skybridge 0.0.0-dev.81fd90a → 0.0.0-dev.8226541

package/dist/server/auth/verify.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../../src/server/auth/verify.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,GAAc,EACd,MAA+B,EAC/B,OAAmE,EAAE;IAErE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;SAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;SACtC,iBAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACtD,sBAAsB,CACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,SAAS,EAAE,UAAU;YACrB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN;YACE,kBAAkB;YAClB,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACvD,6CAA6C;YAC7C,8DAA8D;SAC/D;QACD;YACE,qCAAqC;YACrC,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9D,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,6BAA6B;YAC7B,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACnE,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,+BAA+B;YAC/B,CAAC,GAAc,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;iBACjB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;iBACrD,SAAS,CAAC,MAAM,CAAC;iBACjB,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC;YACd,uCAAuC;YACvC,yDAAyD;SAC1D;KACF,CAAC,CACA,oDAAoD,EACpD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,QAAQ;aACzB,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;aACzC,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAChB,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,kEAAkE;QAClE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aAC/D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;aACrD,SAAS,CAAC,MAAM,CAAC;aACjB,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nafterEach(() => jwksServer?.close());\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction sign(\n  key: CryptoKey,\n  claims: Record<string, unknown>,\n  opts: { issuer?: string; audience?: string; expiresAt?: string } = {},\n) {\n  return new jose.SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(opts.issuer ?? ISSUER)\n    .setAudience(opts.audience ?? AUDIENCE)\n    .setExpirationTime(opts.expiresAt ?? \"1h\")\n    .sign(key);\n}\n\nit(\"rejects a config with no issuer\", () => {\n  expect(() => createJwksVerifier({ issuer: \"\" })).toThrow(\n    /requires an `issuer`/,\n  );\n});\n\ndescribe(\"createJwksVerifier\", () => {\n  it(\"verifies a valid token and maps claims to AuthInfo\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(privateKey, {\n      client_id: \"client-1\",\n      scope: \"openid email\",\n      sub: \"user-1\",\n      email: \"a@b.test\",\n    });\n\n    const auth = await verifier.verifyAccessToken(token);\n\n    expect(auth.token).toBe(token);\n    expect(auth.clientId).toBe(\"client-1\");\n    expect(auth.scopes).toEqual([\"openid\", \"email\"]);\n    expect(auth.extra?.subject).toBe(\"user-1\");\n    expect(auth.extra?.email).toBe(\"a@b.test\");\n  });\n\n  it(\"rejects a token with the wrong audience\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"api://other\" },\n    );\n\n    await expect(verifier.verifyAccessToken(token)).rejects.toThrow(\n      /Token verification failed/,\n    );\n  });\n\n  // jose quotes claim names — `\"exp\" claim timestamp check failed`, `unexpected\n  // \"aud\" claim value`. Those quotes would close `error_description=\"…\"` early,\n  // dropping the `resource_metadata` that MCP clients start discovery from.\n  it.each([\n    [\n      \"an expired token\",\n      (key: CryptoKey) => sign(key, {}, { expiresAt: \"-1h\" }),\n      // jose: `\"exp\" claim timestamp check failed`\n      \"Token verification failed: exp  claim timestamp check failed\",\n    ],\n    [\n      \"a token issued for another resource\",\n      (key: CryptoKey) => sign(key, {}, { audience: \"api://other\" }),\n      // jose: `unexpected \"aud\" claim value`\n      \"Token verification failed: unexpected  aud  claim value\",\n    ],\n    [\n      \"a token from another issuer\",\n      (key: CryptoKey) => sign(key, {}, { issuer: \"https://other.test\" }),\n      // jose: `unexpected \"iss\" claim value`\n      \"Token verification failed: unexpected  iss  claim value\",\n    ],\n    [\n      \"a token carrying no aud claim\",\n      (key: CryptoKey) =>\n        new jose.SignJWT({})\n          .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n          .setIssuer(ISSUER)\n          .setExpirationTime(\"1h\")\n          .sign(key),\n      // jose: `missing required \"aud\" claim`\n      \"Token verification failed: missing required  aud  claim\",\n    ],\n  ])(\n    \"keeps the message safe inside the challenge for %s\",\n    async (_, mint, expected) => {\n      const { privateKey, jwksUri } = await startJwks();\n      const verifier = createJwksVerifier({\n        issuer: ISSUER,\n        audience: AUDIENCE,\n        jwksUri,\n      });\n\n      const error = await verifier\n        .verifyAccessToken(await mint(privateKey))\n        .then(\n          () => undefined,\n          (e: Error) => e,\n        );\n\n      expect(error?.message).toBe(expected);\n      // OAuth 2.1 §5.3.1: %x20-21 / %x23-5B / %x5D-7E and nothing else.\n      expect(error?.message).not.toMatch(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/);\n    },\n  );\n\n  it(\"skips the aud check when no audience is configured (e.g. Clerk)\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({ issuer: ISSUER, jwksUri });\n    // Clerk-shaped access token: no `aud` claim at all.\n    const token = await new jose.SignJWT({ client_id: \"c\", sub: \"u\" })\n      .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n      .setIssuer(ISSUER)\n      .setExpirationTime(\"1h\")\n      .sign(privateKey);\n\n    const auth = await verifier.verifyAccessToken(token);\n    expect(auth.clientId).toBe(\"c\");\n    expect(auth.extra?.subject).toBe(\"u\");\n  });\n\n  it(\"parses array scope claims and trims extra whitespace\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n\n    const arrayToken = await sign(privateKey, {\n      scope: [\"openid\", \"email\"],\n    });\n    expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n\n    const messyToken = await sign(privateKey, { scope: \" openid  email \" });\n    expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n  });\n});\n"]}
