better-supabase 0.13.0 → 0.14.0

package/dist/cli/live-1eL2MIkS.js

@@ -0,0 +1,344 @@
+import { r as errorText } from "./errors-BTe6A15O.js";
+import "./snapshot-Dkwxc1uV.js";
+import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-CCpxS5if.js";
+//#region src/cli/doctor/reserved-roles.ts
+/**
+* Supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
+* drop or change the memberships of these.
+*/
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_functions_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer"
+]);
+/**
+* Reserved roles whose settings (`alter role ... set`) supautils allows
+* changing.
+*/
+const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"authenticated",
+	"anon",
+	"service_role"
+]);
+/**
+* Roles that Supabase's own services log in as. Their statements (PostgREST's
+* schema cache query, Auth and Storage migrations) aren't the app's.
+*/
+const PLATFORM_ROLES = /* @__PURE__ */ new Set([...RESERVED_ROLES, "authenticator"]);
+/** Comments and string literals blanked, newlines kept so offsets map to lines. */
+const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
+const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
+/** Why a statement changes a reserved role, or undefined when it doesn't. */
+function reservedRoleChange(statement) {
+	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
+	if (alter) {
+		const role = roleNames(alter[2])[0];
+		const verb = alter[1].toLowerCase();
+		const next = alter[3].toLowerCase();
+		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
+		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
+		return;
+	}
+	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
+	if (!membership) return;
+	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
+	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
+}
+/**
+* Where a statement ends, including statements inside `do` blocks and function
+* bodies.
+*/
+const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
+/** Statements in schema files and migrations that supautils rejects on Supabase. */
+function reservedRoles(context) {
+	return (context.sqlFiles ?? []).flatMap((file) => {
+		const code = sqlCode(file.text);
+		const findings = [];
+		let start = 0;
+		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
+			const until = end?.index ?? code.length;
+			const statement = code.slice(start, until);
+			const reason = reservedRoleChange(statement);
+			if (reason !== void 0) {
+				const at = start + statement.search(/\S/);
+				const line = code.slice(0, at).split("\n").length;
+				findings.push({
+					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
+					target: `${file.path}:${String(line)}`,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			start = until + (end?.[0].length ?? 0);
+		}
+		return findings;
+	});
+}
+//#endregion
+//#region src/cli/doctor/live.ts
+/**
+* Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are
+* BS209.
+*/
+const SLOW_MEAN_MS = 50;
+const SLOW_CALLS = 1e3;
+/**
+* Rows `--explain` reads, like a `findMany()` under Supabase's default
+* `max_rows`.
+*/
+const EXPLAIN_LIMIT = 1e3;
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const literal = (text) => `'${text.replaceAll("'", "''")}'`;
+const oneLine = (query, max = 160) => {
+	const flat = query.replaceAll(/\s+/g, " ").trim();
+	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+};
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+/** The schema `pg_stat_statements` lives in, when the extension is installed. */
+async function statementsView(db) {
+	const [row] = await db.query(`select n.nspname as schema from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'`);
+	return row ? `${ident(row.schema)}.pg_stat_statements` : void 0;
+}
+/** The first exposed table a statement names, to locate it in the SQL files. */
+function tableIn(query, tables) {
+	return tables.find((table) => {
+		const schema = escape(table.schema);
+		const name = escape(table.name);
+		return new RegExp(`(?:"${schema}"|\\b${schema})\\.(?:"${name}"|${name}\\b)`).test(query);
+	});
+}
+const live = (context) => context.database;
+/**
+* Function calls and self time so far in this transaction. The view can still
+* hold unflushed counts from earlier transactions, so callers diff two
+* readings.
+*/
+async function functionTimes(db) {
+	const rows = await db.query(`select schemaname || '.' || funcname as name, calls, self_time from pg_stat_xact_user_functions`);
+	return new Map(rows.map((row) => [row.name, {
+		calls: Number(row.calls),
+		selfTime: Number(row.self_time)
+	}]));
+}
+/**
+* Node types, timings and loops of an `EXPLAIN (ANALYZE, FORMAT JSON)` plan;
+* never rows.
