, import_zod_compat2.objectFromShape)(tool.inputSchema);
-        const parsed = await (0, import_zod_compat2.safeParseAsync)(schema, rawArgs);
-        if (!parsed.success) {
-          return new Response(
-            JSON.stringify({
-              error: "validation failed",
-              details: (0, import_zod_compat2.getParseErrorMessage)(parsed.error)
-            }),
-            { status: 400, headers: JSON_HEADERS }
-          );
-        }
-        args = parsed.data;
-      } catch {
-        return new Response(JSON.stringify({ error: "schema error", tool: toolName }), {
-          status: 500,
-          headers: JSON_HEADERS
-        });
-      }
-    } else if (!isEmptyArgs(rawArgs)) {
-      return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
-        status: 400,
-        headers: JSON_HEADERS
-      });
-    }
-    let result;
-    const start = nowMs();
-    try {
-      result = await tool.handler(args, new ToolContext(authResult.auth));
-    } catch {
-      await recorder.emit({
-        tool: tool.name,
-        method: "tools/call",
-        outcome: "handler_error",
-        durationMs: nowMs() - start,
-        endUserId
-      });
-      return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
-        status: 500,
-        headers: JSON_HEADERS
-      });
-    }
-    if (result == null) {
-      await recorder.emit({
-        tool: tool.name,
-        method: "tools/call",
-        outcome: "handler_error",
-        durationMs: nowMs() - start,
-        endUserId
-      });
-      return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
-        status: 500,
-        headers: JSON_HEADERS
-      });
-    }
-    await recorder.emit({
-      tool: tool.name,
-      method: "tools/call",
-      outcome: result.isError ? "tool_error" : "ok",
-      durationMs: nowMs() - start,
-      errorText: result.isError ? extractTextContent(result.content) : void 0,
-      endUserId
-    });
-    return Response.json({
-      content: result.content ?? [],
-      structuredContent: result.structuredContent,
-      isError: result.isError
-    });
-  };
-  return async (request, toolName, recorder = createNoopRecorder()) => {
-    if (request.method === "OPTIONS")
-      return corsPreflightResponse("POST, OPTIONS");
-    return withCors(await handle(request, toolName, recorder));
-  };
-}
-
-// src/stacks/supabase/paths.ts
-var FUNCTIONS_MOUNT_PREFIX = "/functions/v1/";
-function assertFunctionName(value, label = "functionName") {
-  if (!/^[a-zA-Z0-9_-]+$/.test(value)) {
-    throw new Error(
-      `@lovable.dev/mcp-js: ${label} must be a single path segment matching [A-Za-z0-9_-], got ${JSON.stringify(value)}`
-    );
-  }
-}
-
-// src/stacks/supabase/handler.ts
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_logger = require("../../logger-BqPOa_E1.cjs");
+const require_cors = require("../../cors-Cga2PWEg.cjs");
+const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
+const require_mcp = require("../../mcp-DLv_c1O5.cjs");
+const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
+const require_list_tools = require("../../list-tools-07OV14rK.cjs");
+const require_rest = require("../../rest-DxhK7-3b.cjs");
+const require_forwarded = require("../../forwarded-Pi8Hs5Ps.cjs");
+const require_paths = require("../../paths-OP318a6c.cjs");
+//#region src/stacks/supabase/handler.ts
 function deriveResourcePath(options) {
-  if (options.resourcePath !== void 0)
-    return options.resourcePath;
-  if (options.functionName === void 0)
-    return void 0;
-  assertFunctionName(options.functionName);
-  return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
+	if (options.resourcePath !== void 0) return options.resourcePath;
+	if (options.functionName === void 0) return void 0;
+	require_paths.assertFunctionName(options.functionName);
+	return `${require_paths.FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
 }
 function dispatchFor(pathname) {
-  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
-  if (path.endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
-    return { kind: "metadata" };
-  }
-  if (path.endsWith("/.mcp/list-tools")) {
-    return { kind: "list-tools" };
-  }
-  const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