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../../src/server/auth/verify.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,GAAc,EACd,MAA+B,EAC/B,OAAmE,EAAE;IAErE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;SAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;SACtC,iBAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACtD,sBAAsB,CACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,SAAS,EAAE,UAAU;YACrB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN;YACE,kBAAkB;YAClB,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACvD,6CAA6C;YAC7C,8DAA8D;SAC/D;QACD;YACE,qCAAqC;YACrC,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9D,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,6BAA6B;YAC7B,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACnE,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,+BAA+B;YAC/B,CAAC,GAAc,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;iBACjB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;iBACrD,SAAS,CAAC,MAAM,CAAC;iBACjB,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC;YACd,uCAAuC;YACvC,yDAAyD;SAC1D;KACF,CAAC,CACA,oDAAoD,EACpD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,QAAQ;aACzB,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;aACzC,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAChB,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,kEAAkE;QAClE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC;YAC3C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CACpC,CAAC;QACF,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,kCAAkC,CACnC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aAC/D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;aACrD,SAAS,CAAC,MAAM,CAAC;aACjB,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nafterEach(() => jwksServer?.close());\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction sign(\n  key: CryptoKey,\n  claims: Record<string, unknown>,\n  opts: { issuer?: string; audience?: string; expiresAt?: string } = {},\n) {\n  return new jose.SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(opts.issuer ?? ISSUER)\n    .setAudience(opts.audience ?? AUDIENCE)\n    .setExpirationTime(opts.expiresAt ?? \"1h\")\n    .sign(key);\n}\n\nit(\"rejects a config with no issuer\", () => {\n  expect(() => createJwksVerifier({ issuer: \"\" })).toThrow(\n    /requires an `issuer`/,\n  );\n});\n\ndescribe(\"createJwksVerifier\", () => {\n  it(\"verifies a valid token and maps claims to AuthInfo\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(privateKey, {\n      client_id: \"client-1\",\n      scope: \"openid email\",\n      sub: \"user-1\",\n      email: \"a@b.test\",\n    });\n\n    const auth = await verifier.verifyAccessToken(token);\n\n    expect(auth.token).toBe(token);\n    expect(auth.clientId).toBe(\"client-1\");\n    expect(auth.scopes).toEqual([\"openid\", \"email\"]);\n    expect(auth.extra?.subject).toBe(\"user-1\");\n    expect(auth.extra?.email).toBe(\"a@b.test\");\n  });\n\n  it(\"rejects a token with the wrong audience\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"api://other\" },\n    );\n\n    await expect(verifier.verifyAccessToken(token)).rejects.toThrow(\n      /Token verification failed/,\n    );\n  });\n\n  // jose quotes claim names — `\"exp\" claim timestamp check failed`, `unexpected\n  // \"aud\" claim value`. Those quotes would close `error_description=\"…\"` early,\n  // dropping the `resource_metadata` that MCP clients start discovery from.\n  it.each([\n    [\n      \"an expired token\",\n      (key: CryptoKey) => sign(key, {}, { expiresAt: \"-1h\" }),\n      // jose: `\"exp\" claim timestamp check failed`\n      \"Token verification failed: exp  claim timestamp check failed\",\n    ],\n    [\n      \"a token issued for another resource\",\n      (key: CryptoKey) => sign(key, {}, { audience: \"api://other\" }),\n      // jose: `unexpected \"aud\" claim value`\n      \"Token verification failed: unexpected  aud  claim value\",\n    ],\n    [\n      \"a token from another issuer\",\n      (key: CryptoKey) => sign(key, {}, { issuer: \"https://other.test\" }),\n      // jose: `unexpected \"iss\" claim value`\n      \"Token verification failed: unexpected  iss  claim value\",\n    ],\n    [\n      \"a token carrying no aud claim\",\n      (key: CryptoKey) =>\n        new jose.SignJWT({})\n          .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n          .setIssuer(ISSUER)\n          .setExpirationTime(\"1h\")\n          .sign(key),\n      // jose: `missing required \"aud\" claim`\n      \"Token verification failed: missing required  aud  claim\",\n    ],\n  ])(\n    \"keeps the message safe inside the challenge for %s\",\n    async (_, mint, expected) => {\n      const { privateKey, jwksUri } = await startJwks();\n      const verifier = createJwksVerifier({\n        issuer: ISSUER,\n        audience: AUDIENCE,\n        jwksUri,\n      });\n\n      const error = await verifier\n        .verifyAccessToken(await mint(privateKey))\n        .then(\n          () => undefined,\n          (e: Error) => e,\n        );\n\n      expect(error?.message).toBe(expected);\n      // OAuth 2.1 §5.3.1: %x20-21 / %x23-5B / %x5D-7E and nothing else.\n      expect(error?.message).not.toMatch(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/);\n    },\n  );\n\n  it(\"accepts a token minted for any of several audiences\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    // A server reached at a local port and through a dev tunnel: tokens carry\n    // whichever resource the client discovered.