+*/
+function summarizePlan(output) {
+	const nodes = [];
+	const perRowSubPlans = [];
+	let initPlans = 0;
+	const walk = (node) => {
+		const loops = node["Actual Loops"] ?? 1;
+		const ms = (node["Actual Total Time"] ?? 0).toFixed(2);
+		const on = node["Relation Name"] ? ` on ${node["Relation Name"]}` : "";
+		const sub = node["Subplan Name"] ? `${node["Subplan Name"]}: ` : "";
+		nodes.push(`${sub}${node["Node Type"]}${on} ${ms} ms ×${loops}`);
+		if (node["Parent Relationship"] === "InitPlan") initPlans += 1;
+		if (node["Parent Relationship"] === "SubPlan" && loops > 1) perRowSubPlans.push(`${sub}${node["Node Type"]}${on} ×${loops}`);
+		for (const child of node.Plans ?? []) walk(child);
+	};
+	walk(output.Plan);
+	return {
+		nodes,
+		initPlans,
+		perRowSubPlans,
+		executionMs: output["Execution Time"] ?? 0
+	};
+}
+const ROLE = /^[a-z_][a-z0-9_]*$/;
+async function explainTable(db, table, claims) {
+	const role = typeof claims["role"] === "string" ? claims["role"] : "anon";
+	if (!ROLE.test(role)) throw new Error(`Invalid role "${role}" in the claims`);
+	await db.query("begin");
+	try {
+		await db.query(`set local statement_timeout = '30s'`);
+		let tracked = true;
+		await db.query("savepoint bs_track");
+		try {
+			await db.query(`set local track_functions = 'all'`);
+			await db.query("release savepoint bs_track");
+		} catch {
+			tracked = false;
+			await db.query("rollback to savepoint bs_track");
+		}
+		await db.query(`select set_config('request.jwt.claims', ${literal(JSON.stringify(claims))}, true)`);
+		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
+		await db.query(`set local role ${ident(role)}`);
+		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident(table.schema)}.${ident(table.name)} limit ${EXPLAIN_LIMIT}`);
+		const raw = row?.["QUERY PLAN"];
+		const plan = typeof raw === "string" ? JSON.parse(raw) : raw;
+		if (!plan?.[0]) throw new Error("EXPLAIN returned no plan");
+		const functions = tracked ? [...await functionTimes(db)].map(([name, after]) => {
+			const start = before.get(name);
+			return {
+				name,
+				calls: after.calls - (start?.calls ?? 0),
+				selfTime: after.selfTime - (start?.selfTime ?? 0)
+			};
+		}).filter((fn) => fn.calls > 0).toSorted((a, b) => b.selfTime - a.selfTime) : void 0;
+		return {
+			summary: summarizePlan(plan[0]),
+			functions
+		};
+	} finally {
+		await db.query("rollback");
+	}
+}
+function resolveTable(context, name) {
+	return name.includes(".") ? catalogOf(context).tables.find((table) => qualified(table) === name) : exposed(context).find((table) => table.name === name);
+}
+const LIVE_RULES = [
+	{
+		code: "BS208",
+		severity: "warning",
+		title: "Queries spill to temporary files",
+		description: "Sorts and hashes that exceed `work_mem` write temporary files, which is slow. Reads `pg_stat_database` and, when installed, the top statements from `pg_stat_statements`. When every statement that spilled ran as a Supabase service role (PostgREST's schema cache query as `authenticator`, Auth or Storage) or came from better-supabase's own catalog reads (`introspect`, `gen`, `doctor`), there is no finding.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			try {
+				const [stats] = await db.query(`select temp_files, temp_bytes, current_setting('work_mem') as work_mem from pg_stat_database where datname = current_database()`);
+				const files = Number(stats?.temp_files ?? 0);
+				if (files === 0) return [];
+				let top = "";
+				const view = await statementsView(db);
+				if (view) {
+					const spilled = await db.query(`select s.query, s.temp_blks_written, r.rolname as role from ${view} s left join pg_roles r on r.oid = s.userid where s.temp_blks_written > 0 order by s.temp_blks_written desc limit 50`).catch(() => []);
+					const statements = spilled.filter((statement) => !statement.query.startsWith("/* better-supabase */") && (statement.role === null || !PLATFORM_ROLES.has(statement.role))).slice(0, 5);
+					if (spilled.length > 0 && statements.length === 0) return [];
+					if (statements.length > 0) top = ` Top statements by temporary blocks written: ${statements.map((statement) => `${oneLine(statement.query, 100)} (${statement.temp_blks_written} blocks)`).join("; ")}.`;
+				}
+				return [{
+					message: `${files} temporary files (${megabytes(Number(stats?.temp_bytes ?? 0))}) since the statistics were reset; work_mem is ${stats?.work_mem}. Add indexes so large sorts go away, or raise work_mem for the role that runs them.${top}`,
+					target: "pg_stat_database:temp_files"
+				}];
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_database (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS209",
+		severity: "warning",
+		title: "Slow frequent statements",
+		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
+		async check(context) {
+			if (!context.stats) return [];
+			const db = live(context);
+			if (!db) return [];
+			if ("skipped" in db) return [{
+				severity: "info",
+				message: `Skipped --stats: ${db.skipped}`
+			}];
+			try {
+				const view = await statementsView(db);
