better-supabase 0.11.0 → 0.13.0

package/dist/mcp/index.d.ts

@@ -1,20 +1,23 @@
-import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { t as OperationTable } from "../operations-DQCWqkt3.js";
-import { D as ResourceOperation } from "../model-lUafmeBQ.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { a as ServerContext, c as ServerOptions, n as BetterServer } from "../server-types-BKN_R4Ws.js";
-import { r as GuardOptions } from "../respond-CEBC6KUX.js";
-import { l as ResourceRouteOptions } from "../resource-types-CGr0BbL-.js";
+import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
+import { t as OperationTable } from "../operations-Cc27HkTG.js";
+import { D as ResourceOperation } from "../model-Btl8X9cs.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
+import { t as BetterSupabase } from "../define-D0LSXmUP.js";
+import { a as ServerContext, c as ServerOptions, n as BetterServer } from "../server-types-D_cQ6OxZ.js";
+import { r as GuardOptions } from "../respond-QW-f1yio.js";
+import { l as ResourceRouteOptions } from "../resource-types-NXau9LJE.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/mcp/dialect.d.ts
+/**
+ * The JSON Schema dialect of tool schemas, which depends on the protocol
+ * revision.
+ */
+type ToolSchemaTarget = "draft-2020-12" | "draft-07";
+//#endregion
 //#region src/mcp/json-rpc.d.ts
 /** A JSON object. */
 type Json = Readonly<Record<string, unknown>>;
 //#endregion
-//#region src/mcp/dialect.d.ts
-/** The JSON Schema dialect of tool schemas, which depends on the protocol revision. */
-type ToolSchemaTarget = "draft-2020-12" | "draft-07";
-//#endregion
 //#region src/mcp/permissions.d.ts
 /** `McpOptions.requiredRoles`: the roles, or the roles and the claim to read. */
 type RequiredRoles = readonly string[] | {
@@ -65,8 +68,8 @@ interface ProtocolServer extends ServerDescription {
   callTool(name: string, args: unknown): Promise<ToolResult | undefined>;
 }
 /**
- * The JSON-RPC response to one message, or `undefined` for a notification.
- * It answers `initialize`, `server/discover`, `ping`, `tools/list` and
+ * The JSON-RPC response to one message, or `undefined` for a notification. It
+ * answers `initialize`, `server/discover`, `ping`, `tools/list` and
  * `tools/call`, for message-based transports such as stdio.
  */
 export declare function answerMessage(message: unknown, server: ProtocolServer): Promise<Json | undefined>;
@@ -89,7 +92,10 @@ interface McpTool<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P
   readonly input?: StandardSchemaV1;
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
-  /** Checked by the authorizer on every call; callers it denies don't see the tool. */
+  /**
+   * Checked by the authorizer on every call; callers it denies don't see the
+   * tool.
+   */
   readonly permission?: unknown;
   /** The provider operation the tool checks, in place of `mcp.tool.<name>`. */
   readonly operation?: string;
@@ -98,7 +104,10 @@ interface McpTool<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P
 /** What the `authorize` and `visible` hooks see of a tool. */
 interface ToolRef {
   readonly info: ToolInfo;
-  /** The tool's `meta`, e.g. a permission. For table tools, the resource's `meta` for that operation. */
+  /**
+   * The tool's `meta`, e.g. a permission. For table tools, the resource's
+   * `meta` for that operation.
+   */
   readonly meta: unknown;
 }
 /** The outcome of `authorize`. `scopes` turns a refusal into an OAuth challenge. */
@@ -131,9 +140,9 @@ interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C =
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
   /**
-   * Checked by the authorizer after the arguments are validated, with the
-   * tool as the resource (`mcp_tool`). `tools/list` hides the tool from
-   * callers it denies.
+   * Checked by the authorizer after the arguments are validated, with the tool
+   * as the resource (`mcp_tool`). `tools/list` hides the tool from callers it
+   * denies.