\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: [AUDIENCE, \"https://tunnel.test\"],\n      jwksUri,\n    });\n\n    const tunnelToken = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"https://tunnel.test\" },\n    );\n    expect((await verifier.verifyAccessToken(tunnelToken)).clientId).toBe(\"c\");\n\n    const localToken = await sign(privateKey, { client_id: \"c\" });\n    expect((await verifier.verifyAccessToken(localToken)).clientId).toBe(\"c\");\n\n    const otherToken = await sign(privateKey, {}, { audience: \"api://other\" });\n    await expect(verifier.verifyAccessToken(otherToken)).rejects.toThrow(\n      /unexpected {2}aud {2}claim value/,\n    );\n  });\n\n  it(\"skips the aud check when no audience is configured (e.g. Clerk)\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({ issuer: ISSUER, jwksUri });\n    // Clerk-shaped access token: no `aud` claim at all.\n    const token = await new jose.SignJWT({ client_id: \"c\", sub: \"u\" })\n      .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n      .setIssuer(ISSUER)\n      .setExpirationTime(\"1h\")\n      .sign(privateKey);\n\n    const auth = await verifier.verifyAccessToken(token);\n    expect(auth.clientId).toBe(\"c\");\n    expect(auth.extra?.subject).toBe(\"u\");\n  });\n\n  it(\"parses array scope claims and trims extra whitespace\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n\n    const arrayToken = await sign(privateKey, {\n      scope: [\"openid\", \"email\"],\n    });\n    expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n\n    const messyToken = await sign(privateKey, { scope: \" openid  email \" });\n    expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n  });\n});\n"]}

package/dist/server/auth-extra.test-d.js

@@ -1,38 +1,55 @@
 import { expectTypeOf, test } from "vitest";
 import { z } from "zod";
+import { Skybridge } from "./app.js";
 import { customProvider } from "./auth/providers/custom.js";
 import { workosProvider } from "./auth/providers/workos.js";
-import { McpServer } from "./server.js";
-const workosOAuth = await workosProvider({ domain: "d", audience: "a" });
+const workosOAuth = await workosProvider({
+    domain: "d",
+    audience: "a",
+}).resolve();
 const customOAuth = await workosProvider({
     domain: "d",
     audience: "a",
-});
+}).resolve();
 test("a server with no oauth keeps the untyped claim bag", () => {
-    new McpServer({ name: "t", version: "0" }).registerTool({ name: "plain", inputSchema: { q: z.string() } }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf();
-        return { content: "ok" };
+    new Skybridge({
+        name: "t",
+        version: "0",
+        handler: (server) => server.registerTool({ name: "plain", inputSchema: { q: z.string() } }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf();
+            return { content: "ok" };
+        }),
     });
 });
 test("provider claims reach tool handlers", () => {
-    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth })
-        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
-        expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf();
-        // @ts-expect-error not a WorkOS claim
-        extra.http?.authInfo?.extra?.nope;
-        return { content: "a" };
-    })
-        .registerTool({ name: "b", inputSchema: {} }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf();
-        return { content: "b" };
+    new Skybridge({
+        name: "t",
+        version: "0",
+        oauth: workosOAuth,
+        handler: (server) => server
+            .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+            expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf();
+            // @ts-expect-error not a WorkOS claim
+            extra.http?.authInfo?.extra?.nope;
+            return { content: "a" };
+        })
+            .registerTool({ name: "b", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf();
+            return { content: "b" };
+        }),
     });
 });
 test("registered claims survive the mapping into extra", () => {
-    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf();
-        expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf();
-        return { content: "a" };
+    new Skybridge({
+        name: "t",
+        version: "0",
+        oauth: workosOAuth,
+        handler: (server) => server.registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf();
+            expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf();
+            return { content: "a" };
+        }),
     });
 });
 test("a hand-written verifier carries its own claims", async () => {
@@ -43,10 +60,15 @@ test("a hand-written verifier carries its own claims", async () => {
     };
     const { oauthMetadata } = await customProvider({
         issuer: "https://idp.example.com",
-    });
-    new McpServer({ name: "t", version: "0" }, {}, { oauth: { oauthMetadata, verifier } }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf();
-        return { content: "a" };
+    }).resolve();
+    new Skybridge({
+        name: "t",
+        version: "0",
+        oauth: { oauthMetadata, verifier },
+        handler: (server) => server.registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf();
+            return { content: "a" };
+        }),
     });
 });
 test("a config must carry a verifier", () => {
@@ -57,15 +79,52 @@ test("a config must carry a verifier", () => {
     void missing;
 });
 test("a provider override adds claims without dropping the provider's", () => {
-    new McpServer({ name: "t", version: "0" }, {}, { oauth: customOAuth })
-        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
-        expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
-        return { content: "a" };
-    })
-        .mcpMiddleware("tools/call", (_request, extra, next) => {
-        expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
-        return next();
+    new Skybridge({
+        name: "t",
+        version: "0",
+        oauth: customOAuth,
+        handler: (server) => server
+            .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
+            expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+            return { content: "a" };
+        })
+            .mcpMiddleware("tools/call", (_request, extra, next) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