+				if (!view) return [{
+					severity: "info",
+					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
+				}];
+				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
+				const tables = exposed(context);
+				return statements.map((statement) => {
+					const table = tableIn(statement.query, tables);
+					return {
+						message: `${Number(statement.mean_exec_time).toFixed(1)} ms mean over ${statement.calls} calls: ${oneLine(statement.query)}`,
+						target: `pg_stat_statements:${statement.queryid}`,
+						...table ? { object: tableObject(table) } : {}
+					};
+				});
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_statements (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS225",
+		severity: "info",
+		title: "pg_stat_statements is not installed",
+		description: "`pg_stat_statements` records the time and calls of each statement, which `--stats` (BS209), BS208 and the Supabase query performance report read. Without it there is no record of which queries are slow. Needs a database; saved snapshots skip it.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			if (context.stats && context.codes?.includes("BS209")) return [];
+			try {
+				if (await statementsView(db)) return [];
+			} catch {
+				return [];
+			}
+			return [{
+				message: `pg_stat_statements is not installed on the ${db.describe}, so nothing records which statements are slow. Run \`create extension if not exists pg_stat_statements with schema extensions;\` in a migration.`,
+				target: "extension:pg_stat_statements"
+			}];
+		}
+	},
+	{
+		code: "BS212",
+		severity: "info",
+		title: "RLS plan for a table",
+		description: `\`--explain <tables>\` runs \`EXPLAIN (ANALYZE, BUFFERS)\` on \`select * from <table> limit ${EXPLAIN_LIMIT}\` as the given claims, in a transaction that is rolled back. It reports node types, timings and loops, never rows, and warns when a policy SubPlan runs once per row.`,
+		async check(context) {
+			const request = context.explain;
+			if (!request) return [];
+			const db = live(context);
+			if (!db || "skipped" in db || !db.session) return [{
+				severity: "warning",
+				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
+			}];
+			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
+			const findings = [];
+			for (const name of request.tables) {
+				const table = resolveTable(context, name);
+				if (!table) {
+					findings.push({
+						severity: "warning",
+						message: `--explain: no table "${name}" in the exposed schemas; qualify tables in other schemas, like better_supabase.memberships.`
+					});
+					continue;
+				}
+				try {
+					const { summary, functions } = await explainTable(db, table, request.claims);
+					const helpers = functions ? functions.length > 0 ? ` Function time: ${functions.map((fn) => {
+						const self = fn.selfTime;
+						const share = summary.executionMs > 0 ? Math.round(self / summary.executionMs * 100) : 0;
+						return `${fn.name} ${self.toFixed(2)} ms over ${plural(fn.calls, "call")} (${share}%)`;
+					}).join(", ")}.` : " No tracked function ran; inlined SQL functions are part of the plan." : " Function times need `track_functions`, which this role may not set; showing the plan only.";
+					const perRow = summary.perRowSubPlans.length > 0 ? ` Per-row SubPlans: ${summary.perRowSubPlans.join(", ")}; wrap the policy's function calls in \`(select ...)\` so they run once as an InitPlan.` : "";
+					findings.push({
+						...summary.perRowSubPlans.length > 0 ? { severity: "warning" } : {},
+						message: `${qualified(table)} as ${who}: ${summary.executionMs.toFixed(2)} ms, ${plural(summary.initPlans, "InitPlan")}. Plan: ${summary.nodes.join(" > ")}.${perRow}${helpers}`,
+						target: `${qualified(table)}:explain`,
+						object: tableObject(table)
+					});
+				} catch (cause) {
+					findings.push({
+						severity: "warning",
+						message: `--explain ${qualified(table)} failed: ${errorText(cause)}`,
+						target: `${qualified(table)}:explain`
+					});
+				}
+			}
+			return findings;
+		}
+	}
+];
+//#endregion
+export { reservedRoles as i, ident as n, literal as r, LIVE_RULES as t };

package/dist/cli/mcp-CaFW6uKU.js

@@ -0,0 +1,240 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-33pu13LT.js";
+import { a as envelope, i as run } from "./run-CE2s5TDh.js";
+import { t as VERSION } from "./version-CTqnp3HO.js";
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { n as consentToken } from "./agent-CbuPvI2x.js";
+import { C as optional, D as record, N as unknown, a as array, d as is, j as string$1, k as safeParse, o as boolean, t as PROCESS_ENV, x as object } from "./env-DMgjB_4y.js";
+import { createInterface } from "node:readline";
+import { answerLine } from "better-supabase/mcp";
+//#region src/cli/mcp/server.ts
+/**
+* The dev-time MCP server behind `better-supabase mcp`: each tool runs one CLI
+* command in process with `--json` and returns its result envelope. Tools that
+* write files exist only with `--allow-writes`, and each call needs a consent
+* token the user agreed to (ADR 0047, ADR 0049).