    */
   readonly permission?: Ref;
   /**
@@ -143,12 +152,15 @@ interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C =
   readonly operation?: string;
   run(args: I, ctx: ToolContext<M, F, E, C, P, B>): unknown;
 }
-/** A table's tools: the REST resource options, plus `meta` per operation for `authorize` and `visible`. */
+/**
+ * A table's tools: the REST resource options, plus `meta` per operation for
+ * `authorize` and `visible`.
+ */
 type ToolResourceOptions<M extends AnyModels, T extends TableKey<M>, Ref = string> = ResourceRouteOptions<M, T, Ref> & {
   /**
-   * Opaque data per operation, e.g. a permission, passed to
-   * `authorize` and `visible` as the table tool's `meta`. Never sent to
-   * clients. An operation without an entry gets `undefined`.
+   * Opaque data per operation, e.g. a permission, passed to `authorize` and
+   * `visible` as the table tool's `meta`. Never sent to clients. An operation
+   * without an entry gets `undefined`.
    */
   readonly meta?: { readonly [K in ResourceOperation]?: unknown; };
 };
@@ -159,13 +171,16 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   readonly title?: string;
   /** Sent to clients on `initialize`, e.g. how the tools fit together. */
   readonly instructions?: string;
-  /** Tables exposed as tools: `<table>_list`, `_get`, `_create`, `_update`, `_delete`. */
+  /**
+   * Tables exposed as tools: `<table>_list`, `_get`, `_create`, `_update`,
+   * `_delete`.
+   */
   readonly resources?: ToolResources<M, Ref>;
   readonly tools?: readonly McpTool<M, F, E, C, P, B>[];
   /**
-   * The authorization provider's operations (`authorization.operations` in
-   * the config). A tool's `mcp.tool.<name>` entry replaces its `permission`,
-   * so the provider decides what each tool needs.
+   * The authorization provider's operations (`authorization.operations` in the
+   * config). A tool's `mcp.tool.<name>` entry replaces its `permission`, so the
+   * provider decides what each tool needs.
    */
   readonly operations?: OperationTable;
   /**
@@ -191,33 +206,43 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   readonly requiredScopes?: readonly string[];
   /**
-   * Roles a signed-in user needs to call the server at all, read from a
-   * claim (`app_metadata.role` by default; a string or an array of
-   * strings). Users without one get 403; service-role callers pass.
+   * Roles a signed-in user needs to call the server at all, read from a claim
+   * (`app_metadata.role` by default; a string or an array of strings). Users
+   * without one get 403; service-role callers pass.
    *
    * ```ts
    * requiredRoles: { roles: ['admin', 'support'], claim: 'app_metadata.roles' }
    * ```
    */
   readonly requiredRoles?: RequiredRoles;
-  /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
+  /**
+   * Origins allowed to call the server (DNS rebinding protection). Defaults to
+   * any.
+   */
   readonly allowedOrigins?: readonly string[];
   /**
-   * Answers CORS preflights and adds `Access-Control-*` headers, so browser
-   * MCP clients can call the server. The allowed origin is `allowedOrigins`
-   * when set, any origin otherwise. Defaults to true.
+   * Answers CORS preflights and adds `Access-Control-*` headers, so browser MCP
+   * clients can call the server. The allowed origin is `allowedOrigins` when
+   * set, any origin otherwise. Defaults to true.
    */
   readonly cors?: boolean;
   /**
    * Hostnames the `Host` header may name, without the port (DNS rebinding
-   * protection). List the production, preview and local hosts. Defaults to any.
+   * protection). List the production, preview and local hosts. Defaults to
+   * any.
    */
   readonly allowedHosts?: readonly string[];
-  /** A page that explains how to connect, published as RFC 9728 `resource_documentation`. */
+  /**
+   * A page that explains how to connect, published as RFC 9728
+   * `resource_documentation`.
+   */
   readonly resourceDocumentation?: string;
   /** Custom jsonb types, as in `createOpenApi`. */
   readonly json?: Readonly<Record<string, unknown>>;
-  /** Include internal error messages in tool results. Defaults to `NODE_ENV === 'development'`. */
+  /**
+   * Include internal error messages in tool results. Defaults to `NODE_ENV ===
+   * 'development'`.