+            return next();
+        }),
+    });
+});
+test("bag oauth claims reach tool handlers through the function form", () => {
+    new Skybridge({
+        name: "t",
+        version: "0",
+        oauth: workosProvider({ domain: "d", audience: "a" }),
+        handler: (server) => server.registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+            expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+            // @ts-expect-error not a WorkOS claim
+            extra.http?.authInfo?.extra?.nope;
+            return { content: "a" };
+        }),
+    });
+});
+test("the setup config flows into oauth and handler, and the app carries the registry", () => {
+    const app = new Skybridge({
+        name: "t",
+        version: "0",
+        setup: async () => ({ apiKey: "k" }),
+        oauth: (config) => {
+            expectTypeOf(config).toEqualTypeOf();
+            return workosOAuth;
+        },
+        handler: (server, config) => {
+            expectTypeOf(config).toEqualTypeOf();
+            return server.registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+                expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+                return { content: "a" };
+            });
+        },
     });
+    expectTypeOf().toEqualTypeOf();
 });
 //# sourceMappingURL=auth-extra.test-d.js.map

package/dist/server/auth-extra.test-d.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-extra.test-d.js","sourceRoot":"","sources":["../../src/server/auth-extra.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAqB;IAC3D,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACjD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,aAAa,EAEpD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,EAEjE,CAAC;QACJ,sCAAsC;QACtC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAEhE,MAAM,QAAQ,GAA0B;QACtC,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC;QAC7C,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;IACH,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CACvC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,aAAa,EAE3D,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,0CAA0C;IAC1C,MAAM,OAAO,GAAgB;QAC3B,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC;IACF,KAAK,OAAO,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport { z } from \"zod\";\nimport type { OAuthConfig } from \"./auth/index.js\";\nimport { customProvider } from \"./auth/providers/custom.js\";\nimport { workosProvider } from \"./auth/providers/workos.js\";\nimport type { TokenVerifier } from \"./auth.js\";\nimport { McpServer } from \"./server.js\";\n\nconst workosOAuth = await workosProvider({ domain: \"d\", audience: \"a\" });\nconst customOAuth = await workosProvider<{ tenant: string }>({\n  domain: \"d\",\n  audience: \"a\",\n});\n\ntest(\"a server with no oauth keeps the untyped claim bag\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n    { name: \"plain\", inputSchema: { q: z.string() } },\n    (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf<\n        Record<string, unknown> | undefined\n      >();\n      return { content: \"ok\" };\n    },\n  );\n});\n\ntest(\"provider claims reach tool handlers\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: workosOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf<\n        string[] | undefined\n      >();\n      // @ts-expect-error not a WorkOS claim\n      extra.http?.authInfo?.extra?.nope;\n      return { content: \"a\" };\n    })\n    .registerTool({ name: \"b\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"b\" };\n    });\n});\n\ntest(\"registered claims survive the mapping into extra\", () => {\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: workosOAuth },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf<\n      string | undefined\n    >();\n    expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf<\n      number | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a hand-written verifier carries its own claims\", async () => {\n  type Claims = { subject?: string; email?: string };\n  const verifier: TokenVerifier<Claims> = {\n    async verifyAccessToken(token) {\n      return { token, clientId: \"c\", scopes: [], expiresAt: 1, extra: {} };\n    },\n  };\n  const { oauthMetadata } = await customProvider({\n    issuer: \"https://idp.example.com\",\n  });\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: { oauthMetadata, verifier } },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf<\n      string | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a config must carry a verifier\", () => {\n  // @ts-expect-error a verifier is required\n  const missing: OAuthConfig = {\n    oauthMetadata: workosOAuth.oauthMetadata,\n  };\n  void missing;\n});\n\ntest(\"a provider override adds claims without dropping the provider's\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: customOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"a\" };\n    })\n    .mcpMiddleware(\"tools/call\", (_request, extra, next) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      return next();\n    });\n});\n"]}
