better-supabase 0.7.1 → 0.8.0

package/dist/mcp/index.js

@@ -1,16 +1,117 @@
-import { n as dbError } from "../errors-B11Duf73.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
+import { a as ok } from "../result-DEqHCMKP.js";
 import { t as base64ToText } from "../base64-D2gsioCY.js";
-import { n as validate } from "../standard-BK0cqJ7y.js";
-import { a as problemResponse, o as toProblem } from "../problem-BreOl8b8.js";
-import { t as SPEC_PINS } from "../spec-pins--j6mTok4.js";
-import { t as buildJsonSchema } from "../json-schema-CvER4kgT.js";
-import { c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
+import { n as validate } from "../standard-DkzZUneg.js";
+import { a as methodNotAllowed, o as problemResponse, s as toProblem } from "../problem-CJvFeGu7.js";
+import { t as SPEC_PINS } from "../spec-pins-DsLfUH7l.js";
+import { t as buildJsonSchema, v as toDraft07 } from "../json-schema-CT4tvrkA.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CN45ibbV.js";
 import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as defineResource } from "../resource-BsvzCMlX.js";
-import { r as hasRole } from "../kit-Fm-Fv7q5.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-volM3ByS.js";
+import { t as boundedTtlCache } from "../ttl-cache-XzZ-Q2eX.js";
+import { n as checkPermission, t as checkEach } from "../authorizer-ayxUDXXP.js";
+import { t as defineResource } from "../resource-DA811u_4.js";
+import { r as hasRole } from "../kit-BhHr9T9v.js";
+import { t as withExtra } from "../extra-CGQ2_q3S.js";
+import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-BJ518zFH.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DdYadv-o.js";
 import { resourceMetadataResponse, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
+//#region src/mcp/dialect.ts
+/**
+* Revisions before 2025-11-25 have no default dialect, and clients written
+* for them validate tool schemas as draft-07.
+*/
+function schemaTargetFor(version) {
+	return version < "2025-11-25" ? "draft-07" : "draft-2020-12";
+}
+/**
+* Returns the listed tool with its schemas in a target's dialect, built
+* once per target. `convert` asks the input's Standard Schema library for
+* the target; without it, or when it can't, the 2020-12 schema is lowered.
+*/
+function toolDialects(info, convert) {
+	const built = /* @__PURE__ */ new Map();
+	return (target) => {
+		const cached = built.get(target);
+		if (cached) return cached;
+		const input = convert?.(target);
+		const lower = target === "draft-07";
+		const result = input === void 0 && !lower ? info : {
+			...info,
+			inputSchema: input ?? toDraft07(info.inputSchema),
+			...info.outputSchema && lower ? { outputSchema: toDraft07(info.outputSchema) } : {}
+		};
+		built.set(target, result);
+		return result;
+	};
+}
+//#endregion
+//#region src/mcp/permissions.ts
+/** The refusal for a caller without one of `required`'s roles. */
+function missingRole(auth, required) {
+	if (!required || auth.kind === "service") return void 0;
+	const { roles, claim } = "roles" in required ? required : {
+		roles: required,
+		claim: void 0
+	};
+	if (roles.length === 0 || hasRole(auth, roles, claim)) return void 0;
+	return dbError("forbidden", `This server needs the role ${roles.join(" or ")}`, { code: "MISSING_ROLE" });
+}
+/** The context of a `tools/call` or `tools/list` request, if the client has one. */
+function contextOf(db) {
+	if (typeof db !== "object" || db === null || !("$context" in db)) return;
+	return db.$context;
+}
+/**
+* Checks a tool call as the caller of `db`: the tool is the resource, its
+* arguments its properties. A tool without a permission passes.
+*/
+async function checkTool(authorizer, tool, args, db) {
+	if (tool.permission === void 0) return ok(void 0);
+	const properties = typeof args === "object" && args !== null && !Array.isArray(args) ? args : void 0;
+	return checkPermission({
+		authorizer,
+		permission: tool.permission,
+		resource: {
+			type: "mcp_tool",
+			id: tool.info.name,
+			...properties ? { properties } : {}
+		},
+		context: contextOf(db)
+	});
+}
+/**
+* Which tools the caller may see, in `tools` order: one batch per
+* permission, and a tool without a permission is always shown.
