skybridge 0.0.0-dev.89e1390 → 0.0.0-dev.89e35fa

package/dist/web/hooks/use-view-state.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-view-state.test.js","sourceRoot":"","sources":["../../../src/web/hooks/use-view-state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EAEF,EAAE,GACH,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,UAA0D,CAAC;IAE/D,UAAU,CAAC,GAAG,EAAE;QACd,UAAU,GAAG;YACX,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SACrD,CAAC;QACF,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEjD,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAEhD,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC;YACrD,YAAY,EAAE,QAAQ;YACtB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC;YACrD,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YACxC,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEhD,8CAA8C;QAC9C,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACvD,sDAAsD;QACtD,QAAQ,EAAE,CAAC;QAEX,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACpD,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,YAAY,CAAC,aAAa,EAAE,CAAC;QAC7B,aAAa,CAAC,aAAa,EAAE,CAAC;QAC9B,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE1E,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,qDAAqD;QACrD,YAAY,CAAC,OAAO,CAClB,oBAAoB,QAAQ,EAAE,EAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CACvC,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE1E,GAAG,CAAC,GAAG,EAAE;YACP,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACrC,YAAY,CAAC,OAAO,CAAC,oBAAoB,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAE1E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,GAAG,CAAC,GAAG,EAAE;YACP,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,MAAM,MAAM,GAAG,oBAAoB,QAAQ,EAAE,CAAC;QAC9C,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,gEAAgE;QAChE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,+CAA+C;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,YAAY,CAAC,OAAO,CAClB,MAAM,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACxE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { act, renderHook, waitFor } from \"@testing-library/react\";\nimport {\n  afterEach,\n  beforeEach,\n  describe,\n  expect,\n  it,\n  type Mock,\n  vi,\n} from \"vitest\";\nimport { McpAppAdaptor, McpAppBridge } from \"../bridges/mcp-app/index.js\";\nimport {\n  fireToolResultNotification,\n  getMcpAppHostPostMessageMock,\n  MockResizeObserver,\n} from \"./test/utils.js\";\nimport { useViewState } from \"./use-view-state.js\";\n\ndescribe(\"useViewState\", () => {\n  let OpenaiMock: { widgetState: unknown; setWidgetState: Mock };\n\n  beforeEach(() => {\n    OpenaiMock = {\n      widgetState: null,\n      setWidgetState: vi.fn().mockResolvedValue(undefined),\n    };\n    vi.stubGlobal(\"openai\", OpenaiMock);\n    vi.stubGlobal(\"skybridge\", { hostType: \"apps-sdk\" });\n  });\n\n  afterEach(() => {\n    vi.unstubAllGlobals();\n    vi.resetAllMocks();\n  });\n\n  const defaultState = { count: 0, name: \"test\" };\n  const windowState = { count: 5, name: \"window\" };\n\n  it(\"should initialize with default state when window.openai.widgetState is null\", () => {\n    OpenaiMock.widgetState = null;\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(defaultState);\n  });\n\n  it(\"should initialize with window.openai.widgetState when available\", () => {\n    OpenaiMock.widgetState = { modelContent: windowState };\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(windowState);\n  });\n\n  it(\"should call window.openai.setWidgetState when setViewState is called with a new state\", async () => {\n    const { result } = renderHook(() => useViewState(defaultState));\n    const newState = { count: 10, name: \"updated\" };\n\n    act(() => {\n      result.current[1](newState);\n    });\n\n    expect(OpenaiMock.setWidgetState).toHaveBeenCalledWith({\n      modelContent: newState,\n      privateContent: {},\n    });\n    expect(result.current[0]).toEqual(newState);\n  });\n\n  it(\"should call window.openai.setWidgetState when setViewState is called with a function updater\", async () => {\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    act(() => {\n      result.current[1]((prev) => ({ ...prev, count: prev.count + 1 }));\n    });\n\n    expect(OpenaiMock.setWidgetState).toHaveBeenCalledWith({\n      modelContent: { count: 1, name: \"test\" },\n      privateContent: {},\n    });\n    expect(result.current[0]).toEqual({ count: 1, name: \"test\" });\n  });\n\n  it(\"should update state when window.openai.widgetState changes\", () => {\n    OpenaiMock.widgetState = { modelContent: defaultState };\n    const { result, rerender } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(defaultState);\n\n    // Simulate window.openai.widgetState changing\n    OpenaiMock.widgetState = { modelContent: windowState };\n    // Trigger re-render to simulate the useEffect running\n    rerender();\n\n    expect(result.current[0]).toEqual(windowState);\n  });\n});\n\ndescribe(\"useViewState (mcp-app host — localStorage persistence)\", () => {\n  beforeEach(() => {\n    vi.stubGlobal(\"parent\", { postMessage: getMcpAppHostPostMessageMock() });\n    vi.stubGlobal(\"skybridge\", { hostType: \"mcp-app\" });\n    vi.stubGlobal(\"ResizeObserver\", MockResizeObserver);\n    localStorage.clear();\n  });\n\n  afterEach(() => {\n    vi.unstubAllGlobals();\n    vi.resetAllMocks();\n    McpAppBridge.resetInstance();\n    McpAppAdaptor.resetInstance();\n    localStorage.clear();\n  });\n\n  it(\"should persist state to localStorage when viewUUID is available\", async () => {\n    const viewUUID = \"test-uuid-123\";\n    const { result } = renderHook(() => useViewState({ page: 1, zoom: 100 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 3, zoom: 150 });\n    });\n\n    expect(result.current[0]).toEqual({ page: 3, zoom: 150 });\n    expect(localStorage.length).toBe(1);\n  });\n\n  it(\"should restore state from localStorage when viewUUID arrives\", async () => {\n    const viewUUID = \"test-uuid-456\";\n    // Pre-seed with the sb:{timestamp}:{viewUUID} format\n    localStorage.setItem(\n      `sb:1700000000000:${viewUUID}`,\n      JSON.stringify({ page: 5, zoom: 200 }),\n    );\n\n    const { result } = renderHook(() => useViewState({ page: 1, zoom: 100 }));\n\n    act(() => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    await waitFor(() => {\n      expect(result.current[0]).toEqual({ page: 5, zoom: 200 });\n    });\n  });\n\n  it(\"should not persist when no viewUUID is available\", () => {\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    act(() => {\n      result.current[1]({ page: 2 });\n    });\n\n    expect(result.current[0]).toEqual({ page: 2 });\n    expect(localStorage.length).toBe(0);\n  });\n\n  it(\"should handle corrupted localStorage data gracefully\", async () => {\n    const viewUUID = \"test-uuid-corrupt\";\n    localStorage.setItem(`sb:1700000000000:${viewUUID}`, \"not valid json{{{\");\n\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    act(() => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    await waitFor(() => {\n      expect(result.current[0]).toEqual({ page: 1 });\n    });\n  });\n\n  it(\"should refresh localStorage timestamp on each persist (LRU)\", async () => {\n    const viewUUID = \"lru-test-uuid\";\n    const oldKey = `sb:1000000000000:${viewUUID}`;\n    localStorage.setItem(oldKey, JSON.stringify({ page: 1 }));\n\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 2 });\n    });\n\n    // Old key removed, replaced with a new one (still just 1 entry)\n    expect(localStorage.getItem(oldKey)).toBeNull();\n    expect(localStorage.length).toBe(1);\n  });\n\n  it(\"should evict oldest entries when exceeding max storage entries\", async () => {\n    // Fill localStorage with 200 entries (the max)\n    for (let i = 0; i < 200; i++) {\n      localStorage.setItem(\n        `sb:${String(1000000000000 + i)}:old-uuid-${String(i).padStart(4, \"0\")}`,\n        JSON.stringify({ i }),\n      );\n    }\n    expect(localStorage.length).toBe(200);\n\n    const viewUUID = \"eviction-test-uuid\";\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 99 });\n    });\n\n    // Should have evicted the oldest entry to stay at 200\n    expect(localStorage.length).toBe(200);\n    expect(localStorage.getItem(\"sb:1000000000000:old-uuid-0000\")).toBeNull();\n  });\n});\n"]}
+{"version":3,"file":"use-view-state.test.js","sourceRoot":"","sources":["../../../src/web/hooks/use-view-state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EAEF,EAAE,GACH,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,UAA0D,CAAC;IAE/D,UAAU,CAAC,GAAG,EAAE;QACd,UAAU,GAAG;YACX,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;SACrD,CAAC;QACF,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,YAAY,CAAC,aAAa,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEjD,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAEhD,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC;YACrD,YAAY,EAAE,QAAQ;YACtB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC;YACrD,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YACxC,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEhD,8CAA8C;QAC9C,UAAU,CAAC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACvD,sDAAsD;QACtD,QAAQ,EAAE,CAAC;QAEX,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACpD,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,YAAY,CAAC,aAAa,EAAE,CAAC;QAC7B,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE1E,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,qDAAqD;QACrD,YAAY,CAAC,OAAO,CAClB,oBAAoB,QAAQ,EAAE,EAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CACvC,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE1E,GAAG,CAAC,GAAG,EAAE;YACP,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACrC,YAAY,CAAC,OAAO,CAAC,oBAAoB,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAE1E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,GAAG,CAAC,GAAG,EAAE;YACP,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC;QACjC,MAAM,MAAM,GAAG,oBAAoB,QAAQ,EAAE,CAAC;QAC9C,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,gEAAgE;QAChE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,+CAA+C;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,YAAY,CAAC,OAAO,CAClB,MAAM,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACxE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/D,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACnB,0BAA0B,CAAC;gBACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,iBAAiB,EAAE,EAAE;gBACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { act, renderHook, waitFor } from \"@testing-library/react\";\nimport {\n  afterEach,\n  beforeEach,\n  describe,\n  expect,\n  it,\n  type Mock,\n  vi,\n} from \"vitest\";\nimport { _resetAdaptor } from \"../bridges/get-adaptor.js\";\nimport { McpAppBridge } from \"../bridges/mcp-app/index.js\";\nimport {\n  fireToolResultNotification,\n  getMcpAppHostPostMessageMock,\n  MockResizeObserver,\n} from \"./test/utils.js\";\nimport { useViewState } from \"./use-view-state.js\";\n\ndescribe(\"useViewState\", () => {\n  let OpenaiMock: { widgetState: unknown; setWidgetState: Mock };\n\n  beforeEach(() => {\n    OpenaiMock = {\n      widgetState: null,\n      setWidgetState: vi.fn().mockResolvedValue(undefined),\n    };\n    vi.stubGlobal(\"openai\", OpenaiMock);\n    vi.stubGlobal(\"skybridge\", { hostType: \"apps-sdk\" });\n  });\n\n  afterEach(() => {\n    vi.unstubAllGlobals();\n    vi.resetAllMocks();\n    _resetAdaptor();\n    McpAppBridge.resetInstance();\n  });\n\n  const defaultState = { count: 0, name: \"test\" };\n  const windowState = { count: 5, name: \"window\" };\n\n  it(\"should initialize with default state when window.openai.widgetState is null\", () => {\n    OpenaiMock.widgetState = null;\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(defaultState);\n  });\n\n  it(\"should initialize with window.openai.widgetState when available\", () => {\n    OpenaiMock.widgetState = { modelContent: windowState };\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(windowState);\n  });\n\n  it(\"should call window.openai.setWidgetState when setViewState is called with a new state\", async () => {\n    const { result } = renderHook(() => useViewState(defaultState));\n    const newState = { count: 10, name: \"updated\" };\n\n    act(() => {\n      result.current[1](newState);\n    });\n\n    expect(OpenaiMock.setWidgetState).toHaveBeenCalledWith({\n      modelContent: newState,\n      privateContent: {},\n    });\n    expect(result.current[0]).toEqual(newState);\n  });\n\n  it(\"should call window.openai.setWidgetState when setViewState is called with a function updater\", async () => {\n    const { result } = renderHook(() => useViewState(defaultState));\n\n    act(() => {\n      result.current[1]((prev) => ({ ...prev, count: prev.count + 1 }));\n    });\n\n    expect(OpenaiMock.setWidgetState).toHaveBeenCalledWith({\n      modelContent: { count: 1, name: \"test\" },\n      privateContent: {},\n    });\n    expect(result.current[0]).toEqual({ count: 1, name: \"test\" });\n  });\n\n  it(\"should update state when window.openai.widgetState changes\", () => {\n    OpenaiMock.widgetState = { modelContent: defaultState };\n    const { result, rerender } = renderHook(() => useViewState(defaultState));\n\n    expect(result.current[0]).toEqual(defaultState);\n\n    // Simulate window.openai.widgetState changing\n    OpenaiMock.widgetState = { modelContent: windowState };\n    // Trigger re-render to simulate the useEffect running\n    rerender();\n\n    expect(result.current[0]).toEqual(windowState);\n  });\n});\n\ndescribe(\"useViewState (mcp-app host — localStorage persistence)\", () => {\n  