+{"version":3,"file":"auth-extra.test-d.js","sourceRoot":"","sources":["../../src/server/auth-extra.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC;IACvC,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC,OAAO,EAAE,CAAC;AACb,MAAM,WAAW,GAAG,MAAM,cAAc,CAAqB;IAC3D,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC,OAAO,EAAE,CAAC;AAEb,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACjD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,aAAa,EAEpD,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,CACF;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM;aACH,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;YACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,EAEjE,CAAC;YACJ,sCAAsC;YACtC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;aACD,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;YACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAEhE,MAAM,QAAQ,GAA0B;QACtC,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC;QAC7C,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC,OAAO,EAAE,CAAC;IACb,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,aAAa,EAE3D,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,0CAA0C;IAC1C,MAAM,OAAO,GAAgB;QAC3B,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC;IACF,KAAK,OAAO,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM;aACH,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;YACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;aACD,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrD,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;YACJ,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,IAAI,SAAS,CAAC;QACZ,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;YACJ,sCAAsC;YACtC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC3F,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;QACxB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACpC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAsB,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC1B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAsB,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,CACxB,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAC9B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACf,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,YAAY,EAAyB,CAAC,aAAa,EAAO,CAAC;AAC7D,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport { z } from \"zod\";\nimport { Skybridge } from \"./app.js\";\nimport type { OAuthConfig } from \"./auth/index.js\";\nimport { customProvider } from \"./auth/providers/custom.js\";\nimport { workosProvider } from \"./auth/providers/workos.js\";\nimport type { TokenVerifier } from \"./auth.js\";\nimport type { ToolNames } from \"./inferUtilityTypes.js\";\n\nconst workosOAuth = await workosProvider({\n  domain: \"d\",\n  audience: \"a\",\n}).resolve();\nconst customOAuth = await workosProvider<{ tenant: string }>({\n  domain: \"d\",\n  audience: \"a\",\n}).resolve();\n\ntest(\"a server with no oauth keeps the untyped claim bag\", () => {\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    handler: (server) =>\n      server.registerTool(\n        { name: \"plain\", inputSchema: { q: z.string() } },\n        (_args, extra) => {\n          expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf<\n            Record<string, unknown> | undefined\n          >();\n          return { content: \"ok\" };\n        },\n      ),\n  });\n});\n\ntest(\"provider claims reach tool handlers\", () => {\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    oauth: workosOAuth,\n    handler: (server) =>\n      server\n        .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n          expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n            string | undefined\n          >();\n          expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf<\n            string[] | undefined\n          >();\n          // @ts-expect-error not a WorkOS claim\n          extra.http?.authInfo?.extra?.nope;\n          return { content: \"a\" };\n        })\n        .registerTool({ name: \"b\", inputSchema: {} }, (_args, extra) => {\n          expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf<\n            string | undefined\n          >();\n          return { content: \"b\" };\n        }),\n  });\n});\n\ntest(\"registered claims survive the mapping into extra\", () => {\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    oauth: workosOAuth,\n    handler: (server) =>\n      server.registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n        expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf<\n          string | undefined\n        >();\n        expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf<\n          number | undefined\n        >();\n        return { content: \"a\" };\n      }),\n  });\n});\n\ntest(\"a hand-written verifier carries its own claims\", async () => {\n  type Claims = { subject?: string; email?: string };\n  const verifier: TokenVerifier<Claims> = {\n    async verifyAccessToken(token) {\n      return { token, clientId: \"c\", scopes: [], expiresAt: 1, extra: {} };\n    },\n  };\n  const { oauthMetadata } = await customProvider({\n    issuer: \"https://idp.example.com\",\n  }).resolve();\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    oauth: { oauthMetadata, verifier },\n    handler: (server) =>\n      server.registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n        expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf<\n          string | undefined\n        >();\n        return { content: \"a\" };\n      }),\n  });\n});\n\ntest(\"a config must carry a verifier\", () => {\n  // @ts-expect-error a verifier is required\n  const missing: OAuthConfig = {\n    oauthMetadata: workosOAuth.oauthMetadata,\n  };\n  void missing;\n});\n\ntest(\"a provider override adds claims without dropping the provider's\", () => {\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    oauth: customOAuth,\n    handler: (server) =>\n      server\n        .