skybridge 0.0.0-dev.9ad69ef → 0.0.0-dev.9addcf5

package/dist/server/register-tool.test.js

@@ -0,0 +1,110 @@
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { describe, expect, it } from "vitest";
+import { z } from "zod";
+import { Skybridge } from "./app.js";
+describe("registerTool handler invocation", () => {
+    it("passes empty args and a usable extra to a schema-less tool handler", async () => {
+        let received;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            handler: (server) => server.registerTool({ name: "no-input", description: "no-input" }, async (args, extra) => {
+                received = { args, extra };
+                return { content: [{ type: "text", text: "ok" }] };
+            }),
+        });
+        const instance = await app.createServerInstance();
+        const client = new Client({ name: "client", version: "1.0.0" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await instance.connect(serverTransport);
+        await client.connect(clientTransport);
+        await client.callTool({ name: "no-input" });
+        expect(received?.args).toEqual({});
+        expect(received?.extra).toHaveProperty("mcpReq.send");
+        await client.close();
+        await instance.close();
+    });
+    it("emits openai options as openai/ui metadata on the tool and its view", async () => {
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            handler: (server) => server.registerTool({
+                name: "library",
+                description: "library",
+                view: { component: "widget" },
+                openai: {
+                    entrypoints: [
+                        { type: "global" },
+                        { type: "file", extensions: [".stl"] },
+                    ],
+                    availableDisplayModes: ["inline", "fullscreen"],
+                    preferredDisplayMode: "fullscreen",
+                },
+            }, async () => ({ content: "ok" })),
+        });
+        const instance = await app.createServerInstance();
+        const client = new Client({ name: "client", version: "1.0.0" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await instance.connect(serverTransport);
+        await client.connect(clientTransport);
+        const { tools } = await client.listTools();
+        const { resources } = await client.listResources();
+        expect(tools[0]?._meta?.["openai/ui"]).toEqual({
+            entrypoints: [{ type: "global" }, { type: "file", extensions: [".stl"] }],
+        });
+        expect(resources[0]?._meta?.["openai/ui"]).toEqual({
+            availableDisplayModes: ["inline", "fullscreen"],
+            preferredDisplayMode: "fullscreen",
+        });
+        await client.close();
+        await instance.close();
+    });
+    it("rejects a global entrypoint on a tool that requires input", async () => {
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            handler: (server) => server.registerTool({
+                name: "search",
+                description: "search",
+                inputSchema: { query: z.string() },
+                view: { component: "widget" },
+                openai: { entrypoints: [{ type: "global" }] },
+            }, async () => ({ content: "ok" })),
+        });
+        await expect(app.createServerInstance()).rejects.toThrow(/rejects `\{\}`/);
+    });
+    it("registers mention search as an app-only tool advertising the extension", async () => {
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            handler: (server) => server.registerMentions({
+                name: "search_parts",
+                handler: async ({ query }) => ({
+                    items: [
+                        { type: "resource_link", uri: `parts://${query}`, name: query },
+                    ],
+                }),
+            }),
+        });
+        const instance = await app.createServerInstance();
+        const client = new Client({ name: "client", version: "1.0.0" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await instance.connect(serverTransport);
+        await client.connect(clientTransport);
+        const { tools } = await client.listTools();
+        expect(tools[0]?._meta).toMatchObject({
+            "openai/extensions": { "mentions/search": {} },
+            ui: { visibility: ["app"] },
+        });
+        const result = await client.callTool({
+            name: "search_parts",
+            arguments: { query: "bolt" },
+        });
+        expect(result.structuredContent).toEqual({
+            items: [{ type: "resource_link", uri: "parts://bolt", name: "bolt" }],
+        });
+        await client.close();
+        await instance.close();
+    });
+});
+//# sourceMappingURL=register-tool.test.js.map

