skybridge 0.0.0-dev.815d058 → 0.0.0-dev.8164d23

package/dist/server/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/server/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,aAAa,EAIb,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAErE,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CACJ,aAAa,EACb,kEAAkE,CACnE;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACzC,CAAC;KACD,KAAK,EAAE,CAAC;AAgBX,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE,CACzC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAEzE,MAAM,cAAc,GAAG,yDAAyD,CAAC;AAEjF,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,8BAA8B,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE,EAA0B,EAAE;IACtE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC3D,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC;QAExC,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAC7C,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAClC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,mCAAmC,KAAK,CAAC,IAAI,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACpC,IAAI,CACH,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACX,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC;YACnD,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACrB;aACA,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE;YACvC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YACvB,OAAO;SACR,CAAC,CAAC,CAAC;QAEN,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,WAAW;YACrC,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAI3C,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CACd,KAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAChC,EAAE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAkBD,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACzC,QAAQ,EAAE,CAAC;AAEd,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5D,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,CAAC;IACrC,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,QAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE;QACpE,MAAM,IAAI,GAAG,KAAK;aACf,GAAG,CAAC,QAAQ,CAAC;YACd,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,gBAAgB,CACrB,KAAK,CAAC,WAAW,CAAC,IAAI,EACtB,KAAK,CAAC,GAAG,EACT;YACE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;YAC1C,QAAQ,EAAE,eAAe;SAC1B,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,gBAAgB,CACrB,aAAa,EACb,IAAI,gBAAgB,CAAC,iCAAiC,EAAE;QACtD,IAAI,EAAE,SAAS;KAChB,CAAC,EACF,EAAE,EACF,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,SAAS,CACd,WAAW,IAAI,WAAW,EAC1B,WAAW,IAAI,IAAI,OAAO,EAAE,EAC5B,OAAO,CAAC,IAAI,CACb,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAC7B,aAAa,EACb,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAClC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAC9C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAC7B,YAAY,EACZ,EAAE,MAAM,EAAE,qBAAqB,EAAE,EACjC,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,kBAAkB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAC7B,0BAA0B,EAC1B,EAAE,MAAM,EAAE,yBAAyB,EAAE,EACrC,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,oBAAoB,MAAM,CAAC,GAAG,EAAE,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACjC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { extname, join } from \"node:path\";\nimport {\n  INVALID_PARAMS,\n  ProtocolError,\n  type ReadResourceCallback,\n  type ReadResourceTemplateCallback,\n  type ResourceMetadata,\n  ResourceTemplate,\n  type McpServer as SdkMcpServer,\n} from \"@modelcontextprotocol/server\";\nimport { parse as parseYaml } from \"yaml\";\nimport { z } from \"zod\";\n\nexport const SKILLS_EXTENSION_KEY = \"io.modelcontextprotocol/skills\";\n\nconst SKILL_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\nconst SkillFrontmatterSchema = z\n  .object({\n    name: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(\n        SKILL_NAME_RE,\n        \"must be lowercase alphanumeric words separated by single hyphens\",\n      ),\n    description: z.string().min(1).max(1024),\n  })\n  .loose();\n\nexport interface SkillResource {\n  uri: string;\n  digest: string;\n  content: string;\n}\n\nexport interface Skill {\n  uri: string;\n  frontmatter: { name: string; description: string } & Record<string, unknown>;\n  resources: SkillResource[];\n}\n\nexport type SkillsManifest = Skill[];\n\nconst sha256 = (content: string): string =>\n  `sha256:${createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\")}`;\n\nconst FRONTMATTER_RE = /^?\\s*---[ \\t]*\\r?\\n([\\s\\S]*?)\\r?\\n---[ \\t]*(?:\\r?\\n|$)/;\n\nfunction parseFrontmatter(content: string, source: string): unknown {\n  const match = FRONTMATTER_RE.exec(content);\n  if (!match) {\n    throw new Error(`Skill ${source} is missing YAML frontmatter`);\n  }\n  try {\n    return parseYaml(match[1] ?? \"\");\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new Error(`Cannot parse frontmatter of ${source}: ${detail}`);\n  }\n}\n\nconst readSkillDir = (root: string, rel = \"\"): Record<string, string> => {\n  const files: Record<string, string> = {};\n  for (const entry of readdirSync(join(root, rel), { withFileTypes: true })) {\n    const childRel = rel ? `${rel}/${entry.name}` : entry.name;\n    if (entry.isSymbolicLink()) {\n      continue;\n    }\n    if (entry.isDirectory()) {\n      Object.assign(files, readSkillDir(root, childRel));\n    } else if (entry.isFile() && extname(entry.name) === \".md\") {\n      files[childRel] = readFileSync(join(root, childRel), \"utf8\");\n    }\n  }\n  return files;\n};\n\nexport function discoverSkills(dir: string): SkillsManifest {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const skills: SkillsManifest = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) {\n      continue;\n    }\n\n    const skillRoot = join(dir, entry.name);\n    const files = readSkillDir(skillRoot);\n    const skillMd = files[\"SKILL.md\"];\n    if (skillMd === undefined) {\n      continue;\n    }\n\n    const source = `${entry.name}/SKILL.md`;\n\n    const parsed = SkillFrontmatterSchema.safeParse(\n      parseFrontmatter(skillMd, source),\n    );\n    if (!parsed.success) {\n      throw new Error(\n        `Invalid skill frontmatter in ${source}: ${z.prettifyError(parsed.error)}`,\n      );\n    }\n    if (parsed.data.name !== entry.name) {\n      throw new Error(\n        `Skill name \"${parsed.data.name}\" in ${source} must match its directory name \"${entry.name}\"`,\n      );\n    }\n\n    const resources = Object.entries(files)\n      .sort(\n        ([a], [b]) =>\n          Number(b === \"SKILL.md\") - Number(a === \"SKILL.md\") ||\n          a.localeCompare(b),\n      )\n      .map(([relPath, content]) => ({\n        uri: `skill://${entry.name}/${relPath}`,\n        digest: sha256(content),\n        content,\n      }));\n\n    skills.push({\n      uri: `skill://${entry.name}/SKILL.md`,\n      frontmatter: parsed.data,\n      resources,\n    });\n  }\n  return skills;\n}\n\nexport function skillUriToRelPath(uri: string): {\n  name: string;\n  relPath: string;\n} {\n  const match = /^skill:\\/\\/([^/]+)(?:\\/(.