+*/
+async function permittedTools(authorizer, tools, context) {
+	const shown = tools.map((tool) => tool.permission === void 0);
+	const groups = /* @__PURE__ */ new Map();
+	for (const [index, tool] of tools.entries()) {
+		if (tool.permission === void 0 || !authorizer) continue;
+		let key;
+		try {
+			key = authorizer.key(tool.permission);
+		} catch {
+			continue;
+		}
+		const group = groups.get(key) ?? {
+			permission: tool.permission,
+			indexes: []
+		};
+		group.indexes.push(index);
+		groups.set(key, group);
+	}
+	await Promise.all([...groups.values()].map(async ({ permission, indexes }) => {
+		const granted = await checkEach(authorizer, permission, indexes.map((index) => ({
+			type: "mcp_tool",
+			id: tools[index].name
+		})), context);
+		for (const [position, index] of indexes.entries()) shown[index] = granted[position] ?? false;
+	}));
+	return shown;
+}
+//#endregion
 //#region src/mcp/mcp.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
@@ -29,27 +130,26 @@ function hostAllowed(host, allowed) {
 		return false;
 	}
 }
-/** The refusal for a caller without one of `required`'s roles. */
-function missingRole(auth, required) {
-	if (!required || auth.kind === "service") return void 0;
-	const { roles, claim } = "roles" in required ? required : {
-		roles: required,
-		claim: void 0
-	};
-	if (roles.length === 0 || hasRole(auth, roles, claim)) return void 0;
-	return dbError("forbidden", `This server needs the role ${roles.join(" or ")}`, { code: "MISSING_ROLE" });
-}
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
 function defineTool(definition) {
 	if (!/^[A-Za-z0-9_.-]{1,64}$/.test(definition.name)) throw new TypeError(`Invalid tool name "${definition.name}": use 1-64 letters, digits, "_", "-" or "."`);
 	const standard = definition.input?.["~standard"];
-	const inputSchema = definition.inputSchema ?? standard?.jsonSchema?.input({ target: "draft-2020-12" }) ?? (definition.input ? void 0 : {
+	const convert = definition.inputSchema === void 0 ? standard?.jsonSchema : void 0;
+	const inputSchema = definition.inputSchema ?? convert?.input({ target: definition.jsonSchemaTarget ?? "draft-2020-12" }) ?? (definition.input ? void 0 : {
 		type: "object",
 		properties: {}
 	});
 	if (!inputSchema) throw new TypeError(`Tool "${definition.name}": the input schema has no JSON Schema; pass inputSchema`);
 	const { $schema: _, ...schema } = inputSchema;
 	return {
+		...convert ? { inputSchemaFor: (target) => {
+			try {
+				const { $schema: _dialect, ...converted } = convert.input({ target });
+				return converted;
+			} catch {
+				return;
+			}
+		} } : {},
 		info: {
 			name: definition.name,
 			...definition.title ? { title: definition.title } : {},
@@ -60,6 +160,7 @@ function defineTool(definition) {
 		},
 		...definition.input ? { input: definition.input } : {},
 		...definition.meta === void 0 ? {} : { meta: definition.meta },
+		...definition.permission === void 0 ? {} : { permission: definition.permission },
 		run: (args, ctx) => definition.run(args, ctx)
 	};
 }
@@ -90,25 +191,6 @@ const ANNOTATIONS = {
 		openWorldHint: false
 	}
 };
-function pageSchema(max, cursor) {
-	return {
-		type: "object",
-		properties: {
-			...cursor ? { after: { type: "string" } } : { page: {
-				type: "integer",
-				minimum: 1,
-				default: 1
-			} },
-			size: {
-				type: "integer",
-				minimum: 1,
-				maximum: max,
-				default: 50
-			}
-		},
-		additionalProperties: false
-	};
-}
 function tableTools(resource, defs) {
 	const { table, keyParam } = resource;
 	const row = defs[`${table}Row`] ?? { type: "object" };
@@ -123,32 +205,7 @@ function tableTools(resource, defs) {
 		additionalProperties: false
 	});
