@lovable.dev/mcp-js 0.9.4 → 0.10.1

package/dist/stacks/supabase/index.cjs

@@ -0,0 +1,950 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/stacks/supabase/index.ts
+var supabase_exports = {};
+__export(supabase_exports, {
+  createSupabaseHandler: () => createSupabaseHandler
+});
+module.exports = __toCommonJS(supabase_exports);
+
+// src/auth/metadata-path.ts
+var OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+
+// src/core/url.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function isLocalHTTPHost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function urlSafetyProblem(url) {
+  const isAllowedHTTP = url.protocol === "http:" && isLocalHTTPHost(url.hostname);
+  if (url.protocol !== "https:" && !isAllowedHTTP) {
+    return "must use https://, except localhost development URLs";
+  }
+  if (url.username || url.password) {
+    return "must not include credentials";
+  }
+  if (url.search || url.hash) {
+    return "must not include query or fragment";
+  }
+  return void 0;
+}
+
+// src/auth/resource.ts
+function resolveProtectedResource(auth, request, options) {
+  if (auth.resource)
+    return trimTrailingSlash(auth.resource);
+  const path = resolveResourcePath(options.resourcePath, request);
+  const resourceURL = new URL(path, request.url);
+  resourceURL.search = "";
+  resourceURL.hash = "";
+  return trimTrailingSlash(resourceURL.toString());
+}
+function assertResourcePathShape(resourcePath, label = "resourcePath") {
+  if (!resourcePath.startsWith("/") || resourcePath.startsWith("//") || resourcePath.includes("\\") || /(^|\/)\.\.(\/|$)/.test(resourcePath)) {
+    throw new Error(
+      `@lovable.dev/mcp-js: ${label} must be an absolute path beginning with "/" without ".." segments or backslashes (got ${JSON.stringify(resourcePath)})`
+    );
+  }
+}
+function resolveResourcePath(resourcePath, request) {
+  if (resourcePath === void 0)
+    return new URL(request.url).pathname;
+  assertResourcePathShape(resourcePath);
+  return resourcePath;
+}
+
+// src/protocols/mcp/protocol.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
+
+// src/core/http.ts
+var JSON_HEADERS = { "Content-Type": "application/json" };
+function headResponse(response) {
+  return new Response(null, { status: response.status, statusText: response.statusText, headers: response.headers });
+}
+function methodNotAllowed(allow) {
+  return new Response(JSON.stringify({ error: "method not allowed" }), {
+    status: 405,
+    headers: { ...JSON_HEADERS, Allow: allow }
+  });
+}
+
+// src/core/logger.ts
+var LEVEL_RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function isLogLevel(value) {
+  return typeof value === "string" && value in LEVEL_RANK;
+}
+function readEnvLevel() {
+  try {
+    const raw = typeof process !== "undefined" ? process.env?.["LOVABLE_MCP_LOG_LEVEL"] : void 0;
+    const normalized = raw?.trim().toLowerCase();
+    return isLogLevel(normalized) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var currentLevel = readEnvLevel() ?? "silent";
+function enabled(level) {
+  return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+function emit(level, method, event, fields) {
+  if (!enabled(level))
+    return;
+  const message = `[mcp-js] ${event}`;
+  if (fields)
+    console[method](message, fields);
+  else
+    console[method](message);
+}
+var log = {
+  error: (event, fields) => emit("error", "error", event, fields),
+  warn: (event, fields) => emit("warn", "warn", event, fields),