beforeEach(() => {\n    vi.stubGlobal(\"parent\", { postMessage: getMcpAppHostPostMessageMock() });\n    vi.stubGlobal(\"skybridge\", { hostType: \"mcp-app\" });\n    vi.stubGlobal(\"openai\", undefined);\n    vi.stubGlobal(\"ResizeObserver\", MockResizeObserver);\n    localStorage.clear();\n  });\n\n  afterEach(() => {\n    vi.unstubAllGlobals();\n    vi.resetAllMocks();\n    _resetAdaptor();\n    McpAppBridge.resetInstance();\n    localStorage.clear();\n  });\n\n  it(\"should persist state to localStorage when viewUUID is available\", async () => {\n    const viewUUID = \"test-uuid-123\";\n    const { result } = renderHook(() => useViewState({ page: 1, zoom: 100 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 3, zoom: 150 });\n    });\n\n    expect(result.current[0]).toEqual({ page: 3, zoom: 150 });\n    expect(localStorage.length).toBe(1);\n  });\n\n  it(\"should restore state from localStorage when viewUUID arrives\", async () => {\n    const viewUUID = \"test-uuid-456\";\n    // Pre-seed with the sb:{timestamp}:{viewUUID} format\n    localStorage.setItem(\n      `sb:1700000000000:${viewUUID}`,\n      JSON.stringify({ page: 5, zoom: 200 }),\n    );\n\n    const { result } = renderHook(() => useViewState({ page: 1, zoom: 100 }));\n\n    act(() => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    await waitFor(() => {\n      expect(result.current[0]).toEqual({ page: 5, zoom: 200 });\n    });\n  });\n\n  it(\"should not persist when no viewUUID is available\", () => {\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    act(() => {\n      result.current[1]({ page: 2 });\n    });\n\n    expect(result.current[0]).toEqual({ page: 2 });\n    expect(localStorage.length).toBe(0);\n  });\n\n  it(\"should handle corrupted localStorage data gracefully\", async () => {\n    const viewUUID = \"test-uuid-corrupt\";\n    localStorage.setItem(`sb:1700000000000:${viewUUID}`, \"not valid json{{{\");\n\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    act(() => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    await waitFor(() => {\n      expect(result.current[0]).toEqual({ page: 1 });\n    });\n  });\n\n  it(\"should refresh localStorage timestamp on each persist (LRU)\", async () => {\n    const viewUUID = \"lru-test-uuid\";\n    const oldKey = `sb:1000000000000:${viewUUID}`;\n    localStorage.setItem(oldKey, JSON.stringify({ page: 1 }));\n\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 2 });\n    });\n\n    // Old key removed, replaced with a new one (still just 1 entry)\n    expect(localStorage.getItem(oldKey)).toBeNull();\n    expect(localStorage.length).toBe(1);\n  });\n\n  it(\"should evict oldest entries when exceeding max storage entries\", async () => {\n    // Fill localStorage with 200 entries (the max)\n    for (let i = 0; i < 200; i++) {\n      localStorage.setItem(\n        `sb:${String(1000000000000 + i)}:old-uuid-${String(i).padStart(4, \"0\")}`,\n        JSON.stringify({ i }),\n      );\n    }\n    expect(localStorage.length).toBe(200);\n\n    const viewUUID = \"eviction-test-uuid\";\n    const { result } = renderHook(() => useViewState({ page: 1 }));\n\n    await act(async () => {\n      fireToolResultNotification({\n        content: [{ type: \"text\", text: \"result\" }],\n        structuredContent: {},\n        _meta: { viewUUID },\n      });\n    });\n\n    act(() => {\n      result.current[1]({ page: 99 });\n    });\n\n    // Should have evicted the oldest entry to stay at 200\n    expect(localStorage.length).toBe(200);\n    expect(localStorage.getItem(\"sb:1000000000000:old-uuid-0000\")).toBeNull();\n  });\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skybridge",
-  "version": "0.0.0-dev.89e1390",
+  "version": "0.0.0-dev.89e35fa",
   "description": "Skybridge is a framework for building ChatGPT and MCP Apps",
   "repository": {
     "type": "git",
@@ -42,7 +42,7 @@
   "license": "ISC",
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.27.0",
-    "@skybridge/devtools": "^1.1.0",
+    "@skybridge/devtools": "^1.0.0",
     "nodemon": ">=3.0.0",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0",
@@ -50,7 +50,7 @@
   },
   "dependencies": {
     "@babel/core": "^7.29.0",
-    "@modelcontextprotocol/ext-apps": "^1.7.3",
+    "@modelcontextprotocol/ext-apps": "^1.3.2",
     "@oclif/core": "^4.10.3",
     "ci-info": "^4.4.0",
     "cors": "^2.8.6",
@@ -61,7 +61,6 @@
     "express": "^5.2.1",
     "handlebars": "^4.7.9",
     "ink": "^7.0.0",
-    "jose": "^6.1.3",
     "open": "^11.0.0",
     "posthog-node": "^5.28.9",
     "superjson": "^2.2.6",