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n          expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n            string | undefined\n          >();\n          expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n            string | undefined\n          >();\n          return { content: \"a\" };\n        })\n        .mcpMiddleware(\"tools/call\", (_request, extra, next) => {\n          expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n            string | undefined\n          >();\n          return next();\n        }),\n  });\n});\n\ntest(\"bag oauth claims reach tool handlers through the function form\", () => {\n  new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    oauth: workosProvider({ domain: \"d\", audience: \"a\" }),\n    handler: (server) =>\n      server.registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n        expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n          string | undefined\n        >();\n        // @ts-expect-error not a WorkOS claim\n        extra.http?.authInfo?.extra?.nope;\n        return { content: \"a\" };\n      }),\n  });\n});\n\ntest(\"the setup config flows into oauth and handler, and the app carries the registry\", () => {\n  const app = new Skybridge({\n    name: \"t\",\n    version: \"0\",\n    setup: async () => ({ apiKey: \"k\" }),\n    oauth: (config) => {\n      expectTypeOf(config).toEqualTypeOf<{ apiKey: string }>();\n      return workosOAuth;\n    },\n    handler: (server, config) => {\n      expectTypeOf(config).toEqualTypeOf<{ apiKey: string }>();\n      return server.registerTool(\n        { name: \"a\", inputSchema: {} },\n        (_args, extra) => {\n          expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n            string | undefined\n          >();\n          return { content: \"a\" };\n        },\n      );\n    },\n  });\n  expectTypeOf<ToolNames<typeof app>>().toEqualTypeOf<\"a\">();\n});\n"]}

package/dist/server/auth.d.ts

@@ -2,13 +2,13 @@ import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/express"
 import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/server";
 import type { RequestHandler } from "express";
 export { type AuthMetadataOptions, type BearerAuthMiddlewareOptions, mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
-export { OAuthError } from "@modelcontextprotocol/server";
+export { OAuthError, OAuthErrorCode } from "@modelcontextprotocol/server";
 /** Claims a verifier puts in `AuthInfo["extra"]`: any JSON-ish bag of them. */
 export type ExtraClaims = Record<string, unknown>;
 /**
  * A validated access token, as resolved by a
  * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to
- * handlers on `extra.authInfo`.
+ * handlers on `extra.http?.authInfo`.
  *
  * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The
  * claims are owned by whoever verifies the token: parameterize the verifier and
@@ -30,7 +30,7 @@ export type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<SdkAuthInf
 };
 /**
  * Checks a bearer token and resolves the claims it carries. The type parameter
- * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the
+ * is what makes `extra.http?.authInfo.extra` typed downstream, so a verifier is the
  * single source for the claim shape.
  *
  * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,
@@ -45,7 +45,7 @@ export type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {
  * Like `requireBearerAuth`, but lets requests through when no
  * `Authorization` header is present. Used for mixed-auth servers where some
  * tools are public and others require sign-in: each tool enforces its own
- * `securitySchemes` against `extra.authInfo`.
+ * `securitySchemes` against `extra.http?.authInfo`.
  *
  * Behavior:
  * - No `Authorization` header → `next()` without `req.auth`.

package/dist/server/auth.js

@@ -1,11 +1,11 @@
 import { requireBearerAuth, } from "@modelcontextprotocol/express";
 export { mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
-export { OAuthError } from "@modelcontextprotocol/server";
+export { OAuthError, OAuthErrorCode } from "@modelcontextprotocol/server";
 /**
  * Like `requireBearerAuth`, but lets requests through when no
  * `Authorization` header is present. Used for mixed-auth servers where some
  * tools are public and others require sign-in: each tool enforces its own
- * `securitySchemes` against `extra.authInfo`.
+ * `securitySchemes` against `extra.http?.authInfo`.
  *
  * Behavior:
  * - No `Authorization` header → `next()` without `req.auth`.

package/dist/server/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAGL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AA2C1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nimport type { AuthInfo as SdkAuthInfo } from \"@modelcontextprotocol/server\";\n\nimport type { RequestHandler } from \"express\";\n\nexport {\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  mcpAuthMetadataRouter,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nexport { OAuthError } from \"@modelcontextprotocol/server\";\n/** Claims a verifier puts in `AuthInfo[\"extra\"]`: any JSON-ish bag of them. */\nexport type ExtraClaims = Record<string, unknown>;\n\n/**\n * A validated access token, as resolved by a\n * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to\n * handlers on `extra.authInfo`.\n *\n * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The\n * claims are owned by whoever verifies the token: parameterize the verifier and\n * the shape flows through {@link OAuthConfig} to every handler.\n *\n * @typeParam TExtra - Claims populated in `extra`.\n *\n * @example\n * ```ts\n * type Claims = { subject?: string; email?: string };\n *\n * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {\n *   // ...\n * }\n * ```\n */\nexport type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<\n  SdkAuthInfo,\n  \"extra\"\n> & { extra?: TExtra };\n\n/**\n * Checks a bearer token and resolves the claims it carries. The type parameter\n * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the\n * single source for the claim shape.\n *\n * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,\n * or hand it to the `oauth` server option inside an {@link OAuthConfig}.\n *\n * @typeParam TExtra - Claims this verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {\n  verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;\n};\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAGL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA2C1E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nimport type { AuthInfo as SdkAuthInfo } from \"@modelcontextprotocol/server\";\n\nimport type { RequestHandler } from \"express\";\n\nexport {\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  mcpAuthMetadataRouter,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nexport { OAuthError, OAuthErrorCode } from \"@modelcontextprotocol/server\";\n/** Claims a verifier puts in `AuthInfo[\"extra\"]`: any JSON-ish bag of them. */\nexport type ExtraClaims = Record<string, unknown>;\n\n/**\n * A validated access token, as resolved by a\n * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to\n * handlers on `extra.http?.authInfo`.