@lovable.dev/mcp-js 0.9.4 → 0.10.1

package/dist/stacks/supabase/index.d.cts

@@ -0,0 +1,39 @@
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
+import 'zod';
+
+type SupabaseHandler = (request: Request) => Promise<Response>;
+interface SupabaseHandlerOptions {
+    /**
+     * Supabase function directory name (the segment under `supabase/functions/`).
+     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+     * protected-resource metadata binds to the canonical public MCP URL rather
+     * than the request path the dispatcher was reached through.
+     *
+     * Either `functionName` or `resourcePath` is required when OAuth auth is
+     * configured and `auth.resource` is not pinned.
+     */
+    functionName?: string;
+    /**
+     * Explicit override for the public MCP route path. Wins over `functionName`
+     * when both are set. Use when the function is fronted by a custom router or
+     * a Lovable Cloud–style host that rewrites the public URL.
+     */
+    resourcePath?: string;
+}
+/**
+ * Build a single Web-Standard handler that serves the full MCP surface from
+ * one Supabase Edge Function. The returned handler dispatches by URL suffix:
+ *
+ * | Suffix | Target |
+ * | --- | --- |
+ * | `/.well-known/oauth-protected-resource` | RFC 9728 metadata |
+ * | `/.mcp/list-tools` | REST tool catalog |
+ * | `/.mcp/invoke-tool/<tool>` | REST tool dispatcher |
+ * | (anything else) | MCP streamable-HTTP protocol |
+ *
+ * Pass the handler to `Deno.serve(...)` in the emitted function entry.
+ * The same OAuth bearer gate protects every dispatch target.
+ */
+declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
+
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.d.ts

@@ -0,0 +1,39 @@
+import { d as McpDefinition } from '../../types-C5SSORxe.js';
+import 'zod';
+
+type SupabaseHandler = (request: Request) => Promise<Response>;
+interface SupabaseHandlerOptions {
+    /**
+     * Supabase function directory name (the segment under `supabase/functions/`).
+     * Used to derive `resourcePath: /functions/v1/<functionName>` so OAuth
+     * protected-resource metadata binds to the canonical public MCP URL rather
+     * than the request path the dispatcher was reached through.
+     *
+     * Either `functionName` or `resourcePath` is required when OAuth auth is
+     * configured and `auth.resource` is not pinned.
+     */
+    functionName?: string;
+    /**
+     * Explicit override for the public MCP route path. Wins over `functionName`
+     * when both are set. Use when the function is fronted by a custom router or
+     * a Lovable Cloud–style host that rewrites the public URL.
+     */
+    resourcePath?: string;
+}
+/**
+ * Build a single Web-Standard handler that serves the full MCP surface from
+ * one Supabase Edge Function. The returned handler dispatches by URL suffix:
+ *
+ * | Suffix | Target |
+ * | --- | --- |
+ * | `/.well-known/oauth-protected-resource` | RFC 9728 metadata |
+ * | `/.mcp/list-tools` | REST tool catalog |
+ * | `/.mcp/invoke-tool/<tool>` | REST tool dispatcher |
+ * | (anything else) | MCP streamable-HTTP protocol |
+ *
+ * Pass the handler to `Deno.serve(...)` in the emitted function entry.
+ * The same OAuth bearer gate protects every dispatch target.
+ */
+declare function createSupabaseHandler(mcp: McpDefinition, options?: SupabaseHandlerOptions): SupabaseHandler;
+
+export { type SupabaseHandler, type SupabaseHandlerOptions, createSupabaseHandler };