+*/
+const Input = object({
+	category: optional(string$1()),
+	block: optional(string$1()),
+	blocks: optional(array(string$1())),
+	text: optional(string$1()),
+	preset: optional(string$1()),
+	allow_breaking: optional(boolean()),
+	confirm: optional(string$1())
+});
+const string = (description) => ({
+	type: "string",
+	description
+});
+const CONFIRM = string("The consent token from the last call's error, once the user agreed to the change");
+const schema = (properties, required = []) => ({
+	type: "object",
+	properties,
+	...required.length > 0 ? { required } : {},
+	additionalProperties: false
+});
+const read = (name, description, inputSchema, argv) => ({
+	info: {
+		name,
+		description,
+		inputSchema,
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	},
+	writes: false,
+	argv
+});
+const write = (name, description, properties, required, argv) => ({
+	info: {
+		name,
+		description: `${description} Writes files: the first call returns a consent token; call again with confirm once the user agrees.`,
+		inputSchema: schema({
+			...properties,
+			confirm: CONFIRM
+		}, required),
+		annotations: {
+			readOnlyHint: false,
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	},
+	writes: true,
+	argv
+});
+const PRESET = string("A named preset, a code from /create or a Create URL");
+const TOOLS = [
+	read("doctor", "Checks RLS, indexes, drift, auth config, env files and migration safety, and lists the findings.", schema({}), () => ["doctor"]),
+	read("blocks_list", "Lists the blocks the project can add, optionally in one category.", schema({ category: string("One block category") }), ({ category }) => [
+		"blocks",
+		"list",
+		...category === void 0 ? [] : ["--category", category]
+	]),
+	read("blocks_view", "Shows a block: its tables, the blocks it requires and its options.", schema({ block: string("The block's name") }, ["block"]), ({ block }) => [
+		"blocks",
+		"view",
+		block ?? ""
+	]),
+	read("blocks_search", "Finds blocks by name, description or category.", schema({ text: string("Words to find") }, ["text"]), ({ text }) => [
+		"blocks",
+		"search",
+		...(text ?? "").split(/\s+/)
+	]),
+	read("config", "Prints the resolved config with every option and its default, credentials redacted.", schema({}), () => ["config"]),
+	read("preset_info", "Shows the config's preset and how the config differs from it.", schema({}), () => ["preset", "info"]),
+	read("sql_list", "Lists the SQL modules and which ones the project has.", schema({}), () => ["sql", "list"]),
+	read("gen_check", "Reports the generated files that are out of date, writing nothing.", schema({}), () => ["gen", "--check"]),
+	read("apply_dry_run", "Shows the config diff and the design changes a preset or Create URL makes, with their severity, writing nothing.", schema({ preset: PRESET }, ["preset"]), ({ preset }) => [
+		"apply",
+		"--preset",
+		preset ?? "",
+		"--dry-run"
+	]),
+	write("gen", "Regenerates the typed client and every other generated file.", {}, [], () => ["gen"]),
+	write("sql_sync", "Writes the SQL module files for the blocks the config lists and removes the others.", {}, [], () => ["sql", "sync"]),
+	write("apply", "Applies a preset or Create URL: edits the config and writes the blocks' modules.", {
+		preset: PRESET,
+		allow_breaking: {
+			type: "boolean",
+			description: "Write breaking app table changes such as a rename"
+		}
+	}, ["preset"], ({ preset, allow_breaking: allowBreaking }) => [
+		"apply",
+		"--preset",
+		preset ?? "",
+		...allowBreaking === true ? ["--allow-breaking"] : []
+	]),
+	write("add", "Adds blocks with the blocks they require.", { blocks: {
+		type: "array",
+		items: { type: "string" },
+		minItems: 1
+	} }, ["blocks"], ({ blocks }) => ["add", ...blocks ?? []])
+];