package/dist/server/auth/index.d.ts

@@ -1,20 +0,0 @@
-import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
-import type { JwksVerifyConfig } from "./verify.js";
-/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
-export type OAuthConfig = {
-    /**
-     * Public URL of this server; sets `resourceServerUrl` and the
-     * `resource_metadata` URL. When omitted, it is inferred per request from
-     * `x-forwarded-host`/`origin`/`host` headers.
-     */
-    baseUrl?: string;
-    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
-    oauthMetadata: OAuthMetadata;
-    verify: JwksVerifyConfig;
-    /** Scopes advertised in protected-resource metadata. */
-    scopesSupported?: string[];
-    /** Server-wide required-scope floor. */
-    requiredScopes?: string[];
-    /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */
-    enforcement?: "required" | "optional";
-};

package/dist/server/auth/index.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */\n  enforcement?: \"required\" | \"optional\";\n};\n"]}

package/dist/server/auth/setup.d.ts

@@ -1,4 +0,0 @@
-import type { Express } from "express";
-import type { OAuthConfig } from "./index.js";
-/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
-export declare function setupOAuth(app: Express, config: OAuthConfig): void;

package/dist/server/auth/setup.js

@@ -1,52 +0,0 @@
-import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
-import cors from "cors";
-import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
-import { resolveServerOrigin } from "../requestOrigin.js";
-import { createJwksVerifier } from "./verify.js";
-/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
-export function setupOAuth(app, config) {
-    if (!config.verify?.issuer || !config.verify?.audience) {
-        throw new Error("oauth.verify requires both `issuer` and `audience`");
-    }
-    const verifier = createJwksVerifier(config.verify);
-    const bearer = config.enforcement === "optional" ? optionalBearerAuth : requireBearerAuth;
-    // baseUrl known at boot: bake the resource URLs once, no Host-header trust.
-    if (config.baseUrl !== undefined) {
-        let baseUrl;
-        try {
-            baseUrl = new URL(config.baseUrl);
-        }
-        catch {
-            throw new Error(`oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(config.baseUrl)}`);
-        }
-        app.use(mcpAuthMetadataRouter({
-            oauthMetadata: config.oauthMetadata,
-            resourceServerUrl: baseUrl,
-            scopesSupported: config.scopesSupported,
-        }));
-        app.use("/mcp", bearer({
-            verifier,
-            requiredScopes: config.requiredScopes,
-            resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
-        }));
-        return;
-    }
-    // No baseUrl: resolve the resource origin per request from forwarded headers
-    // (same precedence the framework uses for view serverUrl). Origin headers are
-    // pathless, so the PRM path stays at root, matching the SDK's static layout.
-    const resolveOrigin = (req) => new URL(resolveServerOrigin((key) => req.get(key)));
-    app.use("/.well-known/oauth-authorization-server", cors(), (_req, res) => void res.json(config.oauthMetadata));
-    app.use("/.well-known/oauth-protected-resource", cors(), (req, res) => {
-        res.json({
-            resource: resolveOrigin(req).href,
-            authorization_servers: [config.oauthMetadata.issuer],
-            scopes_supported: config.scopesSupported,
-        });
-    });
-    app.use("/mcp", (req, res, next) => bearer({
-        verifier,
-        requiredScopes: config.requiredScopes,
-        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resolveOrigin(req)),
-    })(req, res, next));
-}
-//# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GACV,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAE7E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;YACpB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,OAAO;YAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CACL,MAAM,EACN,MAAM,CAAC;YACL,QAAQ;YACR,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;SACnE,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CACrC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,IAAI,EAAE,EACN,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACnD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI;YACjC,qBAAqB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YACpD,gBAAgB,EAAE,MAAM,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjC,MAAM,CAAC;QACL,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CACvD,aAAa,CAAC,GAAG,CAAC,CACnB;KACF,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport cors from \"cors\";\nimport type { Express, Request } from \"express\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport { resolveServerOrigin } from \"../requestOrigin.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  if (!config.verify?.issuer || !config.verify?.audience) {\n    throw new Error(\"oauth.verify requires both `issuer` and `audience`\");\n  }\n\n  const verifier = createJwksVerifier(config.verify);\n  const bearer =\n    config.enforcement === \"optional\" ? optionalBearerAuth : requireBearerAuth;\n\n  // baseUrl known at boot: bake the resource URLs once, no Host-header trust.\n  if (config.baseUrl !== undefined) {\n    let baseUrl: URL;\n    try {\n      baseUrl = new URL(config.baseUrl);\n    } catch {\n      throw new Error(\n        `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n          config.baseUrl,\n        )}`,\n      );\n    }\n    app.use(\n      mcpAuthMetadataRouter({\n        oauthMetadata: config.oauthMetadata,\n        resourceServerUrl: baseUrl,\n        scopesSupported: config.scopesSupported,\n      }),\n    );\n    app.use(\n      \"/mcp\",\n      bearer({\n        verifier,\n        requiredScopes: config.requiredScopes,\n        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n      }),\n    );\n    return;\n  }\n\n  // No baseUrl: resolve the resource origin per request from forwarded headers\n  // (same precedence the framework uses for view serverUrl). Origin headers are\n  // pathless, so the PRM path stays at root, matching the SDK's static layout.\n  const resolveOrigin = (req: Request) =>\n    new URL(resolveServerOrigin((key) => req.get(key)));\n\n  app.use(\n    \"/.well-known/oauth-authorization-server\",\n    cors(),\n    (_req, res) => void res.json(config.oauthMetadata),\n  );\n  app.use(\"/.well-known/oauth-protected-resource\", cors(), (req, res) => {\n    res.json({\n      resource: resolveOrigin(req).href,\n      authorization_servers: [config.oauthMetadata.issuer],\n      scopes_supported: config.scopesSupported,\n    });\n  });\n  app.use(\"/mcp\", (req, res, next) =>\n    bearer({\n      verifier,\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(\n        resolveOrigin(req),\n      ),\n    })(req, res, next),\n  );\n}\n"]}