\n *\n * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The\n * claims are owned by whoever verifies the token: parameterize the verifier and\n * the shape flows through {@link OAuthConfig} to every handler.\n *\n * @typeParam TExtra - Claims populated in `extra`.\n *\n * @example\n * ```ts\n * type Claims = { subject?: string; email?: string };\n *\n * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {\n *   // ...\n * }\n * ```\n */\nexport type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<\n  SdkAuthInfo,\n  \"extra\"\n> & { extra?: TExtra };\n\n/**\n * Checks a bearer token and resolves the claims it carries. The type parameter\n * is what makes `extra.http?.authInfo.extra` typed downstream, so a verifier is the\n * single source for the claim shape.\n *\n * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,\n * or hand it to the `oauth` server option inside an {@link OAuthConfig}.\n *\n * @typeParam TExtra - Claims this verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {\n  verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;\n};\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.http?.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/build-manifest.test.js

@@ -4,7 +4,7 @@ function manifestOf(server) {
     return server.viteManifest;
 }
 function makeServer() {
-    return new McpServer({ name: "test", version: "0.0.1" }, { capabilities: {} });
+    return new McpServer({ name: "test", version: "0.0.1" });
 }
 describe("__setBuildManifest", () => {
     it("primes the Vite manifest for the next McpServer constructed", () => {
@@ -16,12 +16,13 @@ describe("__setBuildManifest", () => {
         // generated `dist/__entry.js` relies on.
         expect(manifestOf(makeServer())).toEqual(manifest);
     });
-    it("is consume-once: a second McpServer built without re-priming gets no manifest", () => {
-        __setBuildManifest({
+    it("keeps priming every McpServer the app factory builds per request", () => {
+        const manifest = {
             "src/views/index.tsx": { file: "assets/index-CAFEBABE.js" },
-        });
-        makeServer(); // consumes the primed manifest
-        expect(manifestOf(makeServer())).toBeNull();
+        };
+        __setBuildManifest(manifest);
+        makeServer();
+        expect(manifestOf(makeServer())).toEqual(manifest);
     });
 });
 //# sourceMappingURL=build-manifest.test.js.map

package/dist/server/build-manifest.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-manifest.test.js","sourceRoot":"","sources":["../../src/server/build-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,SAAS,UAAU,CACjB,MAAiB;IAEjB,OACE,MAGD,CAAC,YAAY,CAAC;AACjB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,SAAS,CAClB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAClC,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,kBAAkB,CAAC;YACjB,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC,CAAC;QAEH,UAAU,EAAE,CAAC,CAAC,+BAA+B;QAC7C,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nfunction manifestOf(\n  server: McpServer,\n): Record<string, { file: string }> | null {\n  return (\n    server as unknown as {\n      viteManifest: Record<string, { file: string }> | null;\n    }\n  ).viteManifest;\n}\n\nfunction makeServer(): McpServer {\n  return new McpServer(\n    { name: \"test\", version: \"0.0.1\" },\n    { capabilities: {} },\n  );\n}\n\ndescribe(\"__setBuildManifest\", () => {\n  it(\"primes the Vite manifest for the next McpServer constructed\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-DEADBEEF.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    // viteManifest is private; reach into it to lock the contract that the\n    // generated `dist/__entry.js` relies on.\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n\n  it(\"is consume-once: a second McpServer built without re-priming gets no manifest\", () => {\n    __setBuildManifest({\n      \"src/views/index.tsx\": { file: \"assets/index-CAFEBABE.js\" },\n    });\n\n    makeServer(); // consumes the primed manifest\n    expect(manifestOf(makeServer())).toBeNull();\n  });\n});\n"]}
+{"version":3,"file":"build-manifest.test.js","sourceRoot":"","sources":["../../src/server/build-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,SAAS,UAAU,CACjB,MAAiB;IAEjB,OACE,MAGD,CAAC,YAAY,CAAC;AACjB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,UAAU,EAAE,CAAC;QACb,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nfunction manifestOf(\n  server: McpServer,\n): Record<string, { file: string }> | null {\n  return (\n    server as unknown as {\n      viteManifest: Record<string, { file: string }> | null;\n    }\n  ).viteManifest;\n}\n\nfunction makeServer(): McpServer {\n  return new McpServer({ name: \"test\", version: \"0.0.1\" });\n}\n\ndescribe(\"__setBuildManifest\", () => {\n  it(\"primes the Vite manifest for the next McpServer constructed\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-DEADBEEF.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    // viteManifest is private; reach into it to lock the contract that the\n    // generated `dist/__entry.js` relies on.\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n\n  it(\"keeps priming every McpServer the app factory builds per request\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-CAFEBABE.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    makeServer();\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n});\n"]}

package/dist/server/events.d.ts

@@ -0,0 +1,113 @@
+import { type McpServer as SdkMcpServer, type StandardSchemaV1, type StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+/**
+ * A webhook subscription, as passed to `onSubscribe`. Whatever delivers the
+ * events POSTs them to `url`, signed with `secret`, until `expiresAt`.