*))?$/.exec(uri.replace(/\\/+$/, \"\"));\n  if (!match) {\n    throw new ProtocolError(INVALID_PARAMS, `Invalid skill uri: ${uri}`);\n  }\n  const [, name = \"\", relPath = \"\"] = match;\n  const segments = relPath.split(\"/\").filter(Boolean);\n  if (name === \"\" || segments.includes(\"..\") || segments.includes(\".\")) {\n    throw new ProtocolError(INVALID_PARAMS, `Invalid skill uri: ${uri}`);\n  }\n  return { name, relPath: segments.join(\"/\") };\n}\n\nfunction listDir(\n  skill: Skill,\n  relPath: string,\n): { name: string; mimeType: string }[] | null {\n  const prefix = relPath === \"\" ? \"\" : `${relPath}/`;\n  const base = skill.uri.slice(0, -\"SKILL.md\".length);\n  const children = new Map<string, string>();\n  let matched = relPath === \"\";\n  for (const filePath of skill.resources.map((resource) =>\n    resource.uri.slice(base.length),\n  )) {\n    if (!filePath.startsWith(prefix)) {\n      continue;\n    }\n    matched = true;\n    const rest = filePath.slice(prefix.length);\n    const slash = rest.indexOf(\"/\");\n    if (slash === -1) {\n      children.set(rest, \"text/markdown\");\n    } else {\n      children.set(rest.slice(0, slash), \"inode/directory\");\n    }\n  }\n  if (!matched) {\n    return null;\n  }\n  return [...children].map(([name, mimeType]) => ({ name, mimeType }));\n}\n\nexport interface SkillRegistrar {\n  registerResource(\n    name: string,\n    uri: string,\n    config: ResourceMetadata,\n    readCallback: ReadResourceCallback,\n  ): unknown;\n  registerResource(\n    name: string,\n    template: ResourceTemplate,\n    config: ResourceMetadata,\n    readCallback: ReadResourceTemplateCallback,\n  ): unknown;\n  readonly server: Pick<SdkMcpServer[\"server\"], \"setRequestHandler\">;\n}\n\nconst DirectoryReadParamsSchema = z.object({\n  uri: z.string(),\n  cursor: z.string().optional(),\n});\n\nconst SkillsListParamsSchema = z\n  .object({ cursor: z.string().optional() })\n  .optional();\n\nconst SkillsGetParamsSchema = z.object({ uri: z.string() });\n\nconst toWireEntry = (skill: Skill) => ({\n  uri: skill.uri,\n  frontmatter: skill.frontmatter,\n  resources: skill.resources.map(({ uri, digest }) => ({ uri, digest })),\n});\n\nexport function registerSkills(\n  server: SkillRegistrar,\n  manifest: SkillsManifest,\n): void {\n  const byUri = new Map(manifest.map((skill) => [skill.uri, skill]));\n  const serveFile = (skillUri: string, fileUri: string, href: string) => {\n    const text = byUri\n      .get(skillUri)\n      ?.resources.find((resource) => resource.uri === fileUri)?.content;\n    if (text === undefined) {\n      throw new ProtocolError(INVALID_PARAMS, `Not found: ${href}`);\n    }\n    return {\n      contents: [{ uri: href, text, mimeType: \"text/markdown\" }],\n    };\n  };\n\n  for (const skill of manifest) {\n    server.registerResource(\n      skill.frontmatter.name,\n      skill.uri,\n      {\n        description: skill.frontmatter.description,\n        mimeType: \"text/markdown\",\n      },\n      (readUri) => serveFile(skill.uri, skill.uri, readUri.href),\n    );\n  }\n\n  server.registerResource(\n    \"skill-files\",\n    new ResourceTemplate(\"skill://{skillName}/{+filePath}\", {\n      list: undefined,\n    }),\n    {},\n    (readUri) => {\n      const { name, relPath } = skillUriToRelPath(readUri.href);\n      return serveFile(\n        `skill://${name}/SKILL.md`,\n        `skill://${name}/${relPath}`,\n        readUri.href,\n      );\n    },\n  );\n\n  server.server.setRequestHandler(\n    \"skills/list\",\n    { params: SkillsListParamsSchema },\n    () => ({ skills: manifest.map(toWireEntry) }),\n  );\n\n  server.server.setRequestHandler(\n    \"skills/get\",\n    { params: SkillsGetParamsSchema },\n    (params) => {\n      const skill = byUri.get(params.uri);\n      if (!skill) {\n        throw new ProtocolError(INVALID_PARAMS, `Unknown skill: ${params.uri}`);\n      }\n      return { skill: toWireEntry(skill) };\n    },\n  );\n\n  server.server.setRequestHandler(\n    \"resources/directory/read\",\n    { params: DirectoryReadParamsSchema },\n    (params) => {\n      const { name, relPath } = skillUriToRelPath(params.uri);\n      const skill = byUri.get(`skill://${name}/SKILL.md`);\n      const entries = skill ? listDir(skill, relPath) : null;\n      if (!entries) {\n        throw new ProtocolError(\n          INVALID_PARAMS,\n          `Not a directory: ${params.uri}`,\n        );\n      }\n      const base = params.uri.replace(/\\/+$/, \"\");\n      return {\n        resources: entries.map((entry) => ({\n          uri: `${base}/${entry.name}`,\n          name: entry.name,\n          mimeType: entry.mimeType,\n        })),\n      };\n    },\n  );\n}\n"]}

package/dist/server/skills.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/skills.test.js

@@ -0,0 +1,243 @@
+// @vitest-environment node
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ResourceTemplate } from "@modelcontextprotocol/server";
+import { describe, expect, it, vi } from "vitest";
+import { discoverSkills, registerSkills, skillUriToRelPath, } from "./skills.js";
+function mkSkillDir(files) {
+    const root = mkdtempSync(join(tmpdir(), "skybridge-skills-"));
+    for (const [rel, content] of Object.entries(files)) {
+        const full = join(root, rel);
+        mkdirSync(join(full, ".."), { recursive: true });
+        writeFileSync(full, content);
+    }
+    return root;
+}
+const FM = (name, description) => `---\nname: ${name}\ndescription: ${description}\n---\n`;
+const digestOf = (content) => `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
+describe("discoverSkills", () => {
+    it("discovers a skill with frontmatter and per-file resources", () => {
+        const skillMd = `${FM("git-workflow", "Team git conventions")}Body`;
+        const dir = mkSkillDir({
+            "git-workflow/SKILL.md": skillMd,
+            "git-workflow/references/GUIDE.md": "# Guide",
+        });
+        const [skill, ...rest] = discoverSkills(dir);
+        expect(rest).toHaveLength(0);
+        expect(skill?.uri).toBe("skill://git-workflow/SKILL.md");
+        expect(skill?.frontmatter).toMatchObject({
+            name: "git-workflow",
+            description: "Team git conventions",
+        });
+        expect(skill?.resources).toEqual([
+            {
+                uri: "skill://git-workflow/SKILL.md",
+                digest: digestOf(skillMd),
+                content: skillMd,