+  info: (event, fields) => emit("info", "info", event, fields),
+  debug: (event, fields) => emit("debug", "debug", event, fields)
+};
+function describeError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { value: String(err) };
+}
+
+// src/core/promise.ts
+function cachedPromise(load, label) {
+  let settled = false;
+  let value;
+  return async () => {
+    if (settled) {
+      if (label)
+        log.debug(`${label}.cache_hit`);
+      return value;
+    }
+    if (label)
+      log.debug(`${label}.load_start`);
+    try {
+      const loaded = await load();
+      settled = true;
+      value = loaded;
+      if (label)
+        log.debug(`${label}.settled`);
+      return loaded;
+    } catch (err) {
+      if (label)
+        log.debug(`${label}.load_failed`, describeError(err));
+      throw err;
+    }
+  };
+}
+
+// src/core/validation.ts
+function parseSafeUrl(subject, raw, ErrorClass = Error) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new ErrorClass(`${subject} must be an absolute URL`);
+  }
+  const problem = urlSafetyProblem(url);
+  if (problem) {
+    throw new ErrorClass(`${subject} ${problem}`);
+  }
+  return url;
+}
+
+// src/auth/discovery.ts
+var OAuthConfigurationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthConfigurationError";
+  }
+};
+var METADATA_FETCH_TIMEOUT_MS = 5e3;
+function issuerPath(url) {
+  const path = trimTrailingSlash(url.pathname);
+  return path === "" ? void 0 : path;
+}
+function pathInsertedOAuthMetadataUrls(url, path) {
+  return [
+    `${url.origin}/.well-known/oauth-authorization-server${path}`,
+    `${url.origin}/.well-known/openid-configuration${path}`
+  ];
+}
+function oauthMetadataUrlsForIssuer(issuer) {
+  const normalizedIssuer = trimTrailingSlash(issuer);
+  const url = new URL(normalizedIssuer);
+  const path = issuerPath(url);
+  if (!path) {
+    return [
+      `${normalizedIssuer}/.well-known/oauth-authorization-server`,
+      `${normalizedIssuer}/.well-known/openid-configuration`
+    ];
+  }
+  return [...pathInsertedOAuthMetadataUrls(url, path), `${normalizedIssuer}/.well-known/openid-configuration`];
+}
+async function fetchFirstValidOAuthServerMetadata(metadataUrls, expectedIssuer) {
+  const errors = [];
+  for (const url of metadataUrls) {
+    try {
+      return await fetchOAuthServerMetadata(url, expectedIssuer);
+    } catch (err) {
+      log.debug("oauth.discovery.attempt_failed", { url, ...describeError(err) });
+      errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  log.error("oauth.discovery.exhausted", { expectedIssuer, urlsTried: metadataUrls, errors });
+  throw new Error(`failed to discover OAuth server metadata (${errors.join("; ")})`);
+}
+async function fetchOAuthServerMetadata(url, expectedIssuer) {
+  log.debug("oauth.discovery.fetch", { url });
+  const response = await fetch(url, { signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS), redirect: "manual" });
+  if (!response.ok) {
+    throw new Error(String(response.status));
+  }
+  const json = await response.json();
+  if (typeof json.issuer !== "string") {
+    throw new Error("missing issuer");
+  }
+  parseSafeUrl("discovered issuer", json.issuer);
+  if (trimTrailingSlash(json.issuer) !== expectedIssuer) {
+    log.warn("oauth.discovery.issuer_mismatch", { url, expectedIssuer, published: json.issuer });
+    throw new Error("issuer mismatch");
+  }
+  if (typeof json.jwks_uri !== "string") {