package/dist/server/auth/setup.test.js

@@ -1,210 +0,0 @@
-// @vitest-environment node
-import http from "node:http";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import * as jose from "jose";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { McpServer } from "../server.js";
-vi.mock("@skybridge/devtools", () => ({
-    devtoolsStaticServer: () => ((_req, _res, next) => next()),
-}));
-vi.mock("../viewsDevServer.js", () => ({
-    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
-}));
-const ISSUER = "https://issuer.test";
-const AUDIENCE = "api://default";
-let jwksServer;
-let appServer;
-afterEach(() => {
-    jwksServer?.close();
-    appServer?.close();
-});
-async function startJwks() {
-    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
-    const jwk = {
-        ...(await jose.exportJWK(publicKey)),
-        kid: "test-key",
-        alg: "RS256",
-        use: "sig",
-    };
-    const server = http.createServer((_req, res) => {
-        res.setHeader("content-type", "application/json");
-        res.end(JSON.stringify({ keys: [jwk] }));
-    });
-    await new Promise((resolve) => server.listen(0, resolve));
-    jwksServer = server;
-    const port = server.address().port;
-    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
-}
-function signToken(key) {
-    return new jose.SignJWT({
-        client_id: "client-1",
-        scope: "openid email",
-        sub: "user-1",
-    })
-        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
-        .setIssuer(ISSUER)
-        .setAudience(AUDIENCE)
-        .setExpirationTime("1h")
-        .sign(key);
-}
-async function bootServer(jwksUri, { baseUrl = "https://app.example.test", enforcement = "required", } = {}) {
-    const { createApp } = await import("../express.js");
-    const server = new McpServer({ name: "auth-test", version: "0.0.0" }, { capabilities: {} }, {
-        oauth: {
-            ...(baseUrl === null ? {} : { baseUrl }),
-            oauthMetadata: {
-                issuer: ISSUER,
-                authorization_endpoint: `${ISSUER}/authorize`,
-                token_endpoint: `${ISSUER}/token`,
-                response_types_supported: ["code"],
-            },
-            verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },
-            scopesSupported: ["openid", "email"],
-            requiredScopes: ["openid"],
-            enforcement,
-        },
-    }).registerTool({
-        name: "whoami",
-        description: "Returns the caller identity.",
-        inputSchema: {},
-    }, (_args, extra) => ({
-        structuredContent: { clientId: extra.authInfo?.clientId ?? null },
-        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
-    }));
-    const httpServer = http.createServer();
-    await createApp({ mcpServer: server, httpServer });
-    const listening = http.createServer(server.express);
-    await new Promise((resolve) => listening.listen(0, resolve));
-    appServer = listening;
-    const port = listening.address().port;
-    return `http://localhost:${port}`;
-}
-describe("setupOAuth wiring", () => {
-    it("serves protected-resource metadata", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri);
-        const res = await fetch(`${base}/.well-known/oauth-protected-resource`);
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.resource).toBe("https://app.example.test/");
-        expect(body.authorization_servers).toContain(ISSUER);
-        expect(body.scopes_supported).toEqual(["openid", "email"]);
-    });
-    it("rejects /mcp without a token (401 + WWW-Authenticate)", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri);
-        const res = await fetch(`${base}/mcp`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
-        });
-        expect(res.status).toBe(401);
-        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata=/);
-    });
-    it("threads authInfo into the tool handler for a valid token", async () => {
-        const { privateKey, jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri);
-        const token = await signToken(privateKey);
-        const client = new Client({ name: "test-client", version: "0.0.0" });
-        const transport = new StreamableHTTPClientTransport(new URL(`${base}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${token}` } } });
-        await client.connect(transport);
-        const result = (await client.callTool({
-            name: "whoami",
-            arguments: {},
-        }));
-        expect(result.content[0]?.text).toBe("client-1");
-        await client.close();
-    });
-});
-describe("baseUrl inferred from headers", () => {
-    it("derives the resource origin from x-forwarded-host", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri, { baseUrl: null });
-        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
-            headers: { "x-forwarded-host": "infer.example.test" },
-        });
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.resource).toBe("https://infer.example.test/");
-    });
-    it("uses the first hop of a forwarded-host chain", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri, { baseUrl: null });
-        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
-            headers: {
-                "x-forwarded-host": "public.example, internal.local",
-                "x-forwarded-proto": "https, http",
-            },
-        });
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.resource).toBe("https://public.example/");
-    });
-    it("falls back to Host when Origin is opaque (null)", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri, { baseUrl: null });
-        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
-            headers: { origin: "null" },
-        });
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.resource).toMatch(/^http:\/\/(localhost|127\.0\.0\.1):/);
-    });
-    it("points the 401 WWW-Authenticate at the inferred host", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri, { baseUrl: null });
-        const res = await fetch(`${base}/mcp`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "x-forwarded-host": "infer.example.test",
-            },
-            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
-        });
-        expect(res.status).toBe(401);
-        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata="https:\/\/infer\.example\.test\//);
-    });
-});
-describe("enforcement: optional", () => {
-    it("lets an anonymous /mcp request through", async () => {
-        const { jwksUri } = await startJwks();
-        const base = await bootServer(jwksUri, { enforcement: "optional" });
-        const res = await fetch(`${base}/mcp`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Accept: "application/json, text/event-stream",
-            },
-            body: JSON.stringify({
-                jsonrpc: "2.0",
-                method: "initialize",
-                id: 1,
-                params: {
-                    protocolVersion: "2025-06-18",
-                    capabilities: {},
-                    clientInfo: { name: "anon", version: "0.0.0" },
-                },
-            }),
-        });
-        expect(res.status).toBe(200);
-    });
-});
-describe("oauth config validation", () => {
-    const validMetadata = {
-        issuer: ISSUER,
-        authorization_endpoint: `${ISSUER}/authorize`,
-        token_endpoint: `${ISSUER}/token`,
-        response_types_supported: ["code"],
-    };
-    it("throws on a non-absolute baseUrl", () => {
-        expect(() => new McpServer({ name: "t", version: "0" }, undefined, {
-            oauth: {
-                baseUrl: "not-a-url",
-                oauthMetadata: validMetadata,
-                verify: { issuer: ISSUER, audience: AUDIENCE },
-            },
-        })).toThrow(/baseUrl must be a valid absolute URL/);
-    });
-});
-//# sourceMappingURL=setup.test.js.map