+   */
   readonly exposeErrors?: boolean;
   /**
    * Keeps the invocation alive for event sink sends a tool started, e.g.
@@ -238,7 +263,10 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   readonly visible?: (ctx: ToolContext<M, F, E, C, P, B>, tool: ToolRef) => boolean | Promise<boolean>;
 }
 interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string, B = unknown> extends BetterServer<M, F, E, C, P, B> {
-  /** Everything in one handler: the MCP endpoint and `/.well-known/oauth-protected-resource`. */
+  /**
+   * Everything in one handler: the MCP endpoint and
+   * `/.well-known/oauth-protected-resource`.
+   */
   readonly fetch: (request: Request) => Promise<Response>;
   /** The Streamable HTTP endpoint (POST JSON-RPC). */
   readonly endpoint: (request: Request) => Promise<Response>;
@@ -253,10 +281,10 @@ interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown,
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
 export declare function defineTool<M extends AnyModels, F extends AnyFunctions, E, I = Record<string, unknown>, C = unknown, P = unknown, Ref = unknown, B = unknown>(definition: ToolDefinition<M, F, E, I, C, P, Ref, B>): McpTool<M, F, E, C, P, B>;
 /**
- * An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
- * the Bearer token from the MCP client is verified and every query goes
- * through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
- * Supabase Auth's OAuth server.
+ * An MCP server (Streamable HTTP, stateless) whose tools run as the caller: the
+ * Bearer token from the MCP client is verified and every query goes through
+ * RLS. Answers 401 with RFC 9728 metadata so clients can sign in with Supabase
+ * Auth's OAuth server.
  */
 export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options: McpOptions<M, F, E, C, P, PermissionRef<A>, B> & {
   readonly authorizer?: A;

package/dist/mcp/index.js

@@ -1,34 +1,34 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { a as ok } from "../result-DIeYscA3.js";
-import { t as base64ToText } from "../base64-D4aqdnDR.js";
-import { n as validate } from "../standard-B1BigegP.js";
-import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-JRCohp1j.js";
-import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
-import { t as buildJsonSchema, v as toDraft07 } from "../json-schema-CpYINXG8.js";
-import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-CsIfMED7.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
-import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { t as boundedTtlCache } from "../ttl-cache-XzZ-Q2eX.js";
-import { n as checkPermission, t as checkEach } from "../authorizer-B3yyCVUF.js";
-import { t as defineResource } from "../resource-Bdkqi8jo.js";
-import { r as hasRole } from "../kit-LTbHrWWD.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
+import { a as ok } from "../result-DIT_qp4G.js";
+import { t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { n as validate } from "../standard-l10kE0yS.js";
+import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-D0KDiYPk.js";
+import { t as SPEC_PINS } from "../spec-pins-D3Tm6HJi.js";
+import { t as buildJsonSchema, v as toDraft07 } from "../json-schema-Bu4YCRbZ.js";
+import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-DVHRHvv6.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-D8dW6p2A.js";
+import { n as jsonResponse, t as jsonReplacer } from "../json-DaByVJpw.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-DjEmE_DN.js";
+import { t as boundedTtlCache } from "../ttl-cache-Bhr9swjT.js";
+import { n as checkPermission, t as checkEach } from "../authorizer-BVR2vPGA.js";
+import { t as defineResource } from "../resource-BVvIiuX_.js";
+import { r as hasRole } from "../kit-BeXTrlZn.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-BJ518zFH.js";
-import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DdYadv-o.js";
+import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-up6bKOUi.js";
+import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DzbloBR-.js";
 import { resourceMetadataResponse, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/dialect.ts
 /**
-* Revisions before 2025-11-25 have no default dialect, and clients written
-* for them validate tool schemas as draft-07.
+* Revisions before 2025-11-25 have no default dialect, and clients written for
+* them validate tool schemas as draft-07.
 */
 function schemaTargetFor(version) {
 	return version < "2025-11-25" ? "draft-07" : "draft-2020-12";
 }
 /**
-* Returns the listed tool with its schemas in a target's dialect, built
-* once per target. `convert` asks the input's Standard Schema library for
-* the target; without it, or when it can't, the 2020-12 schema is lowered.