+    throw new Error("missing jwks_uri");
+  }
+  parseSafeUrl("discovered jwks_uri", json.jwks_uri);
+  return { issuer: json.issuer, jwks_uri: json.jwks_uri };
+}
+async function fetchIssuerOAuthServerMetadata(issuer) {
+  try {
+    return await fetchFirstValidOAuthServerMetadata(oauthMetadataUrlsForIssuer(issuer), issuer);
+  } catch (err) {
+    log.error("oauth.discovery.config_error", {
+      issuer,
+      ...describeError(err),
+      outcome: "500 oauth configuration error"
+    });
+    throw new OAuthConfigurationError(
+      `OAuth issuer discovery failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function createOAuthDiscoveryResolver(auth) {
+  const configuredIssuer = trimTrailingSlash(auth.issuer);
+  const oauthServerMetadata = cachedPromise(
+    () => fetchIssuerOAuthServerMetadata(configuredIssuer),
+    "oauth.discovery.metadata"
+  );
+  return {
+    resolveIssuer: async () => configuredIssuer,
+    resolveJwksUri: async () => {
+      if (auth.jwksUri) {
+        log.debug("oauth.jwks.resolved", { jwksUri: auth.jwksUri, source: "configured" });
+        return auth.jwksUri;
+      }
+      const jwksUri = (await oauthServerMetadata()).jwks_uri;
+      log.debug("oauth.jwks.resolved", { jwksUri, source: "discovered" });
+      return jwksUri;
+    }
+  };
+}
+
+// src/auth/verifier.ts
+var import_jose = require("jose");
+
+// src/auth/claims.ts
+function readString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function splitScopes(value) {
+  if (typeof value === "string")
+    return value.split(/\s+/).filter(Boolean);
+  if (Array.isArray(value))
+    return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+  return [];
+}
+function stringClaim(claims, name) {
+  return readString(claims[name]);
+}
+
+// src/auth/verifier.ts
+var DEFAULT_JWT_ALGORITHMS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"];
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+var JWKS_FETCH_TIMEOUT_MS = 5e3;
+var OAuthTokenError = class extends Error {
+  constructor(status, oauthError, message) {
+    super(message);
+    this.status = status;
+    this.oauthError = oauthError;
+    this.name = "OAuthTokenError";
+  }
+};
+function resolveAcceptedAudiences(auth, resource) {
+  return auth.acceptedAudiences ?? [resource];
+}
+function tokenHeaderFields(token) {
+  try {
+    const header = (0, import_jose.decodeProtectedHeader)(token);
+    return { jwtAlg: header.alg, jwtKid: header.kid, tokenLength: token.length };
+  } catch {
+    return { tokenLength: token.length };
+  }
+}
+async function fetchVerificationKeySet(jwksUri) {
+  try {
+    const response = await fetch(jwksUri, { signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS), redirect: "manual" });
+    if (!response.ok)
+      throw new Error(`JWKS endpoint returned ${response.status}`);
+    const json = await response.json();
+    return (0, import_jose.createLocalJWKSet)(json);
+  } catch (err) {
+    log.error("oauth.jwks.fetch_failed", { ...describeError(err), outcome: "500 oauth configuration error" });
+    throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function verifyJwtClaims(token, keySet, issuer, audience, auth) {
+  try {
+    const { payload } = await (0, import_jose.jwtVerify)(token, keySet, {
+      typ: "at+jwt",
+      // `issuer` is trimmed of any trailing slash; accept both forms so a token whose
+      // `iss` carries the slash the AS publishes still verifies.