 	const cursor = resource.pagination === "cursor";
-	const page = cursor ? {
-		type: "object",
-		properties: {
-			items: {
-				type: "array",
-				items: row
-			},
-			nextCursor: { type: ["string", "null"] },
-			hasMore: { type: "boolean" }
-		},
-		required: [
-			"items",
-			"nextCursor",
-			"hasMore"
-		]
-	} : {
-		type: "object",
-		properties: {
-			items: {
-				type: "array",
-				items: row
-			},
-			page: { type: "object" }
-		},
-		required: ["items", "page"]
-	};
+	const page = pageSchema(row, cursor);
 	const tools = [];
 	const add = (operation, description, inputSchema, outputSchema) => {
 		tools.push({
@@ -165,7 +222,7 @@ function tableTools(resource, defs) {
 	};
 	for (const operation of resource.operations) switch (operation) {
 		case "list": {
-			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageSchema(resource.maxPageSize, cursor);
+			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageInputSchema(cursor, resource.maxPageSize);
 			add("list", `List ${table} rows visible to the caller, one page at a time.`, listSchema, page);
 			break;
 		}
@@ -250,12 +307,14 @@ function createMcp(betterSupabase, options) {
 	})["$defs"];
 	const registry = /* @__PURE__ */ new Map();
 	let allTools;
+	const listed = /* @__PURE__ */ new Map();
 	/** Bumped on every registration, so cached visible lists built before it miss. */
 	let generation = 0;
 	const register = (entry) => {
 		if (registry.has(entry.info.name)) throw new TypeError(`Duplicate MCP tool "${entry.info.name}"`);
 		registry.set(entry.info.name, entry);
 		allTools = void 0;
+		listed.clear();
 		generation++;
 	};
 	const failure = (error) => textResult(toProblem(error, { expose }), true);
@@ -274,7 +333,7 @@ function createMcp(betterSupabase, options) {
 		const key = table;
 		const entry = raw;
 		const { meta, ...route } = entry === true ? {} : entry;
-		const resource = defineResource(betterSupabase, key, route);
+		const resource = defineResource(betterSupabase, key, route, options.authorizer);
 		for (const { info, operation } of tableTools(resource, defs)) {
 			const ref = {
 				info,
@@ -282,6 +341,7 @@ function createMcp(betterSupabase, options) {
 			};
 			register({
 				...ref,
+				infoFor: toolDialects(info),
 				async call(args, ctx) {
 					const input = args ?? {};
 					const refusal = await refused(ref, input, ctx);
@@ -305,6 +365,8 @@ function createMcp(betterSupabase, options) {
 		};
 		register({
 			...ref,
+			...tool.permission === void 0 ? {} : { permission: tool.permission },
+			infoFor: toolDialects(tool.info, tool.inputSchemaFor),
 			async call(args, ctx) {
 				let value = args ?? {};
 				if (tool.input) {
@@ -312,6 +374,8 @@ function createMcp(betterSupabase, options) {
 					if (!parsed.ok) return failure(parsed.error);
 					value = parsed.data;
 				}
+				const checked = await checkTool(options.authorizer, tool, value, ctx.db);
+				if (!checked.ok) return failure(checked.error);
 				const refusal = await refused(ref, value, ctx);
 				if (refusal) return refusal;
 				const outcome = await settle(() => tool.run(value, ctx));
@@ -321,35 +385,38 @@ function createMcp(betterSupabase, options) {
 	};
 	for (const tool of options.tools ?? []) addTool(tool);
 	const listTools = () => allTools ??= [...registry.values()].map((entry) => entry.info);
+	const listFor = (target) => {
+		let tools = listed.get(target);
+		if (!tools) {
+			tools = [...registry.values()].map((entry) => entry.infoFor(target));
+			listed.set(target, tools);
+		}
+		return tools;
+	};
 	/**
 	* A user's visible list per token, for as long as clients may cache it
 	* (`ttlMs`). `tools/call` still checks `visible` on every call.