package/dist/stacks/supabase/index.js

@@ -0,0 +1,95 @@
+import {
+  createMcpProtocolHandler
+} from "../../chunk-DF3DD3KD.js";
+import {
+  createOAuthProtectedResourceMetadataHandler
+} from "../../chunk-X7V2CL7C.js";
+import {
+  createInvokeToolHandler
+} from "../../chunk-SZLSAGDF.js";
+import {
+  createListToolsHandler
+} from "../../chunk-PJXKJNSZ.js";
+import "../../chunk-MA5H6PSF.js";
+import {
+  assertResourcePathShape
+} from "../../chunk-LAFJDJRY.js";
+import {
+  trimTrailingSlash
+} from "../../chunk-QC3DXQTH.js";
+import {
+  OAUTH_PROTECTED_RESOURCE_METADATA_PATH
+} from "../../chunk-6DXGZZA4.js";
+import {
+  FUNCTIONS_MOUNT_PREFIX,
+  assertFunctionName
+} from "../../chunk-XQWJN6DC.js";
+
+// src/stacks/supabase/handler.ts
+function deriveResourcePath(options) {
+  if (options.resourcePath !== void 0)
+    return options.resourcePath;
+  if (options.functionName === void 0)
+    return void 0;
+  assertFunctionName(options.functionName);
+  return `${FUNCTIONS_MOUNT_PREFIX}${options.functionName}`;
+}
+function dispatchFor(pathname) {
+  const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  if (path.endsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
+    return { kind: "metadata" };
+  }
+  if (path.endsWith("/.mcp/list-tools")) {
+    return { kind: "list-tools" };
+  }
+  const invokeMatch = /\/\.mcp\/invoke-tool\/([^/]+)$/.exec(path);
+  if (invokeMatch) {
+    let toolName;
+    try {
+      toolName = decodeURIComponent(invokeMatch[1]);
+    } catch {
+      return { kind: "mcp" };
+    }
+    return { kind: "invoke-tool", toolName };
+  }
+  return { kind: "mcp" };
+}
+function applyForwardedProto(request) {
+  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  if (!proto)
+    return request;
+  const url = new URL(request.url);
+  if (`${proto}:` === url.protocol)
+    return request;
+  url.protocol = `${proto}:`;
+  return new Request(url.href, request);
+}
+function createSupabaseHandler(mcp, options = {}) {
+  const resourcePath = deriveResourcePath(options);
+  if (resourcePath !== void 0)
+    assertResourcePathShape(resourcePath);
+  const servesOwnPrm = !(mcp.auth?.type === "oauth" && mcp.auth.protectedResourceMetadataUrl !== void 0);
+  const metadataPath = resourcePath === void 0 || !servesOwnPrm ? void 0 : `${trimTrailingSlash(resourcePath)}${OAUTH_PROTECTED_RESOURCE_METADATA_PATH}`;
+  const runtimeOptions = resourcePath === void 0 ? {} : { resourcePath, ...metadataPath ? { metadataPath } : {} };
+  const mcpHandler = createMcpProtocolHandler(mcp, runtimeOptions);
+  const listToolsHandler = createListToolsHandler(mcp, runtimeOptions);
+  const invokeToolHandler = createInvokeToolHandler(mcp, runtimeOptions);
+  const metadataHandler = createOAuthProtectedResourceMetadataHandler(mcp, runtimeOptions);
+  return async (request) => {
+    const req = applyForwardedProto(request);
+    const target = dispatchFor(new URL(req.url).pathname);
+    switch (target.kind) {
+      case "metadata":
+        return metadataHandler(req);
+      case "list-tools":
+        return listToolsHandler(req);
+      case "invoke-tool":
+        return invokeToolHandler(req, target.toolName);
+      case "mcp":
+        return mcpHandler(req);
+    }
+  };
+}
+export {
+  createSupabaseHandler
+};