+      issuer: [issuer, `${issuer}/`],
+      audience: [...audience],
+      algorithms: auth.algorithms ? [...auth.algorithms] : DEFAULT_JWT_ALGORITHMS,
+      requiredClaims: ["sub", "exp"],
+      clockTolerance: auth.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS
+    });
+    return payload;
+  } catch (err) {
+    log.debug("oauth.verify.rejected", { ...describeError(err), outcome: "401 invalid_token" });
+    throw err;
+  }
+}
+function assertNonEmptySubject(claims) {
+  const sub = claims["sub"];
+  if (typeof sub !== "string" || sub.trim() === "") {
+    log.debug("oauth.verify.bad_subject", { subType: typeof sub });
+    throw new OAuthTokenError(401, "invalid_token", "token subject claim must be a non-empty string");
+  }
+}
+function assertOAuthClientClaim(auth, clientId) {
+  if (auth.requireOAuthClientClaim !== false && !clientId) {
+    log.debug("oauth.verify.missing_client_claim", { outcome: "401 invalid_token" });
+    throw new OAuthTokenError(401, "invalid_token", "OAuth client claim is required");
+  }
+}
+function makeBearer(token) {
+  return Object.defineProperty({}, "token", { value: token, enumerable: false });
+}
+function buildMcpAuthContext(args) {
+  const { claims } = args;
+  return {
+    type: "oauth",
+    principal: {
+      claims,
+      issuer: args.issuer,
+      resource: args.resource,
+      acceptedAudiences: args.acceptedAudiences,
+      scopes: splitScopes(claims.scope),
+      sub: stringClaim(claims, "sub"),
+      email: stringClaim(claims, "email"),
+      clientId: stringClaim(claims, "client_id") ?? stringClaim(claims, "azp")
+    },
+    bearer: makeBearer(args.token)
+  };
+}
+function createOAuthTokenVerifier(auth, discovery) {
+  return async (token, request, options) => {
+    const resource = resolveProtectedResource(auth, request, options);
+    const issuer = await discovery.resolveIssuer();
+    const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
+    log.debug("oauth.verify.start", { issuer, acceptedAudiences, resource, ...tokenHeaderFields(token) });
+    const jwksUri = await discovery.resolveJwksUri();
+    log.debug("oauth.jwks.fetch", { jwksUri });
+    const keySet = await fetchVerificationKeySet(jwksUri);
+    const claims = await verifyJwtClaims(token, keySet, issuer, acceptedAudiences, auth);
+    assertNonEmptySubject(claims);
+    const context = buildMcpAuthContext({ token, claims, issuer, resource, acceptedAudiences });
+    assertOAuthClientClaim(auth, context.principal.clientId);
+    log.info("oauth.verify.ok", {
+      sub: context.principal.sub,
+      clientId: context.principal.clientId,
+      scopes: context.principal.scopes
+    });
+    return context;
+  };
+}
+
+// src/auth/authorize.ts
+function quoteAuthenticateParam(value) {
+  const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
+  return `"${sanitized.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function resolveProtectedResourceMetadataUrl(auth, request, options) {
+  if (auth.protectedResourceMetadataUrl !== void 0)
+    return auth.protectedResourceMetadataUrl;
+  const base = auth.resource ?? request.url;
+  return new URL(options.metadataPath ?? OAUTH_PROTECTED_RESOURCE_METADATA_PATH, base).toString();
+}
+function wwwAuthenticateHeader(auth, request, options, params = {}) {
+  const values = [
+    `realm=${quoteAuthenticateParam("mcp")}`,
+    `resource_metadata=${quoteAuthenticateParam(resolveProtectedResourceMetadataUrl(auth, request, options))}`
+  ];
+  if (auth.requiredScopes && auth.requiredScopes.length > 0) {
+    values.push(`scope=${quoteAuthenticateParam(auth.requiredScopes.join(" "))}`);
+  }
+  if (params.error)
+    values.push(`error=${quoteAuthenticateParam(params.error)}`);
+  if (params.errorDescription)
+    values.push(`error_description=${quoteAuthenticateParam(params.errorDescription)}`);
+  return `Bearer ${values.join(", ")}`;
+}
+function challengeResponse(auth, request, options, status, oauthError, errorDescription) {
+  const headers = new Headers(JSON_HEADERS);
+  headers.set(
+    "WWW-Authenticate",