package/dist/server/auth/setup.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,cAAc;QACrB,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EACE,OAAO,GAAG,0BAA0B,EACpC,WAAW,GAAG,UAAU,MAItB,EAAE;IAEN,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvD,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,WAAW;SACZ;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE,gCAAgC;gBACpD,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,oBAAoB;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC/C;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC/C;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey) {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope: \"openid email\",\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  {\n    baseUrl = \"https://app.example.test\",\n    enforcement = \"required\",\n  }: {\n    baseUrl?: string | null;\n    enforcement?: \"required\" | \"optional\";\n  } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        ...(baseUrl === null ? {} : { baseUrl }),\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n        enforcement,\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"baseUrl inferred from headers\", () => {\n  it(\"derives the resource origin from x-forwarded-host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { \"x-forwarded-host\": \"infer.example.test\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://infer.example.test/\");\n  });\n\n  it(\"uses the first hop of a forwarded-host chain\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: {\n        \"x-forwarded-host\": \"public.example, internal.local\",\n        \"x-forwarded-proto\": \"https, http\",\n      },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://public.example/\");\n  });\n\n  it(\"falls back to Host when Origin is opaque (null)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { origin: \"null\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toMatch(/^http:\\/\\/(localhost|127\\.0\\.0\\.1):/);\n  });\n\n  it(\"points the 401 WWW-Authenticate at the inferred host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"x-forwarded-host\": \"infer.example.test\",\n      },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /resource_metadata=\"https:\\/\\/infer\\.example\\.test\\//,\n    );\n  });\n});\n\ndescribe(\"enforcement: optional\", () => {\n  it(\"lets an anonymous /mcp request through\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { enforcement: \"optional\" });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        method: \"initialize\",\n        id: 1,\n        params: {\n          protocolVersion: \"2025-06-18\",\n          capabilities: {},\n          clientInfo: { name: \"anon\", version: \"0.0.0\" },\n        },\n      }),\n    });\n    expect(res.status).toBe(200);\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verify: { issuer: ISSUER, audience: AUDIENCE },\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -1,11 +0,0 @@
-import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
-export type JwksVerifyConfig = {
-    /** Expected `iss` claim. */
-    issuer: string;
-    /** Expected `aud` claim. */
-    audience: string;
-    /** Defaults to `${issuer}/.well-known/jwks.json`. */
-    jwksUri?: string;
-};
-/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
-export declare function createJwksVerifier(config: JwksVerifyConfig): OAuthTokenVerifier;

package/dist/server/auth/verify.js

@@ -1,37 +0,0 @@
-import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import * as jose from "jose";
-/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
-export function createJwksVerifier(config) {
-    const jwksUri = config.jwksUri ??
-        `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
-    const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
-    return {
-        async verifyAccessToken(token) {
-            let payload;
-            try {
-                ({ payload } = await jose.jwtVerify(token, jwks, {
-                    issuer: config.issuer,
-                    audience: config.audience,
-                }));
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                throw new InvalidTokenError(`Token verification failed: ${message}`);
-            }
-            const { client_id, scope, exp, sub, ...rest } = payload;
-            const scopes = Array.isArray(scope)
-                ? scope.map(String)
-                : typeof scope === "string"
-                    ? scope.split(/\s+/).filter(Boolean)
-                    : [];
-            return {
-                token,
-                clientId: client_id ?? "",
-                scopes,
-                expiresAt: exp,
-                extra: { subject: sub, ...rest },
-            };
-        },
-    };
-}
-//# sourceMappingURL=verify.js.map

package/dist/server/auth/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAW7B,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;aACd,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport type { OAuthTokenVerifier } from \"@modelcontextprotocol/sdk/server/auth/provider.js\";\nimport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\nimport * as jose from \"jose\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. */\n  audience: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */\nexport function createJwksVerifier(\n  config: JwksVerifyConfig,\n): OAuthTokenVerifier {\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          audience: config.audience,\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        throw new InvalidTokenError(`Token verification failed: ${message}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest },\n      } satisfies AuthInfo;\n    },\n  };\n}\n"]}