package/dist/stacks/supabase/vite.cjs

@@ -0,0 +1,263 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/stacks/supabase/vite.ts
+var vite_exports = {};
+__export(vite_exports, {
+  default: () => vite_default,
+  mcpPlugin: () => mcpPlugin
+});
+module.exports = __toCommonJS(vite_exports);
+var import_node_path2 = require("path");
+
+// src/stacks/supabase/emit.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+
+// package.json
+var version = "0.10.1";
+
+// src/core/fs-errors.ts
+function isFileMissing(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+
+// src/stacks/supabase/paths.ts
+var FUNCTIONS_MOUNT_PREFIX = "/functions/v1/";
+function assertFunctionName(value, label = "functionName") {
+  if (!/^[a-zA-Z0-9_-]+$/.test(value)) {
+    throw new Error(
+      `@lovable.dev/mcp-js: ${label} must be a single path segment matching [A-Za-z0-9_-], got ${JSON.stringify(value)}`
+    );
+  }
+}
+
+// src/stacks/supabase/emit.ts
+var DEFAULT_MCP_ENTRY = "src/lib/mcp/index.ts";
+var DEFAULT_FUNCTIONS_DIR = "supabase/functions";
+var DEFAULT_FUNCTION_NAME = "mcp";
+var GENERATED_BANNER = "// AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin.\n// To take ownership, delete this banner line; the plugin then leaves the file alone.";
+var GENERATED_JSON_MARKER_KEY = "_lovableMcpGenerated";
+var GENERATED_JSON_MARKER_VALUE = "AUTO-GENERATED by @lovable.dev/mcp-js \u2014 do not edit. Regenerated by the Vite plugin. To take ownership, remove this key; the plugin then leaves the file alone.";
+function normalizePath(p) {
+  return p.split(import_node_path.sep).join("/");
+}
+function fileExists(path) {
+  try {
+    (0, import_node_fs.lstatSync)(path);
+    return true;
+  } catch (err) {
+    if (isFileMissing(err))
+      return false;
+    throw err;
+  }
+}
+function hasGeneratedBanner(content) {
+  return content.replace(/\r\n/g, "\n").startsWith(GENERATED_BANNER);
+}
+function hasGeneratedJsonMarker(content) {
+  try {
+    const parsed = JSON.parse(content);
+    return typeof parsed === "object" && parsed !== null && GENERATED_JSON_MARKER_KEY in parsed;
+  } catch {
+    return false;
+  }
+}
+function writeIfChanged(file, content, ownershipCheck) {
+  let existing;
+  try {
+    existing = (0, import_node_fs.readFileSync)(file, "utf8");
+  } catch (err) {
+    if (!isFileMissing(err))
+      throw err;
+  }
+  if (existing !== void 0) {
+    if (!ownershipCheck(existing)) {
+      throw new Error(
+        `@lovable.dev/mcp-js: refusing to overwrite user-authored file at ${file}. Delete it or move it first.`
+      );
+    }
+    if (existing === content)
+      return false;
+  }
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(file), { recursive: true });
+  (0, import_node_fs.writeFileSync)(file, content, "utf8");
+  return true;
+}
+function relativeTsSpecifier(fromFile, toFile) {
+  const rel = normalizePath((0, import_node_path.relative)((0, import_node_path.dirname)(fromFile), toFile));
+  return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function buildFunctionEntry(mcpEntryAbs, functionEntryAbs, functionName) {
+  const entryImport = relativeTsSpecifier(functionEntryAbs, mcpEntryAbs);
+  return `${GENERATED_BANNER}
+// supabase function: ${functionName}
+// emitted to: supabase/functions/${functionName}/index.ts
+
+import { createSupabaseHandler } from "npm:@lovable.dev/mcp-js@${version}/stacks/supabase";
+
+import mcp from "${entryImport}";
+
+Deno.serve(createSupabaseHandler(mcp, { functionName: ${JSON.stringify(functionName)} }));
+`;
+}
+function buildDenoJson() {
+  const config = {
+    [GENERATED_JSON_MARKER_KEY]: GENERATED_JSON_MARKER_VALUE,
+    imports: {
+      "@lovable.dev/mcp-js": `npm:@lovable.dev/mcp-js@${version}`
+    }
+  };
+  return `${JSON.stringify(config, null, 2)}
+`;
+}
+function resolvePaths(options) {
+  const projectRoot = (0, import_node_path.resolve)(options.projectRoot);
+  const mcpEntry = options.mcpEntry ?? DEFAULT_MCP_ENTRY;
+  const functionsDir = options.functionsDir ?? DEFAULT_FUNCTIONS_DIR;
+  const functionName = options.functionName ?? DEFAULT_FUNCTION_NAME;
+  assertFunctionName(functionName);
+  const functionDir = (0, import_node_path.resolve)(projectRoot, functionsDir, functionName);