+    wwwAuthenticateHeader(auth, request, options, { error: oauthError, errorDescription })
+  );
+  headers.set("Cache-Control", "no-store");
+  return new Response(JSON.stringify({ error: status === 403 ? "forbidden" : "unauthorized" }), {
+    status,
+    headers
+  });
+}
+function oauthConfigurationErrorResponse() {
+  return new Response(JSON.stringify({ error: "oauth configuration error" }), {
+    status: 500,
+    headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+  });
+}
+function parseBearerToken(request) {
+  const header = request.headers.get("Authorization");
+  if (!header)
+    return void 0;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  if (!match)
+    return void 0;
+  const token = match[1].trim();
+  if (token === "" || /\s/.test(token))
+    return void 0;
+  return token;
+}
+function getOAuthRuntime(mcp, options = {}) {
+  if (options.resourcePath !== void 0)
+    assertResourcePathShape(options.resourcePath);
+  if (options.metadataPath !== void 0)
+    assertResourcePathShape(options.metadataPath, "metadataPath");
+  const stableOptions = { resourcePath: options.resourcePath, metadataPath: options.metadataPath };
+  const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
+  if (!auth)
+    return { kind: "unconfigured", options: stableOptions };
+  if (options.metadataPath !== void 0 && auth.protectedResourceMetadataUrl !== void 0) {
+    throw new Error(
+      `@lovable.dev/mcp-js: the Vite plugin generates protected-resource metadata (metadataPath set), so auth.protectedResourceMetadataUrl must not also be set. Drop protectedResourceMetadataUrl, or set protectedResourceMetadataRoute: false in mcpPlugin(...) to host the document yourself.`
+    );
+  }
+  const discovery = createOAuthDiscoveryResolver(auth);
+  return {
+    kind: "configured",
+    auth,
+    discovery,
+    verify: createOAuthTokenVerifier(auth, discovery),
+    options: stableOptions
+  };
+}
+function assertRestResourceBinding(mcp, options = {}) {
+  const auth = mcp.auth?.type === "oauth" ? mcp.auth : void 0;
+  if (auth && auth.resource === void 0 && options.resourcePath === void 0) {
+    throw new Error(
+      `@lovable.dev/mcp-js: REST companion handlers require auth.resource or a resourcePath so principal.resource binds to the public MCP route, not the internal /.mcp/* request path`
+    );
+  }
+}
+function missingRequiredScopes(auth, scopes) {
+  const requiredScopes = auth.requiredScopes ?? [];
+  if (requiredScopes.length === 0)
+    return [];
+  const granted = new Set(scopes);
+  return requiredScopes.filter((scope) => !granted.has(scope));
+}
+function assertRequiredScopes(auth, context) {
+  if (missingRequiredScopes(auth, context.principal.scopes).length > 0) {
+    throw new OAuthTokenError(403, "insufficient_scope", "Additional OAuth scope is required");
+  }
+}
+function createRequestAuthorizer(mcp, options = {}) {
+  const runtime = getOAuthRuntime(mcp, options);
+  return {
+    async authorize(request) {
+      if (runtime.kind === "unconfigured")
+        return { ok: true };
+      const token = parseBearerToken(request);
+      if (!token) {
+        log.info("auth.no_bearer_token", { outcome: "401" });
+        return { ok: false, response: challengeResponse(runtime.auth, request, runtime.options, 401) };
+      }
+      try {
+        const auth = await runtime.verify(token, request, runtime.options);
+        assertRequiredScopes(runtime.auth, auth);
+        return { ok: true, auth };
+      } catch (err) {
+        if (err instanceof OAuthConfigurationError) {
+          log.error("auth.config_error", { ...describeError(err), outcome: "500" });
+          return { ok: false, response: oauthConfigurationErrorResponse() };
+        }
+        if (err instanceof OAuthTokenError) {
+          log.info("auth.token_rejected", { status: err.status, oauthError: err.oauthError });
+          return {
+            ok: false,
+            response: challengeResponse(
+              runtime.auth,
+              request,
+              runtime.options,
+              err.status,
+              err.oauthError,