+            },
+            {
+                uri: "skill://git-workflow/references/GUIDE.md",
+                digest: digestOf("# Guide"),
+                content: "# Guide",
+            },
+        ]);
+    });
+    it("returns [] for a missing directory and skips dirs without SKILL.md", () => {
+        expect(discoverSkills(join(tmpdir(), "does-not-exist-xyz"))).toEqual([]);
+        const dir = mkSkillDir({ "not-a-skill/README.md": "hi" });
+        expect(discoverSkills(dir)).toEqual([]);
+    });
+    it("parses a nested metadata map in frontmatter", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": `---\nname: s\ndescription: d\nmetadata:\n  version: "1.2"\n  team: core\n---\n`,
+        });
+        expect(discoverSkills(dir)[0]?.frontmatter.metadata).toEqual({
+            version: "1.2",
+            team: "core",
+        });
+    });
+    it("throws on missing frontmatter", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": "no frontmatter here" });
+        expect(() => discoverSkills(dir)).toThrow(/missing YAML frontmatter/);
+    });
+    it("throws when required fields are absent", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": "---\nname: s\n---\n" });
+        expect(() => discoverSkills(dir)).toThrow(/Invalid skill frontmatter/);
+    });
+    it("throws when the frontmatter name does not match the directory", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": FM("other", "d") });
+        expect(() => discoverSkills(dir)).toThrow(/must match its directory name/);
+    });
+    it("preserves arbitrary YAML frontmatter (arrays, nesting) verbatim", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": "---\nname: s\ndescription: d\nallowed-tools:\n  - get-order\n  - refund\n---\n",
+        });
+        expect(discoverSkills(dir)[0]?.frontmatter["allowed-tools"]).toEqual([
+            "get-order",
+            "refund",
+        ]);
+    });
+    it("throws on malformed YAML frontmatter", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": "---\nname: 's\ndescription: [unclosed\n---\n",
+        });
+        expect(() => discoverSkills(dir)).toThrow(/Cannot parse frontmatter/);
+    });
+});
+describe("skillUriToRelPath", () => {
+    it("splits name and relative path", () => {
+        expect(skillUriToRelPath("skill://refunds/SKILL.md")).toEqual({
+            name: "refunds",
+            relPath: "SKILL.md",
+        });
+        expect(skillUriToRelPath("skill://refunds")).toEqual({
+            name: "refunds",
+            relPath: "",
+        });
+    });
+    it("rejects path traversal and malformed URIs", () => {
+        expect(() => skillUriToRelPath("skill://s/../../etc/passwd")).toThrow();
+        expect(() => skillUriToRelPath("skill://s/./x")).toThrow();
+        expect(() => skillUriToRelPath("https://example.com")).toThrow();
+    });
+});
+describe("registerSkills", () => {
+    const manifest = [
+        {
+            uri: "skill://refunds/SKILL.md",
+            frontmatter: { name: "refunds", description: "Process refunds" },
+            resources: [
+                {
+                    uri: "skill://refunds/SKILL.md",
+                    digest: digestOf("# Refunds"),
+                    content: "# Refunds",
+                },
+                {
+                    uri: "skill://refunds/templates/email.md",
+                    digest: digestOf("Hi"),
+                    content: "Hi",
+                },
+            ],
+        },
+    ];
+    function fakeRegistrar() {
+        const resources = new Map();
+        const handlers = new Map();
+        const server = {
+            registerResource: vi.fn((name, uri, _cfg, cb) => {
+                resources.set(name, {
+                    uri,
+                    cb: cb,
+                });
+            }),
+            server: {
+                setRequestHandler: vi.fn((method, _schemas, handler) => {
+                    handlers.set(method, handler);
+                }),
+            },
+        };
+        return { server, resources, handlers };
+    }
+    it("serves supporting files through the template resource", () => {
+        const { server, resources } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const tpl = resources.get("skill-files");
+        expect(tpl?.uri).toBeInstanceOf(ResourceTemplate);
+        const url = new URL("skill://refunds/templates/email.md");
+        const result = tpl?.cb(url, {}, {});
+        expect(result.contents[0]?.text).toBe("Hi");
+    });
+    it("lists a subdirectory through the directory-read handler", () => {
+        const on = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(on.server, manifest);
+        const result = on.handlers.get("resources/directory/read")?.({
+            uri: "skill://refunds/templates",
+        });
+        expect(result.resources).toEqual([
+            {
+                uri: "skill://refunds/templates/email.md",
+                name: "email.md",
+                mimeType: "text/markdown",
+            },
+        ]);
+    });
+    it("lists a skill root and marks subdirectories as inode/directory", () => {
+        const { server, handlers } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const result = handlers.get("resources/directory/read")?.({
+            uri: "skill://refunds",
+        });
+        expect(result.resources).toContainEqual({
+            uri: "skill://refunds/templates",
+            name: "templates",
+            mimeType: "inode/directory",
+        });
+        expect(result.resources).toContainEqual({
+            uri: "skill://refunds/SKILL.md",
+            name: "SKILL.md",
+            mimeType: "text/markdown",
+        });
+    });
+    it("lists entries with complete per-file resources via skills/list", () => {
+        const { server, handlers } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const result = handlers.get("skills/list")?.({});
+        expect(result).toEqual({
+            skills: [
+                {
+                    uri: "skill://refunds/SKILL.md",
+                    frontmatter: { name: "refunds", description: "Process refunds" },
+                    resources: [
+                        { uri: "skill://refunds/SKILL.md", digest: digestOf("# Refunds") },
+                        {
+                            uri: "skill://refunds/templates/email.md",
+                            digest: digestOf("Hi"),
+                        },
+                    ],
+                },
+            ],
+        });
+    });
+    it("returns a single entry via skills/get and rejects non-skill URIs", () => {
+        const { server, handlers } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const get = handlers.get("skills/get");