+* Returns the listed tool with its schemas in a target's dialect, built once
+* per target. `convert` asks the input's Standard Schema library for the
+* target; without it, or when it can't, the 2020-12 schema is lowered.
 */
 function toolDialects(info, convert) {
 	const built = /* @__PURE__ */ new Map();
@@ -104,9 +104,8 @@ function missingRole(auth, required) {
 	return dbError("forbidden", `This server needs the role ${roles.join(" or ")}`, { code: "MISSING_ROLE" });
 }
 /**
-* The permission a tool needs: the provider's entry for the tool's
-* `operation` (default `mcp.tool.<name>`) first, then the tool's own
-* `permission`.
+* The permission a tool needs: the provider's entry for the tool's `operation`
+* (default `mcp.tool.<name>`) first, then the tool's own `permission`.
 */
 function toolPermission(operations, name, declared, operation = `${OPERATION_PREFIXES.mcpTool}${name}`) {
 	return operationPermission(operations, operation, typeof declared === "string" ? declared : void 0) ?? declared;
@@ -135,8 +134,8 @@ async function checkTool(authorizer, tool, args, db) {
 	});
 }
 /**
-* Which tools the caller may see, in `tools` order: one batch per
-* permission, and a tool without a permission is always shown.
+* Which tools the caller may see, in `tools` order: one batch per permission,
+* and a tool without a permission is always shown.
 */
 async function permittedTools(authorizer, tools, context) {
 	const shown = tools.map((tool) => tool.permission === void 0);
@@ -167,12 +166,6 @@ async function permittedTools(authorizer, tools, context) {
 }
 //#endregion
 //#region src/mcp/protocol.ts
-/**
-* The transport-free part of MCP: protocol versions, tool and result shapes,
-* the handshake results and a dispatcher for one JSON-RPC message. The
-* Streamable HTTP server in `mcp.ts` and the CLI's stdio server share it, so
-* it imports nothing from Node.
-*/
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
 const LEGACY_VERSIONS = [
@@ -184,7 +177,10 @@ const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
 /** How long clients may cache `tools/list` and `server/discover`. */
 const LIST_TTL_MS = 3e5;
 const CAPABILITIES = { tools: { listChanged: false } };
-/** A tool result: the value as text, and as `structuredContent` when it is an object. */
+/**
+* A tool result: the value as text, and as `structuredContent` when it is an
+* object.
+*/
 function textResult(value, isError = false) {
 	const structured = isObject(value) ? value : void 0;
 	return {
@@ -234,8 +230,8 @@ const response = (id, result) => ({
 	result
 });
 /**
-* The JSON-RPC response to one message, or `undefined` for a notification.
-* It answers `initialize`, `server/discover`, `ping`, `tools/list` and
+* The JSON-RPC response to one message, or `undefined` for a notification. It
+* answers `initialize`, `server/discover`, `ping`, `tools/list` and
 * `tools/call`, for message-based transports such as stdio.
 */
 async function answerMessage(message, server) {
@@ -399,10 +395,10 @@ function tableTools(resource, defs) {
 /** Callers whose visible tool lists are kept; the oldest goes first. */
 const VISIBLE_LISTS_MAX = 1e3;
 /**
-* An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
-* the Bearer token from the MCP client is verified and every query goes
-* through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
-* Supabase Auth's OAuth server.
+* An MCP server (Streamable HTTP, stateless) whose tools run as the caller: the
+* Bearer token from the MCP client is verified and every query goes through
+* RLS. Answers 401 with RFC 9728 metadata so clients can sign in with Supabase
+* Auth's OAuth server.