 	*/
-	const visibleLists = /* @__PURE__ */ new Map();
-	/** Without a `visible` hook every caller sees the same list, built once. */
-	const visibleTools = async (context) => {
-		if (!options.visible) return listTools();
+	const visibleLists = boundedTtlCache({ max: VISIBLE_LISTS_MAX });
+	/** Without a `visible` hook or permissions every caller sees the same list, built once. */
+	const visibleTools = async (context, target) => {
+		const all = [...registry.values()];
+		const gated = all.some((entry) => entry.permission !== void 0);
+		if (!options.visible && !gated) return listFor(target);
 		const ctx = context();
 		const token = ctx.auth.kind === "user" ? ctx.auth.token : void 0;
-		const now = Date.now();
 		const cached = token === void 0 ? void 0 : visibleLists.get(token);
-		if (cached && cached.until > now && cached.generation === generation) return cached.tools;
-		const entries = [...registry.values()];
-		const shown = await Promise.all(entries.map((entry) => isVisible(entry, ctx)));
-		const tools = entries.filter((_, index) => shown[index]).map((e) => e.info);
-		if (token !== void 0) {
-			visibleLists.delete(token);
-			if (visibleLists.size >= VISIBLE_LISTS_MAX) {
-				const oldest = visibleLists.keys().next();
-				if (!oldest.done) visibleLists.delete(oldest.value);
-			}
-			visibleLists.set(token, {
-				tools,
-				until: now + LIST_TTL_MS,
-				generation
-			});
-		}
-		return tools;
+		if (cached?.generation === generation) return cached.entries.map((entry) => entry.infoFor(target));
+		const [shown, permitted] = await Promise.all([Promise.all(all.map((entry) => isVisible(entry, ctx))), permittedTools(options.authorizer, all.map((entry) => ({
+			name: entry.info.name,
+			...entry
+		})), contextOf(ctx.db))]);
+		const entries = all.filter((_, index) => shown[index] && permitted[index]);
+		if (token !== void 0) visibleLists.set(token, {
+			entries,
+			generation
+		}, Date.now() + LIST_TTL_MS);
+		return entries.map((entry) => entry.infoFor(target));
 	};
 	const urls = discovery(options, () => server.env.url);
 	const { metadataUrl } = urls;
@@ -427,10 +494,7 @@ function createMcp(betterSupabase, options) {
 		if (origin && options.allowedOrigins && !options.allowedOrigins.includes(origin)) return rpcError(null, INVALID_REQUEST, "Origin not allowed", 403);
 		if (options.allowedHosts && !hostAllowed(urls.host(request), options.allowedHosts)) return rpcError(null, INVALID_REQUEST, "Host not allowed", 403);
 		if (request.method === "OPTIONS" && cors) return endpointPreflight(request, options.allowedOrigins);
-		if (request.method !== "POST") return new Response(null, {
-			status: 405,
-			headers: { allow: cors ? "POST, OPTIONS" : "POST" }
-		});
+		if (request.method !== "POST") return methodNotAllowed(cors ? ["POST", "OPTIONS"] : ["POST"]);
 		const header = request.headers.get("mcp-protocol-version");
 		if (header && !SUPPORTED_VERSIONS.includes(header)) return unsupportedVersion(null, header);
 		const ctx = await server.context(request, { cookies: false });
@@ -486,7 +550,7 @@ function createMcp(betterSupabase, options) {
 			}
 			case "ping": return modern ? notFound() : reply({});
 			case "tools/list": return reply({
-				tools: await visibleTools(toolContext),
+				tools: await visibleTools(toolContext, schemaTargetFor(modern ? MCP_PROTOCOL_VERSION : header ?? "2025-03-26")),
 				...modern ? {
 					ttlMs: LIST_TTL_MS,
 					cacheScope: "private"

package/dist/mcp/sdk/index.d.ts

@@ -1,8 +1,10 @@
-import { a as AnyModels, i as AnyFunctions } from "../../types-6BdhkmZe.js";
-import { r as AuthState } from "../../resolve-ChTYeTEl.js";
-import { t as BetterSupabase } from "../../define-CJJkkr1-.js";
-import { i as ServerContext$1, o as ServerOptions, t as BetterServer } from "../../server-Bh0EVSwU.js";
-import { r as GuardOptions, t as AllowedCaller } from "../../respond-DprrgyXX.js";
+import { a as AnyModels, i as AnyFunctions } from "../../types-CoE5Zwy4.js";
+import { r as AuthState } from "../../resolve-MxXVWyhd.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-ib9wzUDz.js";
+import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-C6tMoEjn.js";
+import { t as BetterSupabase } from "../../define-DmcfoNXB.js";
+import { i as ServerContext$1, s as ServerOptions, t as BetterServer } from "../../server-types-CrAmZ8jv.js";
+import { r as GuardOptions, t as AllowedCaller } from "../../respond-Cw-zanCm.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts
 interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
@@ -102,4 +104,34 @@ export declare function createMcpAuth<M extends AnyModels, D, F extends AnyFunct
  */
 export declare function withBetterSupabaseMcp<S extends ToolRegistrar, M extends AnyModels, F extends AnyFunctions, E, C, P>(server: S, auth: Pick<BetterMcpAuth<M, F, E, C, P>, "contextOf">): BetterMcpServer<S, M, F, E, C, P>;
 //#endregion
-export type { AllowedCaller, BetterMcpAuth, BetterMcpServer, BetterToolCallback, BetterToolConfig, BetterToolContext, BetterToolExtra, GuardOptions, McpAuthOptions, McpFetchHandler, ToolRegistrar };
+//#region src/mcp/sdk/supabase.d.ts
+type UserAuth<C, P> = Extract<AuthState<C, P>, {
+  kind: "user";
+}>;
+interface SupabaseMcpHandlerOptions<C = unknown, P = unknown> extends SupabaseMcpScope {
+  /** Resolves the Management API token, as the app; never the caller's JWT. */
+  readonly credentials: CredentialProvider;
+  /** The app credential that holds a Management API access token. */
+  readonly credentialRef: CredentialRef;
+  /**
+   * Who may use the server once the bearer token verified. Its tools
+   * administer the project, so allow only the people who run it.