+        const result = get?.({ uri: "skill://refunds/SKILL.md" });
+        expect(result.skill.uri).toBe("skill://refunds/SKILL.md");
+        expect(result.skill.resources).toHaveLength(2);
+        expect(() => get?.({ uri: "skill://unknown/SKILL.md" })).toThrow(/Unknown skill/);
+        expect(() => get?.({ uri: "skill://refunds/templates/email.md" })).toThrow(/Unknown skill/);
+    });
+});
+describe("discoverSkills symlink safety", () => {
+    it("excludes symlinked files and directories from the manifest", () => {
+        const outside = mkdtempSync(join(tmpdir(), "skybridge-outside-"));
+        writeFileSync(join(outside, "secret.md"), "TOP SECRET");
+        const dir = mkSkillDir({
+            "demo/SKILL.md": FM("demo", "d"),
+            "demo/real.md": "ok",
+        });
+        symlinkSync(join(outside, "secret.md"), join(dir, "demo", "leak.md"));
+        symlinkSync(outside, join(dir, "demo", "escape"));
+        const uris = discoverSkills(dir)[0]?.resources.map((r) => r.uri) ?? [];
+        expect(uris).toEqual(["skill://demo/SKILL.md", "skill://demo/real.md"]);
+    });
+    it("ignores non-markdown supporting files", () => {
+        const dir = mkSkillDir({
+            "demo/SKILL.md": FM("demo", "d"),
+            "demo/notes.md": "kept",
+            "demo/data.json": "{}",
+            "demo/scripts/run.py": "print(1)",
+        });
+        const uris = discoverSkills(dir)[0]?.resources.map((r) => r.uri) ?? [];
+        expect(uris).toEqual(["skill://demo/SKILL.md", "skill://demo/notes.md"]);
+    });
+});
+//# sourceMappingURL=skills.test.js.map

package/dist/server/skills.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.test.js","sourceRoot":"","sources":["../../src/server/skills.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,cAAc,EACd,cAAc,EAEd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,SAAS,UAAU,CAAC,KAA6B;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,EAAE,CAC/C,cAAc,IAAI,kBAAkB,WAAW,SAAS,CAAC;AAE3D,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAEzE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC,MAAM,CAAC;QACpE,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,uBAAuB,EAAE,OAAO;YAChC,kCAAkC,EAAE,SAAS;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,CAAC;YACvC,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,sBAAsB;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC;YAC/B;gBACE,GAAG,EAAE,+BAA+B;gBACpC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;gBACzB,OAAO,EAAE,OAAO;aACjB;YACD;gBACE,GAAG,EAAE,0CAA0C;gBAC/C,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAC3B,OAAO,EAAE,SAAS;aACnB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EAAE,gFAAgF;SAC/F,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC3D,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EACV,gFAAgF;SACnF,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EAAE,8CAA8C;SAC7D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5D,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,QAAQ,GAAY;QACxB;YACE,GAAG,EAAE,0BAA0B;YAC/B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE;YAChE,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,EAAE,WAAW;iBACrB;gBACD;oBACE,GAAG,EAAE,oCAAoC;oBACzC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACtB,OAAO,EAAE,IAAI;iBACd;aACF;SACF;KACF,CAAC;IAEF,SAAS,aAAa;QACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC9D,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,EAAE,CAAC,EAAE,CACrB,CAAC,IAAY,EAAE,GAAY,EAAE,IAAa,EAAE,EAAW,EAAE,EAAE;gBACzD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;oBAClB,GAAG;oBACH,EAAE,EAAE,EAAqC;iBAC1C,CAAC,CAAC;YACL,CAAC,CACF;YACD,MAAM,EAAE;gBACN,iBAAiB,EAAE,EAAE,CAAC,EAAE,CACtB,CAAC,MAAe,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;oBACvD,QAAQ,CAAC,GAAG,CACV,MAAgB,EAChB,OAAoC,CACrC,CAAC;gBACJ,CAAC,CACF;aACF;SACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAC9C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAqC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3B,qEAAqE;QACrE,cAAc,CAAC,EAAE,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC3D,GAAG,EAAE,2BAA2B;SACjC,CAAqE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;YAC/B;gBACE,GAAG,EAAE,oCAAoC;gBACzC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,eAAe;aAC1B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC7C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACxD,GAAG,EAAE,iBAAiB;SACvB,CAAwD,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;YACtC,GAAG,EAAE,2BAA2B;YAChC,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;YACtC,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC7C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE;gBACN;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE;oBAChE,SAAS,EAAE;wBACT,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;wBAClE;4BACE,GAAG,EAAE,oCAAoC;4BACzC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;yBACvB;qBACF;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAAC;QAC7C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAEvD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,OAAO,CAC9D,eAAe,CAChB,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,OAAO,CACxE,eAAe,CAChB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,eAAe,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACtE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAElD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,eAAe,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,eAAe,EAAE,MAAM;YACvB,gBAAgB,EAAE,IAAI;YACtB,qBAAqB,EAAE,UAAU;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { createHash } from \"node:crypto\";\nimport { mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { ResourceTemplate } from \"@modelcontextprotocol/server\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport {\n  discoverSkills,\n  registerSkills,\n  type Skill,\n  skillUriToRelPath,\n} from \"./skills.js\";\n\nfunction mkSkillDir(files: Record<string, string>): string {\n  const root = mkdtempSync(join(tmpdir(), \"skybridge-skills-\"));\n  for (const [rel, content] of Object.entries(files)) {\n    const full = join(root, rel);\n    mkdirSync(join(full, \"..