+              err.message
+            )
+          };
+        }
+        log.error("auth.unexpected_error", { ...describeError(err), outcome: "401" });
+        return {
+          ok: false,
+          response: challengeResponse(
+            runtime.auth,
+            request,
+            runtime.options,
+            401,
+            "invalid_token",
+            "Invalid access token"
+          )
+        };
+      }
+    }
+  };
+}
+
+// src/auth/context.ts
+var ToolContext = class {
+  #auth;
+  constructor(auth) {
+    this.#auth = auth;
+  }
+  /** Whether the in-flight tool call carries a verified auth context. */
+  isAuthenticated() {
+    return this.#auth !== void 0;
+  }
+  /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
+  getToken() {
+    return this.#auth?.bearer.token;
+  }
+  /** The verified user id (the token `sub`), or `undefined`. */
+  getUserId() {
+    return this.#auth?.principal.sub;
+  }
+  /** The verified user email, or `undefined` when absent. */
+  getUserEmail() {
+    return this.#auth?.principal.email;
+  }
+  /** The verified OAuth `client_id`, or `undefined`. */
+  getClientId() {
+    return this.#auth?.principal.clientId;
+  }
+  /** The verified OAuth scopes, or `undefined` when unauthenticated. */
+  getScopes() {
+    return this.#auth?.principal.scopes;
+  }
+  /** The verified token issuer, or `undefined`. */
+  getIssuer() {
+    return this.#auth?.principal.issuer;
+  }
+  /**
+   * The full verified JWT claims, or `undefined`. Use this for app/business
+   * authorization on issuer-specific claims that have no dedicated accessor.
+   */
+  getClaims() {
+    return this.#auth?.principal.claims;
+  }
+};
+
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
+// src/protocols/mcp/protocol.ts
+function adaptToolToSdkCallback(tool, auth) {
+  return async (first) => {
+    const args = tool.inputSchema ? first ?? {} : {};
+    let result;
+    try {
+      result = await tool.handler(args, new ToolContext(auth));
+    } catch {
+      return { content: [{ type: "text", text: "tool execution failed" }], isError: true };
+    }
+    if (result == null) {
+      return { content: [{ type: "text", text: `tool "${tool.name}" returned no result` }], isError: true };
+    }
+    return { content: result.content ?? [], structuredContent: result.structuredContent, isError: result.isError };
+  };
+}
+function createMcpProtocolHandler(mcp, options = {}) {
+  const authorizer = createRequestAuthorizer(mcp, options);
+  const handle = async (request) => {
+    const authResult = await authorizer.authorize(request);
+    if (!authResult.ok)
+      return authResult.response;
+    try {
+      const server = new import_mcp.McpServer(
+        { name: mcp.name, version: mcp.version, title: mcp.title },
+        { instructions: mcp.instructions }
+      );
+      for (const tool of mcp.tools) {
+        server.registerTool(
+          tool.name,
+          {
+            title: tool.title,
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+            outputSchema: tool.outputSchema,
+            annotations: tool.annotations
+          },
+          adaptToolToSdkCallback(tool, authResult.auth)
+        );
+      }
+      const transport = new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0
+      });
+      await server.connect(transport);
+      return await transport.handleRequest(request);
+    } catch (err) {
+      log.error("mcp.transport_error", { ...describeError(err), outcome: "500 internal error" });
+      return Response.json(
+        { jsonrpc: "2.0", id: null, error: { code: -32603, message: "internal error" } },
+        { status: 500 }
+      );
+    }
+  };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+    return withCors(await handle(request));
+  };
+}
+
+// src/protocols/oauth-metadata.ts
+function notFound() {
+  return withCors(
+    new Response(JSON.stringify({ error: "not found" }), {
+      status: 404,
+      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
+      // then served past a later deploy that enables OAuth and starts returning 200.