+ */
+export interface EventSubscription {
+    /** Stable across refreshes: the same user subscribing to the same event with the same arguments and callback gets the same `id`. */
+    id: string;
+    /** Callback URL deliveries are POSTed to. */
+    url: string;
+    /** Standard Webhooks signing secret (`whsec_…`). A refresh may carry a new one. */
+    secret: string;
+    /** When the subscription lapses unless the host refreshes it. */
+    expiresAt: Date;
+}
+/** An event occurrence, as passed to {@link deliverEvent}. */
+export interface EventOccurrence {
+    /** Event type name, as registered with `registerEvent`. */
+    name: string;
+    /** Stable identifier the host uses to drop duplicates, ideally the upstream's. Reuse it when retrying. */
+    id: string;
+    /** When the event happened. Defaults to now. */
+    timestamp?: Date;
+    /** Payload matching the event's `payloadSchema`. */
+    data: unknown;
+}
+/** Outcome of {@link deliverEvent}. Retry with the same event `id` when `retryable`. */
+export type DeliveryResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    retryable: boolean;
+    status?: number;
+};
+type EventSchema = Record<string, StandardSchemaWithJSON> | StandardSchemaWithJSON;
+export type InferEventSchema<T extends EventSchema> = T extends StandardSchemaWithJSON ? StandardSchemaV1.InferOutput<T> : T extends Record<string, StandardSchemaWithJSON> ? {
+    [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]> ? never : K]: StandardSchemaV1.InferOutput<T[K]>;
+} & {
+    [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]> ? K : never]?: StandardSchemaV1.InferOutput<T[K]>;
+} : never;
+/** The `registerEvent` config: how the event type is described in `events/list`. */
+export interface EventConfig<TInput extends EventSchema> {
+    /** Stable, specific name such as `comment.created`. */
+    name: string;
+    /** What the event is and when it fires. */
+    description?: string;
+    /** Subscription arguments (filters): a Zod shape or a Standard Schema object. */
+    inputSchema?: TInput;
+    /** Shape of the delivered `data`: a Zod shape or a Standard Schema object. */
+    payloadSchema: EventSchema;
+    _meta?: Record<string, unknown>;
+}
+/** What `registerEvent` does when the host subscribes and unsubscribes. */
+export interface EventHooks<TArguments, TExtra> {
+    /**
+     * Runs on every `events/subscribe`, including the host's refreshes, once
+     * the callback URL is verified. Hand the subscription to whatever delivers
+     * the events, keyed by `subscription.id`. Throw (e.g. a `ProtocolError`) to
+     * reject it, for instance when the user may not access what the arguments
+     * point to.
+     */
+    onSubscribe(args: TArguments, context: {
+        subscription: EventSubscription;
+        extra: TExtra;
+    }): void | Promise<void>;
+    /** Runs on `events/unsubscribe`. Stop delivering to `subscription.id`. */
+    onUnsubscribe(args: TArguments, context: {
+        subscription: Pick<EventSubscription, "id">;
+        extra: TExtra;
+    }): void | Promise<void>;
+}
+/**
+ * @experimental POST one event to a subscription handed out by `onSubscribe`,
+ * as MCP Events expects: the event envelope, Standard Webhooks signature
+ * headers, a 10 second deadline and, outside development, no requests to
+ * private addresses. Pass the old and new secrets during a rotation so both
+ * sign the delivery. A subscription past `expiresAt` is not posted to.
+ * Retrying is up to the caller. API may change.
+ *
+ * @example
+ * ```ts
+ * const result = await deliverEvent(subscription, {
+ *   name: "comment.created",
+ *   id: comment.id,
+ *   data: { documentId: comment.documentId, excerpt: comment.text.slice(0, 280) },
+ * });
+ * if (!result.ok && result.retryable) {
+ *   await queue.retryLater(subscription, comment);
+ * }
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/register-event
+ */
+export declare function deliverEvent(subscription: Pick<EventSubscription, "id" | "url"> & {
+    secret: string | string[];
+    expiresAt: Date | string;
+}, event: EventOccurrence): Promise<DeliveryResult>;
+/**
+ * The event types registered on one server, and the `events/*` handlers that
+ * serve them.
+ *
+ * @internal
+ */
+export declare class EventRegistry {
+    private readonly server;
+    private readonly events;
+    constructor(server: Pick<SdkMcpServer["server"], "setRequestHandler">);
+    add(config: EventConfig<EventSchema>, hooks: EventHooks<never, never>): void;
+    private install;
+    private resolve;
+}
+export {};