\"), { recursive: true });\n    writeFileSync(full, content);\n  }\n  return root;\n}\n\nconst FM = (name: string, description: string) =>\n  `---\\nname: ${name}\\ndescription: ${description}\\n---\\n`;\n\nconst digestOf = (content: string) =>\n  `sha256:${createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\")}`;\n\ndescribe(\"discoverSkills\", () => {\n  it(\"discovers a skill with frontmatter and per-file resources\", () => {\n    const skillMd = `${FM(\"git-workflow\", \"Team git conventions\")}Body`;\n    const dir = mkSkillDir({\n      \"git-workflow/SKILL.md\": skillMd,\n      \"git-workflow/references/GUIDE.md\": \"# Guide\",\n    });\n    const [skill, ...rest] = discoverSkills(dir);\n    expect(rest).toHaveLength(0);\n    expect(skill?.uri).toBe(\"skill://git-workflow/SKILL.md\");\n    expect(skill?.frontmatter).toMatchObject({\n      name: \"git-workflow\",\n      description: \"Team git conventions\",\n    });\n    expect(skill?.resources).toEqual([\n      {\n        uri: \"skill://git-workflow/SKILL.md\",\n        digest: digestOf(skillMd),\n        content: skillMd,\n      },\n      {\n        uri: \"skill://git-workflow/references/GUIDE.md\",\n        digest: digestOf(\"# Guide\"),\n        content: \"# Guide\",\n      },\n    ]);\n  });\n\n  it(\"returns [] for a missing directory and skips dirs without SKILL.md\", () => {\n    expect(discoverSkills(join(tmpdir(), \"does-not-exist-xyz\"))).toEqual([]);\n    const dir = mkSkillDir({ \"not-a-skill/README.md\": \"hi\" });\n    expect(discoverSkills(dir)).toEqual([]);\n  });\n\n  it(\"parses a nested metadata map in frontmatter\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\": `---\\nname: s\\ndescription: d\\nmetadata:\\n  version: \"1.2\"\\n  team: core\\n---\\n`,\n    });\n    expect(discoverSkills(dir)[0]?.frontmatter.metadata).toEqual({\n      version: \"1.2\",\n      team: \"core\",\n    });\n  });\n\n  it(\"throws on missing frontmatter\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": \"no frontmatter here\" });\n    expect(() => discoverSkills(dir)).toThrow(/missing YAML frontmatter/);\n  });\n\n  it(\"throws when required fields are absent\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": \"---\\nname: s\\n---\\n\" });\n    expect(() => discoverSkills(dir)).toThrow(/Invalid skill frontmatter/);\n  });\n\n  it(\"throws when the frontmatter name does not match the directory\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": FM(\"other\", \"d\") });\n    expect(() => discoverSkills(dir)).toThrow(/must match its directory name/);\n  });\n\n  it(\"preserves arbitrary YAML frontmatter (arrays, nesting) verbatim\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\":\n        \"---\\nname: s\\ndescription: d\\nallowed-tools:\\n  - get-order\\n  - refund\\n---\\n\",\n    });\n    expect(discoverSkills(dir)[0]?.frontmatter[\"allowed-tools\"]).toEqual([\n      \"get-order\",\n      \"refund\",\n    ]);\n  });\n\n  it(\"throws on malformed YAML frontmatter\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\": \"---\\nname: 's\\ndescription: [unclosed\\n---\\n\",\n    });\n    expect(() => discoverSkills(dir)).toThrow(/Cannot parse frontmatter/);\n  });\n});\n\ndescribe(\"skillUriToRelPath\", () => {\n  it(\"splits name and relative path\", () => {\n    expect(skillUriToRelPath(\"skill://refunds/SKILL.md\")).toEqual({\n      name: \"refunds\",\n      relPath: \"SKILL.md\",\n    });\n    expect(skillUriToRelPath(\"skill://refunds\")).toEqual({\n      name: \"refunds\",\n      relPath: \"\",\n    });\n  });\n\n  it(\"rejects path traversal and malformed URIs\", () => {\n    expect(() => skillUriToRelPath(\"skill://s/../../etc/passwd\")).toThrow();\n    expect(() => skillUriToRelPath(\"skill://s/./x\")).toThrow();\n    expect(() => skillUriToRelPath(\"https://example.com\")).toThrow();\n  });\n});\n\ndescribe(\"registerSkills\", () => {\n  const manifest: Skill[] = [\n    {\n      uri: \"skill://refunds/SKILL.md\",\n      frontmatter: { name: \"refunds\", description: \"Process refunds\" },\n      resources: [\n        {\n          uri: \"skill://refunds/SKILL.md\",\n          digest: digestOf(\"# Refunds\"),\n          content: \"# Refunds\",\n        },\n        {\n          uri: \"skill://refunds/templates/email.md\",\n          digest: digestOf(\"Hi\"),\n          content: \"Hi\",\n        },\n      ],\n    },\n  ];\n\n  function fakeRegistrar() {\n    const resources = new Map<\n      string,\n      { uri: unknown; cb: (...args: unknown[]) => unknown }\n    >();\n    const handlers = new Map<string, (req: unknown) => unknown>();\n    const server = {\n      registerResource: vi.fn(\n        (name: string, uri: unknown, _cfg: unknown, cb: unknown) => {\n          resources.set(name, {\n            uri,\n            cb: cb as (...args: unknown[]) => unknown,\n          });\n        },\n      ),\n      server: {\n        setRequestHandler: vi.fn(\n          (method: unknown, _schemas: unknown, handler: unknown) => {\n            handlers.set(\n              method as string,\n              handler as (req: unknown) => unknown,\n            );\n          },\n        ),\n      },\n    };\n    return { server, resources, handlers };\n  }\n\n  it(\"serves supporting files through the template resource\", () => {\n    const { server, resources } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const tpl = resources.get(\"skill-files\");\n    expect(tpl?.uri).toBeInstanceOf(ResourceTemplate);\n    const url = new URL(\"skill://refunds/templates/email.md\");\n    const result = tpl?.cb(url, {}, {}) as { contents: { text: string }[] };\n    expect(result.contents[0]?.text).toBe(\"Hi\");\n  });\n\n  it(\"lists a subdirectory through the directory-read handler\", () => {\n    const on = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(on.server as any, manifest);\n    const result = on.handlers.get(\"resources/directory/read\")?.({\n      uri: \"skill://refunds/templates\",\n    }) as { resources: { uri: string; name: string; mimeType: string }[] };\n    expect(result.resources).toEqual([\n      {\n        uri: \"skill://refunds/templates/email.md\",\n        name: \"email.md\",\n        mimeType: \"text/markdown\",\n      },\n    ]);\n  });\n\n  it(\"lists a skill root and marks subdirectories as inode/directory\", () => {\n    const { server, handlers } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const result = handlers.get(\"resources/directory/read\")?.({\n      uri: \"skill://refunds\",\n    }) as { resources: { name: string; mimeType: string }[] };\n    expect(result.resources).toContainEqual({\n      uri: \"skill://refunds/templates\",\n      name: \"templates\",\n      mimeType: \"inode/directory\",\n    });\n    expect(result.resources).toContainEqual({\n      uri: \"skill://refunds/SKILL.md\",\n      name: \"SKILL.md\",\n      mimeType: \"text/markdown\",\n    });\n  });\n\n  it(\"lists entries with complete per-file resources via skills/list\", () => {\n    const { server, handlers } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const result = handlers.get(\"skills/list\")?.