 */
 function createMcp(betterSupabase, options) {
 	const server = createServer(betterSupabase, options);
@@ -421,7 +417,7 @@ function createMcp(betterSupabase, options) {
 		registry.set(entry.info.name, entry);
 		allTools = void 0;
 		listed.clear();
-		generation++;
+		generation += 1;
 	};
 	const failure = (error) => textResult(toProblem(error, { expose }), true);
 	const refused = async (tool, args, ctx) => {
@@ -510,7 +506,10 @@ function createMcp(betterSupabase, options) {
 	*/
 	const visibleLists = boundedTtlCache({ max: VISIBLE_LISTS_MAX });
 	let warned = false;
-	/** A tool with a permission and no authorizer to check it is never listed, which is easy to miss. */
+	/**
+	* A tool with a permission and no authorizer to check it is never listed,
+	* which is easy to miss.
+	*/
 	const warnHidden = (all) => {
 		if (warned || options.authorizer) return;
 		const hidden = all.filter((entry) => entry.permission !== void 0).map((entry) => entry.info.name);
@@ -519,7 +518,10 @@ function createMcp(betterSupabase, options) {
 			console.warn(`createMcp: ${hidden.join(", ")} ${hidden.length === 1 ? "has" : "have"} a permission but no authorizer is set, so tools/list hides ${hidden.length === 1 ? "it" : "them"}. Pass authorizer to createMcp, or drop the permission.`);
 		}
 	};
-	/** Without a `visible` hook or permissions every caller sees the same list, built once. */
+	/**
+	* Without a `visible` hook or permissions every caller sees the same list,
+	* built once.
+	*/
 	const visibleTools = async (context, target) => {
 		const all = [...registry.values()];
 		const gated = all.some((entry) => entry.permission !== void 0);
@@ -582,7 +584,10 @@ function createMcp(betterSupabase, options) {
 		response.headers.set("www-authenticate", challenge);
 		return response;
 	};
-	/** A missing second factor is no scope problem, and an outage is not the caller's fault. */
+	/**
+	* A missing second factor is no scope problem, and an outage is not the
+	* caller's fault.
+	*/
 	const refuse = (request, denied) => {
 		if (denied.kind === "unauthorized") return unauthorized(request);
 		if (denied.kind !== "forbidden") return problemResponse(denied, { expose });
@@ -592,7 +597,10 @@ function createMcp(betterSupabase, options) {
 		supported: [...SUPPORTED_VERSIONS],
 		requested
 	});
-	/** 2026-07-28 requests carry their version and capabilities, mirrored in headers. */
+	/**
+	* 2026-07-28 requests carry their version and capabilities, mirrored in
+	* headers.
+	*/
 	const checkModern = (message, header, headers) => {
 		const meta = message.params?.["_meta"];
 		const version = isObject(meta) ? meta[META_VERSION] : void 0;

package/dist/mcp/sdk/index.d.ts

@@ -1,25 +1,25 @@
-import { a as AnyModels, i as AnyFunctions } from "../../types-BrpW5ixT.js";
-import { r as AuthState } from "../../resolve-Bqb8TMTt.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-CNs0Jx0I.js";
-import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-C6tMoEjn.js";
-import { t as BetterSupabase } from "../../define-M_r1d2AT.js";
-import { a as ServerContext$1, c as ServerOptions, n as BetterServer } from "../../server-types-BKN_R4Ws.js";
-import { r as GuardOptions, t as AllowedCaller } from "../../respond-CEBC6KUX.js";
+import { a as AnyModels, i as AnyFunctions } from "../../types-DmshMaXz.js";
+import { r as AuthState } from "../../resolve-D57oDWNr.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-Dmsbl8ug.js";
+import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-Z4vtsuoO.js";
+import { t as BetterSupabase } from "../../define-D0LSXmUP.js";
+import { a as ServerContext$1, c as ServerOptions, n as BetterServer } from "../../server-types-D_cQ6OxZ.js";
+import { r as GuardOptions, t as AllowedCaller } from "../../respond-QW-f1yio.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts
 interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
   /**
    * The MCP endpoint's public URL, the RFC 9728 `resource`. Defaults to the
-   * request URL without a trailing slash, and on Supabase Edge Functions to
-   * the public `<origin>/functions/v1/<slug>`; pass it when a proxy rewrites
-   * the host or path.