+   */
+  readonly authorize: (auth: UserAuth<C, P>) => boolean | Promise<boolean>;
+  /** The Management API URL; Supabase's when unset. */
+  readonly apiUrl?: string;
+}
+/** Loads `@supabase/mcp-server-supabase`; tests pass their own. */
+interface SupabaseMcpLoaders {
+  readonly server?: () => Promise<SupabaseMcpModule>;
+  readonly platform?: () => Promise<SupabaseMcpPlatformModule>;
+}
+/**
+ * Serves Supabase's MCP server (`@supabase/mcp-server-supabase`) behind
+ * `createMcpAuth`: the bearer check and metadata of `auth.serve`, then
+ * `authorize`, then a server built for the request with the Management API
+ * token from `credentials`. The server closes when its response ends.
+ */
+export declare function supabaseMcpHandler<M extends AnyModels, F extends AnyFunctions, E, C, P>(auth: Pick<BetterMcpAuth<M, F, E, C, P>, "serve">, options: SupabaseMcpHandlerOptions<C, P>, loaders?: SupabaseMcpLoaders): (request: Request) => Promise<Response>;
+//#endregion
+export type { AllowedCaller, BetterMcpAuth, BetterMcpServer, BetterToolCallback, BetterToolConfig, BetterToolContext, BetterToolExtra, GuardOptions, McpAuthOptions, McpFetchHandler, SupabaseMcpFeature, SupabaseMcpHandlerOptions, SupabaseMcpLoaders, SupabaseMcpModule, SupabaseMcpPlatformModule, SupabaseMcpScope, ToolRegistrar };

package/dist/mcp/sdk/index.js

@@ -1,10 +1,15 @@
+import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { o as problemResponse } from "../../problem-CJvFeGu7.js";
 import { o as delegationOf } from "../../impersonation-DcqaTBHx.js";
-import { c as extendServer, i as resolveToken, l as withExtra, n as flushEvents, s as createServer } from "../../adapter-iKgjHVPx.js";
-import { r as guard } from "../../respond-BUgsXNgk.js";
+import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-CN45ibbV.js";
+import { r as guard } from "../../respond-volM3ByS.js";
+import { t as withExtra } from "../../extra-CGQ2_q3S.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
+import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-Cpn5A4i-.js";
 import { OAuthError, bearerAuthChallengeResponse, verifyBearerToken } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.ts
-const STATE_KEY = "betterSupabase";
+/** Where `serve` keeps the verified `AuthState` in `AuthInfo.extra`. */
+const MCP_AUTH_STATE_KEY = "betterSupabase";
 function claimString(claims, key) {
 	const value = claims[key];
 	return typeof value === "string" ? value : void 0;
@@ -47,7 +52,7 @@ function createMcpAuth(betterSupabase, options = {}) {
 			clientId: claimString(auth.claims, "client_id") ?? claimString(auth.claims, "azp") ?? "",
 			scopes: [...delegationOf(auth.claims)?.scopes ?? []],
 			...auth.expiresAt === null ? typeof exp === "number" ? { expiresAt: exp } : {} : { expiresAt: auth.expiresAt },
-			extra: { [STATE_KEY]: auth }
+			extra: { [MCP_AUTH_STATE_KEY]: auth }
 		};
 	} };
 	const anon = {
@@ -56,7 +61,7 @@ function createMcpAuth(betterSupabase, options = {}) {
 	};
 	const contextOf = async (ctx) => {
 		const info = ctx.http?.authInfo;
-		const state = info?.extra?.[STATE_KEY];
+		const state = info?.extra?.[MCP_AUTH_STATE_KEY];
 		if (isUserState(state, verified)) return server.contextFor(state);
 		if (info?.token) {
 			const auth = await resolveToken(server, info.token);
@@ -123,4 +128,81 @@ function withBetterSupabaseMcp(server, auth) {
 	return server;
 }
 //#endregion
-export { createMcpAuth, withBetterSupabaseMcp };
+//#region src/mcp/sdk/supabase.ts
+function userOf(authInfo) {
+	if (!isRecord(authInfo) || !isRecord(authInfo["extra"])) return void 0;
+	const state = authInfo["extra"][MCP_AUTH_STATE_KEY];
+	return isRecord(state) && state["kind"] === "user" ? state : void 0;
+}
+/** The response, with `done` called once its body is read, cancelled or fails. */
+function onFinish(response, done) {
+	const source = response.body;
+	if (source === null) {
+		done();
+		return response;
+	}
+	const reader = source.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			try {
+				const chunk = await reader.read();
+				if (chunk.done) {
+					controller.close();
+					done();
+				} else controller.enqueue(chunk.value);
+			} catch (error) {
+				controller.error(error);
+				done();
+			}
+		},
+		cancel(reason) {
+			done();
+			return reader.cancel(reason);
+		}
+	});
+	return new Response(body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
+/**
+* Serves Supabase's MCP server (`@supabase/mcp-server-supabase`) behind
+* `createMcpAuth`: the bearer check and metadata of `auth.serve`, then
+* `authorize`, then a server built for the request with the Management API
+* token from `credentials`. The server closes when its response ends.