({});\n    expect(result).toEqual({\n      skills: [\n        {\n          uri: \"skill://refunds/SKILL.md\",\n          frontmatter: { name: \"refunds\", description: \"Process refunds\" },\n          resources: [\n            { uri: \"skill://refunds/SKILL.md\", digest: digestOf(\"# Refunds\") },\n            {\n              uri: \"skill://refunds/templates/email.md\",\n              digest: digestOf(\"Hi\"),\n            },\n          ],\n        },\n      ],\n    });\n  });\n\n  it(\"returns a single entry via skills/get and rejects non-skill URIs\", () => {\n    const { server, handlers } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const get = handlers.get(\"skills/get\");\n    const result = get?.({ uri: \"skill://refunds/SKILL.md\" }) as {\n      skill: { uri: string; resources: unknown[] };\n    };\n    expect(result.skill.uri).toBe(\"skill://refunds/SKILL.md\");\n    expect(result.skill.resources).toHaveLength(2);\n    expect(() => get?.({ uri: \"skill://unknown/SKILL.md\" })).toThrow(\n      /Unknown skill/,\n    );\n    expect(() => get?.({ uri: \"skill://refunds/templates/email.md\" })).toThrow(\n      /Unknown skill/,\n    );\n  });\n});\n\ndescribe(\"discoverSkills symlink safety\", () => {\n  it(\"excludes symlinked files and directories from the manifest\", () => {\n    const outside = mkdtempSync(join(tmpdir(), \"skybridge-outside-\"));\n    writeFileSync(join(outside, \"secret.md\"), \"TOP SECRET\");\n    const dir = mkSkillDir({\n      \"demo/SKILL.md\": FM(\"demo\", \"d\"),\n      \"demo/real.md\": \"ok\",\n    });\n    symlinkSync(join(outside, \"secret.md\"), join(dir, \"demo\", \"leak.md\"));\n    symlinkSync(outside, join(dir, \"demo\", \"escape\"));\n\n    const uris = discoverSkills(dir)[0]?.resources.map((r) => r.uri) ?? [];\n    expect(uris).toEqual([\"skill://demo/SKILL.md\", \"skill://demo/real.md\"]);\n  });\n\n  it(\"ignores non-markdown supporting files\", () => {\n    const dir = mkSkillDir({\n      \"demo/SKILL.md\": FM(\"demo\", \"d\"),\n      \"demo/notes.md\": \"kept\",\n      \"demo/data.json\": \"{}\",\n      \"demo/scripts/run.py\": \"print(1)\",\n    });\n    const uris = discoverSkills(dir)[0]?.resources.map((r) => r.uri) ?? [];\n    expect(uris).toEqual([\"skill://demo/SKILL.md\", \"skill://demo/notes.md\"]);\n  });\n});\n"]}

package/dist/server/tool-extra.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/tool-extra.test.js

@@ -0,0 +1,72 @@
+// @vitest-environment node
+import http from "node:http";
+import { Client, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { z } from "zod";
+import { Skybridge } from "./app.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_r, _s, n) => n()),
+}));
+vi.mock("./viewsDevServer.js", () => ({
+    viewsDevServer: () => ((_r, _s, n) => n()),
+}));
+let openServer;
+afterEach(() => openServer?.close());
+describe("tool handler extra", () => {
+    it("exposes the client hints the host sent on the request", async () => {
+        const { createApp } = await import("./express.js");
+        let seenLocale;
+        const app = new Skybridge({ name: "t", version: "0.0.0" }, (server) => server.registerTool({ name: "hints", description: "Reads client hints.", inputSchema: {} }, (_args, extra) => {
+            seenLocale = extra.mcpReq._meta?.["openai/locale"];
+            return { content: [{ type: "text", text: "ok" }] };
+        }));
+        const httpServer = http.createServer();
+        const expressApp = await createApp({ app, httpServer });
+        const listening = http.createServer(expressApp);
+        await new Promise((r) => listening.listen(0, r));
+        openServer = listening;
+        const port = listening.address().port;
+        const client = new Client({ name: "c", version: "0.0.0" });
+        await client.connect(new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`)));
+        await client.callTool({
+            name: "hints",
+            arguments: {},
+            _meta: { "openai/locale": "fr-FR" },
+        });
+        await client.close();
+        expect(seenLocale).toBe("fr-FR");
+    });
+});
+describe("stateless server instances", () => {
+    it("carries the registered capabilities onto each per-request instance", () => {
+        const app = new Skybridge({ name: "t", version: "0.0.0" }, (server) => server.registerTool({ name: "a-tool", description: "d", inputSchema: {} }, () => ({ content: [{ type: "text", text: "ok" }] })));
+        const fresh = app.createServerInstance();
+        expect(fresh.getCapabilities().tools).toBeDefined();
+    });
+    it("serves a 2026-era caller with that era's result shape", async () => {
+        const { createApp } = await import("./express.js");
+        const app = new Skybridge({ name: "t", version: "0.0.0" }, (server) => server.registerTool({
+            name: "scalar",
+            description: "Returns a scalar structuredContent.",
+            inputSchema: {},
+            outputSchema: z.number(),
+        }, () => ({
+            structuredContent: 42,
+            content: [{ type: "text", text: "42" }],
+        })));
+        const httpServer = http.createServer();
+        const expressApp = await createApp({ app, httpServer });
+        const listening = http.createServer(expressApp);
+        await new Promise((r) => listening.listen(0, r));
+        openServer = listening;
+        const port = listening.address().port;
+        const client = new Client({ name: "c", version: "0.0.0" }, { versionNegotiation: { mode: "auto" } });
+        await client.connect(new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`)));
+        const result = await client.callTool({ name: "scalar", arguments: {} });
+        const negotiated = client.getNegotiatedProtocolVersion();
+        await client.close();
+        expect(negotiated).toBe("2026-07-28");
+        expect(result.structuredContent).toBe(42);
+    });
+});
+//# sourceMappingURL=tool-extra.test.js.map