+  if (functionDir !== projectRoot && !functionDir.startsWith(projectRoot + import_node_path.sep)) {
+    throw new Error(
+      `@lovable.dev/mcp-js: functionsDir must resolve within the project root, got ${JSON.stringify(functionsDir)}`
+    );
+  }
+  return {
+    functionDir,
+    functionEntry: (0, import_node_path.join)(functionDir, "index.ts"),
+    denoJson: (0, import_node_path.join)(functionDir, "deno.json"),
+    mcpEntryAbs: (0, import_node_path.resolve)(projectRoot, mcpEntry)
+  };
+}
+function syncSupabaseFunction(options) {
+  const paths = resolvePaths(options);
+  const functionName = options.functionName ?? DEFAULT_FUNCTION_NAME;
+  const written = [];
+  const removed = [];
+  if (!fileExists(paths.mcpEntryAbs)) {
+    cleanupOrphans(paths.functionDir, /* @__PURE__ */ new Set(), removed);
+    return { written, removed };
+  }
+  if (writeIfChanged(
+    paths.functionEntry,
+    buildFunctionEntry(paths.mcpEntryAbs, paths.functionEntry, functionName),
+    hasGeneratedBanner
+  )) {
+    written.push(paths.functionEntry);
+  }
+  if (writeIfChanged(paths.denoJson, buildDenoJson(), hasGeneratedJsonMarker)) {
+    written.push(paths.denoJson);
+  }
+  cleanupOrphans(paths.functionDir, /* @__PURE__ */ new Set([paths.functionEntry, paths.denoJson]), removed);
+  return { written, removed };
+}
+function cleanupOrphans(functionDir, expected, removed) {
+  let entries;
+  try {
+    entries = (0, import_node_fs.readdirSync)(functionDir);
+  } catch (err) {
+    if (isFileMissing(err))
+      return;
+    throw err;
+  }
+  for (const entry of entries) {
+    const full = (0, import_node_path.join)(functionDir, entry);
+    if (expected.has(full))
+      continue;
+    let content;
+    try {
+      content = (0, import_node_fs.readFileSync)(full, "utf8");
+    } catch (err) {
+      if (isFileMissing(err) || err.code === "EISDIR")
+        continue;
+      throw err;
+    }
+    if (hasGeneratedBanner(content) || hasGeneratedJsonMarker(content)) {
+      try {
+        (0, import_node_fs.unlinkSync)(full);
+        removed.push(full);
+      } catch (err) {
+        if (!isFileMissing(err))
+          throw err;
+      }
+    }
+  }
+}
+
+// src/stacks/supabase/vite.ts
+function normalizePath2(p) {
+  return p.split(import_node_path2.sep).join("/");
+}
+function mcpPlugin(options = {}) {
+  const mcpEntryOption = options.mcpEntry ?? DEFAULT_MCP_ENTRY;
+  const functionsDirOption = options.functionsDir ?? DEFAULT_FUNCTIONS_DIR;
+  const functionName = options.functionName ?? DEFAULT_FUNCTION_NAME;
+  const urlPath = `${FUNCTIONS_MOUNT_PREFIX}${functionName}`;
+  let projectRoot = process.cwd();
+  let mcpEntryAbs = (0, import_node_path2.resolve)(projectRoot, mcpEntryOption);
+  const regenerate = () => {
+    syncSupabaseFunction({
+      projectRoot,
+      mcpEntry: mcpEntryOption,
+      functionsDir: functionsDirOption,
+      functionName
+    });
+  };
+  return {
+    name: "@lovable.dev/mcp-js/supabase",
+    // The extract CLI reads these back via `resolveConfig().plugins`. Getter
+    // for `mcpEntry` because the absolute path is finalized in `configResolved`;
+    // `urlPath` is config-time-final so it's a plain field.
+    api: {
+      get mcpEntry() {
+        return mcpEntryAbs;
+      },
+      urlPath
+    },
+    configResolved(config) {
+      projectRoot = config.root;
+      mcpEntryAbs = (0, import_node_path2.resolve)(projectRoot, mcpEntryOption);
+      regenerate();
+    },
+    configureServer(server) {
+      const onChange = (file) => {
+        if (normalizePath2(file) === normalizePath2(mcpEntryAbs)) {
+          regenerate();
+        }
+      };
+      server.watcher.on("add", onChange);
+      server.watcher.on("change", onChange);
+      server.watcher.on("unlink", onChange);
+      server.watcher.once("close", () => {
+        server.watcher.off("add", onChange);
+        server.watcher.off("change", onChange);
+        server.watcher.off("unlink", onChange);
+      });
+    },
+    buildStart() {
+      regenerate();
+    }
+  };
+}
+var vite_default = mcpPlugin;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  mcpPlugin
+});