+*/
+function supabaseMcpHandler(auth, options, loaders = {}) {
+	const loadServer = loaders.server ?? loadSupabaseMcp;
+	const loadPlatform = loaders.platform ?? loadSupabaseMcpPlatform;
+	return auth.serve({ async fetch(request, init) {
+		const user = userOf(init?.authInfo);
+		if (user === void 0 || !await options.authorize(user)) return problemResponse(dbError("forbidden", "Supabase's MCP server is not open to you"));
+		const token = await options.credentials.getToken(options.credentialRef, { subject: { type: "app" } });
+		if (!token.ok) return problemResponse(token.error);
+		const [server, platform] = await Promise.all([loadServer(), loadPlatform()]);
+		const handler = server.createSupabaseMcpHandler({
+			platform: platform.createSupabaseApiPlatform({
+				accessToken: token.data.token,
+				...options.apiUrl === void 0 ? {} : { apiUrl: options.apiUrl }
+			}),
+			readOnly: options.readOnly ?? true,
+			...options.projectRef === void 0 ? {} : { projectId: options.projectRef },
+			...options.features === void 0 ? {} : { features: [...options.features] }
+		});
+		let closed = false;
+		const close = () => {
+			if (closed) return;
+			closed = true;
+			handler.close().catch(() => {});
+		};
+		try {
+			return onFinish(await handler.fetch(request, init), close);
+		} catch (error) {
+			close();
+			throw error;
+		}
+	} });
+}
+//#endregion
+export { createMcpAuth, supabaseMcpHandler, withBetterSupabaseMcp };

package/dist/{message-CfDoR0Y6.d.ts → message-B0fNJgq8.d.ts}

@@ -82,7 +82,6 @@ interface AiMessage {
   readonly parts: readonly AiMessagePart[];
   readonly metadata?: Readonly<Record<string, unknown>>;
 }
-declare const AI_MESSAGE_PART_TYPES: readonly AiMessagePartType[];
 /**
  * A Standard Schema for `AiMessage`, matching `schemas/ai-message-v1.json`.
  * Pass it to `validate()` or any library that takes a Standard Schema.
@@ -91,4 +90,4 @@ declare const aiMessageSchema: StandardSchemaV1<unknown, AiMessage>;
 /** Whether `value` is a canonical message, without collecting the issues. */
 declare function isAiMessage(value: unknown): value is AiMessage;
 //#endregion
-export { isAiMessage as _, AiMessage as a, AiMessageRole as c, AiStepPart as d, AiTextPart as f, aiMessageSchema as g, AiToolResultPart as h, AiFilePart as i, AiReasoningPart as l, AiToolCallPart as m, AI_MESSAGE_SCHEMA_ID as n, AiMessagePart as o, AiToolApprovalPart as p, AiDataPart as r, AiMessagePartType as s, AI_MESSAGE_PART_TYPES as t, AiSourcePart as u };
+export { AiMessagePart as a, AiReasoningPart as c, AiTextPart as d, AiToolApprovalPart as f, isAiMessage as g, aiMessageSchema as h, AiMessage as i, AiSourcePart as l, AiToolResultPart as m, AiDataPart as n, AiMessagePartType as o, AiToolCallPart as p, AiFilePart as r, AiMessageRole as s, AI_MESSAGE_SCHEMA_ID as t, AiStepPart as u };