package/dist/server/tool-extra.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-extra.test.js","sourceRoot":"","sources":["../../src/server/tool-extra.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,MAAM,EACN,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,EAAW,EAAE,EAAW,EAAE,CAAa,EAAE,EAAE,CAAC,CAAC,EAAE,CAAmB;CACvE,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,GAAG,EAAE,CACnB,CAAC,CAAC,EAAW,EAAE,EAAW,EAAE,CAAa,EAAE,EAAE,CAAC,CAAC,EAAE,CAAmB;CACvE,CAAC,CAAC,CAAC;AAEJ,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,UAAmB,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,EAAE,EAAE,EACtE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,CAAC,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC,CACF,CACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,UAAU,GAAG,SAAS,CAAC;QACvB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAC/B,IAAI,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,CACxC,CACF,CAAC;QACF,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EACrD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CACpD,CACF,CAAC;QAEF,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAEzC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,YAAY,CACjB;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qCAAqC;YAClD,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;SACzB,EACD,GAAG,EAAE,CAAC,CAAC;YACL,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CACH,CACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,UAAU,GAAG,SAAS,CAAC;QACvB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAC/B,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CACzC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAC/B,IAAI,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,CACxC,CACF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,MAAM,CAAC,4BAA4B,EAAE,CAAC;QACzD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport {\n  Client,\n  StreamableHTTPClientTransport,\n} from \"@modelcontextprotocol/client\";\nimport type { RequestHandler } from \"express\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { z } from \"zod\";\nimport { Skybridge } from \"./app.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_r: unknown, _s: unknown, n: () => void) => n()) as RequestHandler,\n}));\nvi.mock(\"./viewsDevServer.js\", () => ({\n  viewsDevServer: () =>\n    ((_r: unknown, _s: unknown, n: () => void) => n()) as RequestHandler,\n}));\n\nlet openServer: http.Server | undefined;\nafterEach(() => openServer?.close());\n\ndescribe(\"tool handler extra\", () => {\n  it(\"exposes the client hints the host sent on the request\", async () => {\n    const { createApp } = await import(\"./express.js\");\n    let seenLocale: unknown;\n    const app = new Skybridge({ name: \"t\", version: \"0.0.0\" }, (server) =>\n      server.registerTool(\n        { name: \"hints\", description: \"Reads client hints.\", inputSchema: {} },\n        (_args, extra) => {\n          seenLocale = extra.mcpReq._meta?.[\"openai/locale\"];\n          return { content: [{ type: \"text\", text: \"ok\" }] };\n        },\n      ),\n    );\n\n    const httpServer = http.createServer();\n    const expressApp = await createApp({ app, httpServer });\n    const listening = http.createServer(expressApp);\n    await new Promise<void>((r) => listening.listen(0, r));\n    openServer = listening;\n    const port = (listening.address() as { port: number }).port;\n\n    const client = new Client({ name: \"c\", version: \"0.0.0\" });\n    await client.connect(\n      new StreamableHTTPClientTransport(\n        new URL(`http://localhost:${port}/mcp`),\n      ),\n    );\n    await client.callTool({\n      name: \"hints\",\n      arguments: {},\n      _meta: { \"openai/locale\": \"fr-FR\" },\n    });\n    await client.close();\n\n    expect(seenLocale).toBe(\"fr-FR\");\n  });\n});\n\ndescribe(\"stateless server instances\", () => {\n  it(\"carries the registered capabilities onto each per-request instance\", () => {\n    const app = new Skybridge({ name: \"t\", version: \"0.0.0\" }, (server) =>\n      server.registerTool(\n        { name: \"a-tool\", description: \"d\", inputSchema: {} },\n        () => ({ content: [{ type: \"text\", text: \"ok\" }] }),\n      ),\n    );\n\n    const fresh = app.createServerInstance();\n\n    expect(fresh.getCapabilities().tools).toBeDefined();\n  });\n\n  it(\"serves a 2026-era caller with that era's result shape\", async () => {\n    const { createApp } = await import(\"./express.js\");\n    const app = new Skybridge({ name: \"t\", version: \"0.0.0\" }, (server) =>\n      server.registerTool(\n        {\n          name: \"scalar\",\n          description: \"Returns a scalar structuredContent.\",\n          inputSchema: {},\n          outputSchema: z.number(),\n        },\n        () => ({\n          structuredContent: 42,\n          content: [{ type: \"text\", text: \"42\" }],\n        }),\n      ),\n    );\n\n    const httpServer = http.createServer();\n    const expressApp = await createApp({ app, httpServer });\n    const listening = http.createServer(expressApp);\n    await new Promise<void>((r) => listening.listen(0, r));\n    openServer = listening;\n    const port = (listening.address() as { port: number }).port;\n\n    const client = new Client(\n      { name: \"c\", version: \"0.0.0\" },\n      { versionNegotiation: { mode: \"auto\" } },\n    );\n    await client.connect(\n      new StreamableHTTPClientTransport(\n        new URL(`http://localhost:${port}/mcp`),\n      ),\n    );\n    const result = await client.callTool({ name: \"scalar\", arguments: {} });\n    const negotiated = client.getNegotiatedProtocolVersion();\n    await client.close();\n\n    expect(negotiated).toBe(\"2026-07-28\");\n    expect(result.structuredContent).toBe(42);\n  });\n});\n"]}

package/dist/server/view-name.test-d.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/view-name.test-d.js

@@ -0,0 +1,8 @@
+import { expectTypeOf, test } from "vitest";
+test("ViewNameFor falls back to string when the registry is empty", () => {
+    expectTypeOf().toEqualTypeOf();
+});
+test("ViewNameFor narrows to the registered view names when populated", () => {
+    expectTypeOf().toEqualTypeOf();
+});
+//# sourceMappingURL=view-name.test-d.js.map

package/dist/server/view-name.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-name.test-d.js","sourceRoot":"","sources":["../../src/server/view-name.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG5C,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,YAAY,EAAqC,CAAC,aAAa,EAAU,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,YAAY,EAA4C,CAAC,aAAa,EAEnE,CAAC;AACN,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport type { ViewNameFor } from \"./server.js\";\n\ntest(\"ViewNameFor falls back to string when the registry is empty\", () => {\n  expectTypeOf<ViewNameFor<Record<never, never>>>().toEqualTypeOf<string>();\n});\n\ntest(\"ViewNameFor narrows to the registered view names when populated\", () => {\n  expectTypeOf<ViewNameFor<{ home: true; about: true }>>().toEqualTypeOf<\n    \"home\" | \"about\"\n  >();\n});\n"]}

package/dist/server/view-resource-resolution.test.js

@@ -1,24 +1,57 @@
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { afterEach, describe, expect, it } from "vitest";
-import { __setBuildManifest, McpServer } from "./index.js";
+import http from "node:http";
+import { Client, InMemoryTransport, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { __setBuildManifest, Skybridge } from "./index.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("./viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
 // SKY-435: a view resource must resolve no matter the `?v=` query param value.