+      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+    })
+  );
+}
+async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
+  const issuer = await discovery.resolveIssuer();
+  const body = {
+    resource: resolveProtectedResource(auth, request, options),
+    authorization_servers: [issuer],
+    bearer_methods_supported: ["header"],
+    resource_name: auth.resourceName ?? mcp.title,
+    resource_documentation: auth.resourceDocumentation
+  };
+  if (auth.requiredScopes && auth.requiredScopes.length > 0)
+    body.scopes_supported = auth.requiredScopes;
+  return body;
+}
+function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
+  const runtime = getOAuthRuntime(mcp, options);
+  if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0 && runtime.options.resourcePath === void 0) {
+    throw new Error(
+      `@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`
+    );
+  }
+  return async (request) => {
+    if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
+      return notFound();
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    if (request.method !== "GET" && request.method !== "HEAD")
+      return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
+    const headers = {
+      ...JSON_HEADERS,
+      "Cache-Control": "public, max-age=300",
+      Vary: "Host"
+    };
+    try {
+      const metadata = await buildProtectedResourceMetadata(
+        mcp,
+        runtime.auth,
+        request,
+        runtime.options,
+        runtime.discovery
+      );
+      const response = withCors(Response.json(metadata, { headers }));
+      return request.method === "HEAD" ? headResponse(response) : response;
+    } catch (err) {
+      log.error("oauth.metadata.config_error", { ...describeError(err), outcome: "500 oauth configuration error" });
+      const response = withCors(oauthConfigurationErrorResponse());
+      return request.method === "HEAD" ? headResponse(response) : response;
+    }
+  };
+}
+
+// src/protocols/rest/list-tools.ts
+var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+var import_zod_json_schema_compat = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
+function shapeToJsonSchema(shape) {
+  if (!shape)
+    return null;
+  try {
+    return (0, import_zod_json_schema_compat.toJsonSchemaCompat)((0, import_zod_compat.objectFromShape)(shape));
+  } catch {
+    return null;
+  }
+}
+function buildMcpListing(mcp) {
+  return {
+    server: { name: mcp.name, version: mcp.version, title: mcp.title },
+    tools: mcp.tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      annotations: tool.annotations,
+      inputSchema: shapeToJsonSchema(tool.inputSchema),
+      outputSchema: shapeToJsonSchema(tool.outputSchema)
+    }))
+  };
+}
+function createListToolsHandler(mcp, options = {}) {
+  assertRestResourceBinding(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options);
+  const handle = async (request) => {
+    const authResult = await authorizer.authorize(request);
+    if (!authResult.ok)
+      return authResult.response;
+    if (request.method !== "GET" && request.method !== "HEAD")
+      return methodNotAllowed("GET, HEAD, OPTIONS");
+    const response = Response.json(buildMcpListing(mcp));
+    return request.method === "HEAD" ? headResponse(response) : response;
+  };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
+}
+
+// src/protocols/rest/invoke-tool.ts
+var import_zod_compat2 = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+var MAX_REFLECTED_TOOL_NAME = 256;
+function safeReflectName(name) {
+  const text = String(name);
+  return text.length > MAX_REFLECTED_TOOL_NAME ? `${text.slice(0, MAX_REFLECTED_TOOL_NAME)}\u2026` : text;
+}
+function isEmptyArgs(value) {
+  if (value == null)
+    return true;
+  if (typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.keys(value).length === 0;
+}
+function createInvokeToolHandler(mcp, options = {}) {
+  assertRestResourceBinding(mcp, options);
+  const authorizer = createRequestAuthorizer(mcp, options);
+  const handle = async (request, toolName) => {
+    const authResult = await authorizer.authorize(request);
+    if (!authResult.ok)
+      return authResult.response;
+    if (request.method !== "POST")
+      return methodNotAllowed("POST, OPTIONS");
+    const tool = mcp.tools.find((t) => t.name === toolName);
+    if (!tool) {
+      return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
+        status: 404,
+        headers: JSON_HEADERS
+      });
+    }
+    let rawArgs = {};
+    const text = await request.text();
+    if (text) {
+      try {