+   * request URL without a trailing slash, and on Supabase Edge Functions to the
+   * public `<origin>/functions/v1/<slug>`; pass it when a proxy rewrites the
+   * host or path.
    */
   readonly resource?: string | ((request: Request) => string);
   /** Defaults to the project's Supabase Auth issuer. */
   readonly authorizationServers?: readonly string[];
   /**
-   * Answers CORS preflights in `serve` and adds `Access-Control-*` headers
-   * (any origin), so browser MCP clients can call the server. Defaults to true.
+   * Answers CORS preflights in `serve` and adds `Access-Control-*` headers (any
+   * origin), so browser MCP clients can call the server. Defaults to true.
    */
   readonly cors?: boolean;
   /** Scopes published as `scopes_supported`; `offline_access` is never listed. */
@@ -37,22 +37,28 @@ interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
-/** A fetch handler that takes verified auth, like the SDK's `createMcpHandler(...)`. */
+/**
+ * A fetch handler that takes verified auth, like the SDK's
+ * `createMcpHandler(...)`.
+ */
 interface McpFetchHandler {
   fetch(request: Request, options?: {
     readonly authInfo?: AuthInfo;
   }): Promise<Response>;
 }
 interface BetterMcpAuth<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
-  /** An `OAuthTokenVerifier` for the SDK's bearer helpers; it verifies the token locally. */
+  /**
+   * An `OAuthTokenVerifier` for the SDK's bearer helpers; it verifies the token
+   * locally.
+   */
   readonly verifier: OAuthTokenVerifier;
   /** The RFC 9728 Protected Resource Metadata document. */
   metadata(request: Request): Response;
   /** Where the metadata is served, for `WWW-Authenticate` challenges. */
   metadataUrl(request: Request): string;
   /**
-   * A fetch handler that serves the metadata, refuses callers without a
-   * valid bearer token (401 or 403 with an RFC 9728 challenge), then calls
+   * A fetch handler that serves the metadata, refuses callers without a valid
+   * bearer token (401 or 403 with an RFC 9728 challenge), then calls
    * `handler.fetch(request, { authInfo })`.
    */
   serve(handler: McpFetchHandler): (request: Request) => Promise<Response>;
@@ -77,7 +83,10 @@ interface BetterToolConfig<InputArgs extends StandardSchemaWithJSON | undefined,
   readonly icons?: Icon[];
   readonly scopeChallenge?: ScopeChallengeHandler;
   readonly _meta?: Record<string, unknown>;
-  /** Extra keys for wrappers registered in between, such as an authorization library's `permission`. */
+  /**
+   * Extra keys for wrappers registered in between, such as an authorization
+   * library's `permission`.
+   */
   readonly [key: string]: unknown;
 }
 type ToolReturn = CallToolResult | InputRequiredResult | Promise<CallToolResult | InputRequiredResult>;
@@ -86,21 +95,24 @@ type BetterToolCallback<InputArgs extends StandardSchemaWithJSON | undefined, Ct
 type BetterMcpServer<S, M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> = Omit<S, "registerTool"> & {
   registerTool<OutputArgs extends StandardSchemaWithJSON | undefined = undefined, InputArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: BetterToolConfig<InputArgs, OutputArgs>, cb: BetterToolCallback<InputArgs, BetterToolContext<M, F, E, C, P, B>>): RegisteredTool;
 };
-/** The structural part of `McpServer` (or a wrapper of it) that `withBetterSupabaseMcp` needs. */
+/**
+ * The structural part of `McpServer` (or a wrapper of it) that
+ * `withBetterSupabaseMcp` needs.
+ */
 interface ToolRegistrar {
   registerTool(name: string, config: never, cb: (...params: never[]) => unknown): unknown;
 }
 /**
  * Bearer auth for an MCP server built on the official SDK
  * (`@modelcontextprotocol/server` 2.3 or later). Verifies Supabase access
- * tokens locally, serves the RFC 9728 metadata, and binds repositories to
- * the caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
+ * tokens locally, serves the RFC 9728 metadata, and binds repositories to the
+ * caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
  */
 export declare function createMcpAuth<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: McpAuthOptions): BetterMcpAuth<M, F, E, C, P, B>;
 /**
- * Wraps `server.registerTool` so every tool callback gets `db`, `auth` and
- * `bs` for the caller on its context. Wrap after an authorization wrapper
- * so permissions are checked before the context is built.