package/dist/server/auth/verify.test.js

@@ -1,87 +0,0 @@
-// @vitest-environment node
-import http from "node:http";
-import * as jose from "jose";
-import { afterEach, describe, expect, it } from "vitest";
-import { createJwksVerifier } from "./verify.js";
-const ISSUER = "https://issuer.test";
-const AUDIENCE = "api://default";
-let jwksServer;
-afterEach(() => jwksServer?.close());
-async function startJwks() {
-    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
-    const jwk = {
-        ...(await jose.exportJWK(publicKey)),
-        kid: "test-key",
-        alg: "RS256",
-        use: "sig",
-    };
-    const server = http.createServer((_req, res) => {
-        res.setHeader("content-type", "application/json");
-        res.end(JSON.stringify({ keys: [jwk] }));
-    });
-    await new Promise((resolve) => server.listen(0, resolve));
-    jwksServer = server;
-    const port = server.address().port;
-    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
-}
-function sign(key, claims, opts = {}) {
-    return new jose.SignJWT(claims)
-        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
-        .setIssuer(opts.issuer ?? ISSUER)
-        .setAudience(opts.audience ?? AUDIENCE)
-        .setExpirationTime(opts.expiresAt ?? "1h")
-        .sign(key);
-}
-describe("createJwksVerifier", () => {
-    it("verifies a valid token and maps claims to AuthInfo", async () => {
-        const { privateKey, jwksUri } = await startJwks();
-        const verifier = createJwksVerifier({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri,
-        });
-        const token = await sign(privateKey, {
-            client_id: "client-1",
-            scope: "openid email",
-            sub: "user-1",
-            email: "a@b.test",
-        });
-        const auth = await verifier.verifyAccessToken(token);
-        expect(auth.token).toBe(token);
-        expect(auth.clientId).toBe("client-1");
-        expect(auth.scopes).toEqual(["openid", "email"]);
-        expect(auth.extra?.subject).toBe("user-1");
-        expect(auth.extra?.email).toBe("a@b.test");
-    });
-    it("rejects a token with the wrong audience", async () => {
-        const { privateKey, jwksUri } = await startJwks();
-        const verifier = createJwksVerifier({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri,
-        });
-        const token = await sign(privateKey, { client_id: "c" }, { audience: "api://other" });
-        await expect(verifier.verifyAccessToken(token)).rejects.toThrow(/Token verification failed/);
-    });
-    it("parses array scope claims and trims extra whitespace", async () => {
-        const { privateKey, jwksUri } = await startJwks();
-        const verifier = createJwksVerifier({
-            issuer: ISSUER,
-            audience: AUDIENCE,
-            jwksUri,
-        });
-        const arrayToken = await sign(privateKey, {
-            scope: ["openid", "email"],
-        });
-        expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([
-            "openid",
-            "email",
-        ]);
-        const messyToken = await sign(privateKey, { scope: " openid  email " });
-        expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([
-            "openid",
-            "email",
-        ]);
-    });
-});
-//# sourceMappingURL=verify.test.js.map

package/dist/server/auth/verify.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../../src/server/auth/verify.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,GAAc,EACd,MAA+B,EAC/B,OAAmE,EAAE;IAErE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;SAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;SACtC,iBAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,SAAS,EAAE,UAAU;YACrB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nafterEach(() => jwksServer?.close());\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction sign(\n  key: CryptoKey,\n  claims: Record<string, unknown>,\n  opts: { issuer?: string; audience?: string; expiresAt?: string } = {},\n) {\n  return new jose.SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(opts.issuer ?? ISSUER)\n    .setAudience(opts.audience ?? AUDIENCE)\n    .setExpirationTime(opts.expiresAt ?? \"1h\")\n    .sign(key);\n}\n\ndescribe(\"createJwksVerifier\", () => {\n  it(\"verifies a valid token and maps claims to AuthInfo\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(privateKey, {\n      client_id: \"client-1\",\n      scope: \"openid email\",\n      sub: \"user-1\",\n      email: \"a@b.test\",\n    });\n\n    const auth = await verifier.verifyAccessToken(token);\n\n    expect(auth.token).toBe(token);\n    expect(auth.clientId).toBe(\"client-1\");\n    expect(auth.scopes).toEqual([\"openid\", \"email\"]);\n    expect(auth.extra?.subject).toBe(\"user-1\");\n    expect(auth.extra?.email).toBe(\"a@b.test\");\n  });\n\n  it(\"rejects a token with the wrong audience\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"api://other\" },\n    );\n\n    await expect(verifier.verifyAccessToken(token)).rejects.toThrow(\n      /Token verification failed/,\n    );\n  });\n\n  it(\"parses array scope claims and trims extra whitespace\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n\n    const arrayToken = await sign(privateKey, {\n      scope: [\"openid\", \"email\"],\n    });\n    expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n\n    const messyToken = await sign(privateKey, { scope: \" openid  email \" });\n    expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n  });\n});\n"]}