+        rawArgs = JSON.parse(text);
+      } catch {
+        return new Response(JSON.stringify({ error: "invalid JSON body" }), {
+          status: 400,
+          headers: JSON_HEADERS
+        });
+      }
+    }
+    let args = rawArgs;
+    if (tool.inputSchema) {
+      try {
+        const schema = (0, import_zod_compat2.objectFromShape)(tool.inputSchema);
+        const parsed = await (0, import_zod_compat2.safeParseAsync)(schema, rawArgs);
+        if (!parsed.success) {
+          return new Response(
+            JSON.stringify({
+              error: "validation failed",
+              details: (0, import_zod_compat2.getParseErrorMessage)(parsed.error)
+            }),
+            { status: 400, headers: JSON_HEADERS }
+          );
+        }
+        args = parsed.data;
+      } catch {
+        return new Response(JSON.stringify({ error: "schema error", tool: toolName }), {
+          status: 500,
+          headers: JSON_HEADERS
+        });
+      }
+    } else if (!isEmptyArgs(rawArgs)) {
+      return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
+        status: 400,
+        headers: JSON_HEADERS
+      });
+    }
+    let result;
+    try {
+      result = await tool.handler(args, new ToolContext(authResult.auth));
+    } catch {
+      return new Response(JSON.stringify({ error: "handler threw", tool: toolName }), {
+        status: 500,
+        headers: JSON_HEADERS
+      });
+    }
+    if (result == null) {
+      return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
+        status: 500,
+        headers: JSON_HEADERS
+      });
+    }
+    return Response.json({
+      content: result.content ?? [],
+      structuredContent: result.structuredContent,
+      isError: result.isError
+    });
+  };
+  return async (request, toolName) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName));
+  };
+}
+
+// src/stacks/supabase/paths.ts
+var FUNCTIONS_MOUNT_PREFIX = "/functions/v1/";
+function assertFunctionName(value, label = "functionName") {
+  if (!/^[a-zA-Z0-9_-]+$/.test(value)) {
+    throw new Error(
+      `@lovable.dev/mcp-js: ${label} must be a single path segment matching [A-Za-z0-9_-], got ${JSON.stringify(value)}`
+    );
+  }
+}
+
+// src/stacks/supabase/handler.ts
+function deriveResourcePath(options) {
+  if (options.resourcePath !== void 0)
+    return options.resourcePath;
+  if (options.functionName === void 0)
+    return void 0;
+  assertFunctionName(options.functionName);
+  return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
+}
+function dispatchFor(pathname) {
+  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  if (path.endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
+    return { kind: "metadata" };
+  }
+  if (path.endsWith("/.mcp/list-tools")) {
+    return { kind: "list-tools" };
+  }
+  const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
+  if (invokeMatch) {
+    let toolName;
+    try {
+      toolName = decodeURIComponent(invokeMatch[1]);
+    } catch {
+      return { kind: "mcp" };
+    }
+    return { kind: "invoke-tool", toolName };
+  }
+  return { kind: "mcp" };
+}
+function applyForwardedProto(request) {
+  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  if (!proto)
+    return request;
+  const url = new URL(request.url);
+  if (`${proto}:` === url.protocol)
+    return request;
+  url.protocol = `${proto}:`;
+  return new Request(url.href, request);
+}
+function createSupabaseHandler(mcp, options = {}) {
+  const resourcePath = deriveResourcePath(options);
+  if (resourcePath !== void 0)
+    assertResourcePathShape(resourcePath);
+  const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
+  const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
+  const runtimeOptions = resourcePath === void 0 ? {} : { resourcePath, ...metadataPath ? { metadataPath } : {} };
+  const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
+  const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
+  const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
+  const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
+  return async (request) => {
+    const req = applyForwardedProto(request);
+    const target = dispatchFor(new URL(req.url).pathname);
+    switch (target.kind) {
+      case "metadata":
+        return metadataHandler(req);
+      case "list-tools":
+        return listToolsHandler(req);
+      case "invoke-tool":
+        return invokeToolHandler(req, target.toolName);
+      case "mcp":
+        return mcpHandler(req);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createSupabaseHandler
+});