+const INSTRUCTIONS = "Tools for the better-supabase project in this directory. Each returns the CLI's JSON envelope (status, data, error, next). Read with doctor, config, blocks_* and the dry runs first. Tools that write files ask for consent: show the user the error's detail, and call again with confirm set to its token only after they agree.";
+function parsedEnvelope(stdout) {
+	try {
+		const value = JSON.parse(stdout);
+		return is(record(string$1(), unknown()), value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+function consentResult(name, detail, token) {
+	const error = new CliError("consent_required", `${detail}. Ask the user first, then call ${name} again with confirm "${token}".`, {
+		token,
+		next: [{
+			command: `${name} ${JSON.stringify({ confirm: token })}`,
+			when: "after the user agrees"
+		}]
+	});
+	const body = envelope(error.exitCode, {
+		error: error.problem,
+		next: error.next
+	});
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(body)
+		}],
+		structuredContent: { ...body },
+		isError: true
+	};
+}
+/** The dev MCP server for one project directory. */
+function createDevMcp(options) {
+	const tools = TOOLS.filter((tool) => options.allowWrites === true || !tool.writes);
+	const byName = new Map(tools.map((tool) => [tool.info.name, tool]));
+	const globals = options.globals ?? [];
+	const callTool = async (name, args) => {
+		const tool = byName.get(name);
+		if (!tool) return;
+		const parsed = safeParse(Input, args ?? {});
+		if (!parsed.success) return {
+			content: [{
+				type: "text",
+				text: `Invalid arguments: ${parsed.issues.map((issue) => issue.message).join("; ")}`
+			}],
+			isError: true
+		};
+		const argv = [...tool.argv(parsed.output), ...globals];
+		if (tool.writes) {
+			const detail = `${name} writes files in ${options.cwd}`;
+			const token = consentToken(argv, {
+				effect: "mcp-write",
+				detail
+			});
+			if (parsed.output.confirm !== token) return consentResult(name, detail, token);
+		}
+		const result = await options.run([
+			...argv,
+			"--json",
+			"--agent",
+			"no"
+		], {
+			cwd: options.cwd,
+			env: options.env
+		});
+		const body = parsedEnvelope(result.stdout);
+		const diagnostics = result.stderr.trim();
+		return {
+			content: [{
+				type: "text",
+				text: body ? JSON.stringify(body) : result.stdout
+			}, ...diagnostics === "" ? [] : [{
+				type: "text",
+				text: diagnostics
+			}]],
+			...body ? { structuredContent: body } : {},
+			...result.code === 0 ? {} : { isError: true }
+		};
+	};
+	return {
+		info: {
+			name: "better-supabase",
+			version: VERSION
+		},
+		instructions: INSTRUCTIONS,
+		listTools: () => Promise.resolve(tools.map((tool) => tool.info)),
+		callTool
+	};
+}
+/**
+* Answers each newline-delimited JSON-RPC message in turn, writing one line per
+* response.
+*/
+async function serveLines(lines, server, write) {
+	for await (const line of lines) {
+		if (line.trim() === "") continue;
+		const response = await answerLine(line, server);
+		if (response !== void 0) write(`${JSON.stringify(response)}\n`);
+	}
+}
+const mcpCommand = defineCliCommand({
+	meta: commandMeta("mcp"),
+	args: { "allow-writes": {
+		type: "boolean",
+		description: "Add the tools that write files (gen, sql_sync, apply, add); each call still needs the user's consent token"
+	} },
+	runsWithInvalidConfig: true,
+	run: async (args, { cwd, configFile, config, env, io, log }) => {
+		const server = createDevMcp({
+			run,
+			cwd,
+			env: env[PROCESS_ENV] ?? {},
+			allowWrites: args["allow-writes"] === true,
+			globals: [...configFile ? ["--config", configFile] : [], ...config.environment ? ["--env", config.environment] : []]
+		});
+		log.info(`better-supabase MCP server on stdio for ${cwd}${args["allow-writes"] === true ? " (writes allowed with consent)" : " (read-only)"}`);
+		await serveLines(createInterface({
+			input: process.stdin,
+			crlfDelay: Infinity
+		}), server, io.stdout);
+		return {
+			code: 0,
+			streamed: true
+		};
+	}
+});
+//#endregion
+export { mcpCommand };