+ * Wraps `server.registerTool` so every tool callback gets `db`, `auth` and `bs`
+ * for the caller on its context. Wrap after an authorization wrapper so
+ * permissions are checked before the context is built.
  */
 export declare function withBetterSupabaseMcp<S extends ToolRegistrar, M extends AnyModels, F extends AnyFunctions, E, C, P, B>(server: S, auth: Pick<BetterMcpAuth<M, F, E, C, P, B>, "contextOf">): BetterMcpServer<S, M, F, E, C, P>;
 //#endregion
@@ -114,8 +126,8 @@ interface SupabaseMcpHandlerOptions<C = unknown, P = unknown> extends SupabaseMc
   /** The app credential that holds a Management API access token. */
   readonly credentialRef: CredentialRef;
   /**
-   * Who may use the server once the bearer token verified. Its tools
-   * administer the project, so allow only the people who run it.
+   * Who may use the server once the bearer token verified. Its tools administer
+   * the project, so allow only the people who run it.
    */
   readonly authorize: (auth: UserAuth<C, P>) => boolean | Promise<boolean>;
   /** The Management API URL; Supabase's when unset. */

package/dist/mcp/sdk/index.js

@@ -1,11 +1,11 @@
-import { n as dbError } from "../../errors-BV1SKTVs.js";
-import { o as problemResponse } from "../../problem-JRCohp1j.js";
-import { i as delegationOf } from "../../actor-CAL8mMih.js";
-import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-B2WRsRIg.js";
-import { r as guard } from "../../respond-Bhp3G__q.js";
+import { n as dbError } from "../../errors-D7u24ZJH.js";
+import { o as problemResponse } from "../../problem-D0KDiYPk.js";
+import { i as delegationOf } from "../../actor-C9pwyCVz.js";
+import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-D8dW6p2A.js";
+import { r as guard } from "../../respond-DjEmE_DN.js";
 import { t as withExtra } from "../../extra-CGQ2_q3S.js";
-import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
-import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-DomZ-amK.js";
+import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DzbloBR-.js";
+import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-Dz9DgrKP.js";
 import { OAuthError, bearerAuthChallengeResponse, verifyBearerToken } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.ts
 /** Where `serve` keeps the verified `AuthState` in `AuthInfo.extra`. */
@@ -20,12 +20,15 @@ function isUserState(value, verified) {
 /**
 * Bearer auth for an MCP server built on the official SDK
 * (`@modelcontextprotocol/server` 2.3 or later). Verifies Supabase access
-* tokens locally, serves the RFC 9728 metadata, and binds repositories to
-* the caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
+* tokens locally, serves the RFC 9728 metadata, and binds repositories to the
+* caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
 */
 function createMcpAuth(betterSupabase, options = {}) {
 	const server = createServer(betterSupabase, options);
-	/** Auth states this instance verified and guarded; any other `AuthInfo.extra` is ignored. */
+	/**
+	* Auth states this instance verified and guarded; any other `AuthInfo.extra`
+	* is ignored.
+	*/
 	const verified = /* @__PURE__ */ new WeakSet();
 	const allow = options.allow ?? ["user"];
 	const scopes = options.requiredScopes ?? [];
@@ -104,9 +107,9 @@ function createMcpAuth(betterSupabase, options = {}) {
 	});
 }
 /**
-* Wraps `server.registerTool` so every tool callback gets `db`, `auth` and
-* `bs` for the caller on its context. Wrap after an authorization wrapper
-* so permissions are checked before the context is built.
+* Wraps `server.registerTool` so every tool callback gets `db`, `auth` and `bs`
+* for the caller on its context. Wrap after an authorization wrapper so
+* permissions are checked before the context is built.
 */
 function withBetterSupabaseMcp(server, auth) {
 	const register = server.registerTool.bind(server);