package/dist/stacks/supabase/vite.d.cts

@@ -0,0 +1,47 @@
+import { Plugin } from 'vite';
+export { M as McpPluginApi } from '../../io-D4srzRKc.js';
+
+interface McpPluginOptions {
+    /**
+     * Path to the MCP entry file (default export = `defineMcp(...)` result),
+     * relative to the project root.
+     * @default "src/lib/mcp/index.ts"
+     */
+    mcpEntry?: string;
+    /**
+     * Directory holding Supabase function folders (one per function), relative
+     * to the project root.
+     * @default "supabase/functions"
+     */
+    functionsDir?: string;
+    /**
+     * Name of the function directory under `functionsDir`. Becomes the public
+     * URL segment (`/functions/v1/<functionName>`) the dispatcher binds OAuth
+     * metadata to via `resourcePath`.
+     * @default "mcp"
+     */
+    functionName?: string;
+}
+/**
+ * Vite plugin that emits the Supabase Edge Function entry (and its
+ * `deno.json` import map) for an `@lovable.dev/mcp-js` MCP server.
+ *
+ * Place this in your `vite.config.ts` plugins array. It uses Vite as the
+ * trigger for codegen even though the emitted output (Deno function) is
+ * not part of the Vite bundle — Classic Lovable stacks already run Vite
+ * for the frontend, so it's the natural authoring surface.
+ *
+ * Lifecycle, mirroring `stacks/tanstack/vite`:
+ *  - `configResolved` finalizes the project root and runs the first emit.
+ *  - `buildStart` re-runs the emit so a `vite build` always picks up the
+ *    latest entry.
+ *  - `configureServer` re-emits when the entry file appears, changes, or
+ *    is removed during `vite dev`, so a developer editing tools sees the
+ *    function regenerate without restarting the server.
+ *
+ * Idempotent: `syncSupabaseFunction` writes only on byte-level change and
+ * cleans up SDK-owned files when the entry is deleted.
+ */
+declare function mcpPlugin(options?: McpPluginOptions): Plugin;
+
+export { type McpPluginOptions, mcpPlugin as default, mcpPlugin };

package/dist/stacks/supabase/vite.d.ts

@@ -0,0 +1,47 @@
+import { Plugin } from 'vite';
+export { M as McpPluginApi } from '../../io-D4srzRKc.js';
+
+interface McpPluginOptions {
+    /**
+     * Path to the MCP entry file (default export = `defineMcp(...)` result),
+     * relative to the project root.
+     * @default "src/lib/mcp/index.ts"
+     */
+    mcpEntry?: string;
+    /**
+     * Directory holding Supabase function folders (one per function), relative
+     * to the project root.
+     * @default "supabase/functions"
+     */
+    functionsDir?: string;
+    /**
+     * Name of the function directory under `functionsDir`. Becomes the public
+     * URL segment (`/functions/v1/<functionName>`) the dispatcher binds OAuth
+     * metadata to via `resourcePath`.
+     * @default "mcp"
+     */
+    functionName?: string;
+}
+/**
+ * Vite plugin that emits the Supabase Edge Function entry (and its
+ * `deno.json` import map) for an `@lovable.dev/mcp-js` MCP server.
+ *
+ * Place this in your `vite.config.ts` plugins array. It uses Vite as the
+ * trigger for codegen even though the emitted output (Deno function) is
+ * not part of the Vite bundle — Classic Lovable stacks already run Vite
+ * for the frontend, so it's the natural authoring surface.
+ *
+ * Lifecycle, mirroring `stacks/tanstack/vite`:
+ *  - `configResolved` finalizes the project root and runs the first emit.
+ *  - `buildStart` re-runs the emit so a `vite build` always picks up the
+ *    latest entry.
+ *  - `configureServer` re-emits when the entry file appears, changes, or
+ *    is removed during `vite dev`, so a developer editing tools sees the
+ *    function regenerate without restarting the server.
+ *
+ * Idempotent: `syncSupabaseFunction` writes only on byte-level change and
+ * cleans up SDK-owned files when the entry is deleted.
+ */
+declare function mcpPlugin(options?: McpPluginOptions): Plugin;
+
+export { type McpPluginOptions, mcpPlugin as default, mcpPlugin };