 // The version param is a content-derived cache key for external consumers
 // (it busts host/CDN caches when the bundle changes); it is not part of the
 // resource's identity, so a stale, absent, or arbitrary param must still serve
 // the underlying asset.
+function buildApp(register) {
+    return new Skybridge({ name: "test", version: "1.0.0" }, (server) => {
+        register(server);
+        return server;
+    });
+}
 async function connect(register) {
-    const server = new McpServer({ name: "test", version: "1.0.0" });
-    register(server);
+    const instance = buildApp(register).createServerInstance();
     const client = new Client({ name: "test-client", version: "1.0.0" });
     const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
-    await server.connect(serverTransport);
+    await instance.connect(serverTransport);
     await client.connect(clientTransport);
     return {
         client,
         teardown: async () => {
             await client.close();
-            await server.close();
+            await instance.close();
+        },
+    };
+}
+let openHttpServer;
+afterEach(() => openHttpServer?.close());
+// Connect over real HTTP so forwarded proxy headers reach the resource handler.
+async function connectHttp(register, headers) {
+    const { createApp } = await import("./express.js");
+    const app = buildApp(register);
+    const httpServer = http.createServer();
+    await createApp({ app, httpServer });
+    const listening = http.createServer(app.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    openHttpServer = listening;
+    const port = listening.address().port;
+    const client = new Client({ name: "test-client", version: "1.0.0" });
+    const transport = new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`), { requestInit: { headers } });
+    await client.connect(transport);
+    return {
+        client,
+        teardown: async () => {
+            await client.close();
         },
     };
 }
@@ -36,15 +69,15 @@ describe("view resource resolution (cache key)", () => {
     it("resolves regardless of the ?v= param and echoes the requested URI", async () => {
         const { client, teardown } = await connect(registerWidget);
         const { resources } = await client.listResources();
-        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
         // Dev build advertises no cache key.
-        expect(listed?.uri).toBe("ui://views/apps-sdk/widget.html");
+        expect(listed?.uri).toBe("ui://views/ext-apps/widget.html");
         // A stale/arbitrary/absent param all resolve the same underlying asset,
         // and the response echoes the URI the consumer asked for (never rewritten).
         for (const uri of [
-            "ui://views/apps-sdk/widget.html?v=stale123",
-            "ui://views/apps-sdk/widget.html?v=whatever-else",
-            "ui://views/apps-sdk/widget.html",
+            "ui://views/ext-apps/widget.html?v=stale123",
+            "ui://views/ext-apps/widget.html?v=whatever-else",
+            "ui://views/ext-apps/widget.html",
         ]) {
             const { contents } = await client.readResource({ uri });
             expect(contents).toHaveLength(1);
@@ -67,11 +100,11 @@ describe("view resource resolution (cache key)", () => {
         });
         const { client, teardown } = await connect(registerWidget);
         const { resources } = await client.listResources();
-        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
         // Production advertises a content-derived cache key.
-        expect(listed?.uri).toMatch(/^ui:\/\/views\/apps-sdk\/widget\.html\?v=[0-9a-f]{8}$/);
+        expect(listed?.uri).toMatch(/^ui:\/\/views\/ext-apps\/widget\.html\?v=[0-9a-f]{8}$/);
         // A consumer holding a stale key still resolves the current asset.
-        const staleUri = "ui://views/apps-sdk/widget.html?v=00000000";
+        const staleUri = "ui://views/ext-apps/widget.html?v=00000000";
         const { contents } = await client.readResource({ uri: staleUri });
         expect(contents).toHaveLength(1);
         const content = textContent(contents);
@@ -81,7 +114,58 @@ describe("view resource resolution (cache key)", () => {
     });
     it("still throws for an unknown view path", async () => {
         const { client, teardown } = await connect(registerWidget);
-        await expect(client.readResource({ uri: "ui://views/apps-sdk/nope.html?v=1" })).rejects.toThrow();
+        await expect(client.readResource({ uri: "ui://views/ext-apps/nope.html?v=1" })).rejects.toThrow();
+        await teardown();
+    });
+    // A proxy routing the request under a path prefix sends x-forwarded-prefix;
+    // the view's asset URLs must carry that prefix (and the forwarded origin) so
+    // they resolve back through the same routing. Per-request, so one process can
+    // serve many hosts/prefixes at once.
+    it("prefixes emitted asset URLs with x-forwarded-prefix (prod)", async () => {
+        process.env.NODE_ENV = "production";
+        __setBuildManifest({
+            "src/views/widget.tsx": {
+                isEntry: true,
+                name: "widget",
+                file: "assets/widget-ABC123.js",
+            },
+            "style.css": { file: "assets/style-XYZ.css" },
+        });
+        const { client, teardown } = await connectHttp(registerWidget, {
+            "x-forwarded-host": "foo.com",
+            "x-forwarded-proto": "https",
+            "x-forwarded-prefix": "/v1/canary",
+        });
+        try {
+            const { contents } = await client.readResource({
+                uri: "ui://views/ext-apps/widget.html",
+            });
+            const { text } = textContent(contents);
+            // Forwarded origin + prefix. (`assets/assets` is the existing layout: the
+            // manifest `file` already carries `assets/` and the template prepends
+            // `/assets/`; build.tsx's `_redirects` collapses it on the asset host.)
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/widget-ABC123.js");
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/style-XYZ.css");
+            // No unprefixed asset URL leaks through.
+            expect(text).not.toContain("foo.com/assets/");
+        }
+        finally {
+            await teardown();
+        }
+    });
+    // Back-compat: older Skybridge advertised the view at `ui://views/apps-sdk/...`
+    // via openai/outputTemplate. We no longer advertise it, but apps published then
+    // have it cached, so the read must still resolve to the ext-apps content.
+    it("resolves the legacy apps-sdk URL to the ext-apps content", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        const legacyUri = "ui://views/apps-sdk/widget.html";
+        const { contents } = await client.readResource({ uri: legacyUri });
+        expect(contents).toHaveLength(1);
+        const content = contents[0];
+        expect(content.mimeType).toBe("text/html;profile=mcp-app");
+        expect(content.text.length).toBeGreaterThan(0);
+        // The response echoes the requested (legacy) URI, never the canonical one.
+        expect(content.uri).toBe(legacyUri);
         await teardown();
     });
 });