-  if (invokeMatch) {
-    let toolName;
-    try {
-      toolName = decodeURIComponent(invokeMatch[1]);
-    } catch {
-      return { kind: "mcp" };
-    }
-    return { kind: "invoke-tool", toolName };
-  }
-  return { kind: "mcp" };
-}
+	const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+	if (path.endsWith("/.well-known/oauth-protected-resource")) return { kind: "metadata" };
+	if (path.endsWith("/.mcp/list-tools")) return { kind: "list-tools" };
+	const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
+	if (invokeMatch) {
+		let toolName;
+		try {
+			toolName = decodeURIComponent(invokeMatch[1]);
+		} catch {
+			return { kind: "mcp" };
+		}
+		return {
+			kind: "invoke-tool",
+			toolName
+		};
+	}
+	return { kind: "mcp" };
+}
+/**
+* Build a single Web-Standard handler that serves the full MCP surface from
+* one Supabase Edge Function. The returned handler dispatches by URL suffix:
+*
+* | Suffix | Target |
+* | --- | --- |
+* | `/.well-known/oauth-protected-resource` | RFC 9728 metadata |
+* | `/.mcp/list-tools` | REST tool catalog |
+* | `/.mcp/invoke-tool/<tool>` | REST tool dispatcher |
+* | (anything else) | MCP streamable-HTTP protocol |
+*
+* Pass the handler to `Deno.serve(...)` in the emitted function entry.
+* The same OAuth bearer gate protects every dispatch target.
+*/
 function createSupabaseHandler(mcp, options = {}) {
-  const resourcePath = deriveResourcePath(options);
-  if (resourcePath !== void 0)
-    assertResourcePathShape(resourcePath);
-  const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
-  const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
-  const runtimeOptions = resourcePath === void 0 ? {} : { resourcePath, ...metadataPath ? { metadataPath } : {} };
-  const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
-  const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
-  const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
-  const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
-  return async (request) => {
-    const req = applyForwardedOrigin(request, {
-      trustForwardedProto: true,
-      trustForwardedHost: options.trustForwardedHost
-    });
-    const recorder = createRecorderForRuntime(mcp, { stack: "supabase" });
-    const target = dispatchFor(new URL(req.url).pathname);
-    switch (target.kind) {
-      case "metadata":
-        return metadataHandler(req);
-      case "list-tools":
-        return listToolsHandler(req, recorder);
-      case "invoke-tool":
-        return invokeToolHandler(req, target.toolName, recorder);
-      case "mcp":
-        return mcpHandler(req, recorder);
-    }
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createSupabaseHandler
-});
+	const resourcePath = deriveResourcePath(options);
+	if (resourcePath !== void 0) require_cors.assertResourcePathShape(resourcePath);
+	const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
+	const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${require_logger.trimTrailingSlash(resourcePath)}${require_metadata_path.OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
+	const runtimeOptions = resourcePath === void 0 ? {} : {
+		resourcePath,
+		...metadataPath ? { metadataPath } : {}
+	};
+	const mcpHandler = require_mcp.createMcpProtocolHandler(mcp, runtimeOptions);
+	const listToolsHandler = require_list_tools.createListToolsHandler(mcp, runtimeOptions);
+	const invokeToolHandler = require_rest.createInvokeToolHandler(mcp, runtimeOptions);
+	const metadataHandler = require_protocols_oauth_metadata.createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
+	return async (request) => {
+		const req = require_forwarded.applyForwardedOrigin(request, {
+			trustForwardedProto: true,
+			trustForwardedHost: options.trustForwardedHost
+		});
+		const recorder = require_cors.createRecorderForRuntime(mcp, { stack: "supabase" });
+		const target = dispatchFor(new URL(req.url).pathname);
+		switch (target.kind) {
+			case "metadata": return metadataHandler(req);
+			case "list-tools": return listToolsHandler(req, recorder);
+			case "invoke-tool": return invokeToolHandler(req, target.toolName, recorder);
+			case "mcp": return mcpHandler(req, recorder);
+		}
+	};
+}
+//#endregion
+exports.createSupabaseHandler = createSupabaseHandler;