package/dist/server/register-tool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-tool.test.js","sourceRoot":"","sources":["../../src/server/register-tool.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,IAAI,QAAuD,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,EAC7C,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBACpB,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,CAAC,CACF;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5C,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAEtD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CACjB;gBACE,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC7B,MAAM,EAAE;oBACN,WAAW,EAAE;wBACX,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAClB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;qBACvC;oBACD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;oBAC/C,oBAAoB,EAAE,YAAY;iBACnC;aACF,EACD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChC;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QAEnD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7C,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACjD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;YAC/C,oBAAoB,EAAE,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,YAAY,CACjB;gBACE,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,QAAQ;gBACrB,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC7B,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;aAC9C,EACD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChC;SACJ,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,gBAAgB,CAAC;gBACtB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC7B,KAAK,EAAE;wBACL,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;qBAChE;iBACF,CAAC;aACH,CAAC;SACL,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,CAAC;YACpC,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;YAC9C,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACvC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client, InMemoryTransport } from \"@modelcontextprotocol/client\";\nimport { describe, expect, it } from \"vitest\";\nimport { z } from \"zod\";\nimport { Skybridge } from \"./app.js\";\n\ndescribe(\"registerTool handler invocation\", () => {\n  it(\"passes empty args and a usable extra to a schema-less tool handler\", async () => {\n    let received: { args: unknown; extra: unknown } | undefined;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      handler: (server) =>\n        server.registerTool(\n          { name: \"no-input\", description: \"no-input\" },\n          async (args, extra) => {\n            received = { args, extra };\n            return { content: [{ type: \"text\", text: \"ok\" }] };\n          },\n        ),\n    });\n    const instance = await app.createServerInstance();\n\n    const client = new Client({ name: \"client\", version: \"1.0.0\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    await instance.connect(serverTransport);\n    await client.connect(clientTransport);\n\n    await client.callTool({ name: \"no-input\" });\n\n    expect(received?.args).toEqual({});\n    expect(received?.extra).toHaveProperty(\"mcpReq.send\");\n\n    await client.close();\n    await instance.close();\n  });\n\n  it(\"emits openai options as openai/ui metadata on the tool and its view\", async () => {\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      handler: (server) =>\n        server.registerTool(\n          {\n            name: \"library\",\n            description: \"library\",\n            view: { component: \"widget\" },\n            openai: {\n              entrypoints: [\n                { type: \"global\" },\n                { type: \"file\", extensions: [\".stl\"] },\n              ],\n              availableDisplayModes: [\"inline\", \"fullscreen\"],\n              preferredDisplayMode: \"fullscreen\",\n            },\n          },\n          async () => ({ content: \"ok\" }),\n        ),\n    });\n    const instance = await app.createServerInstance();\n    const client = new Client({ name: \"client\", version: \"1.0.0\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    await instance.connect(serverTransport);\n    await client.connect(clientTransport);\n\n    const { tools } = await client.listTools();\n    const { resources } = await client.listResources();\n\n    expect(tools[0]?._meta?.[\"openai/ui\"]).toEqual({\n      entrypoints: [{ type: \"global\" }, { type: \"file\", extensions: [\".stl\"] }],\n    });\n    expect(resources[0]?._meta?.[\"openai/ui\"]).toEqual({\n      availableDisplayModes: [\"inline\", \"fullscreen\"],\n      preferredDisplayMode: \"fullscreen\",\n    });\n\n    await client.close();\n    await instance.close();\n  });\n\n  it(\"rejects a global entrypoint on a tool that requires input\", async () => {\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      handler: (server) =>\n        server.registerTool(\n          {\n            name: \"search\",\n            description: \"search\",\n            inputSchema: { query: z.string() },\n            view: { component: \"widget\" },\n            openai: { entrypoints: [{ type: \"global\" }] },\n          },\n          async () => ({ content: \"ok\" }),\n        ),\n    });\n\n    await expect(app.createServerInstance()).rejects.toThrow(/rejects `\\{\\}`/);\n  });\n\n  it(\"registers mention search as an app-only tool advertising the extension\", async () => {\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      handler: (server) =>\n        server.registerMentions({\n          name: \"search_parts\",\n          handler: async ({ query }) => ({\n            items: [\n              { type: \"resource_link\", uri: `parts://${query}`, name: query },\n            ],\n          }),\n        }),\n    });\n    const instance = await app.createServerInstance();\n    const client = new Client({ name: \"client\", version: \"1.0.0\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    await instance.connect(serverTransport);\n    await client.connect(clientTransport);\n\n    const { tools } = await client.listTools();\n    expect(tools[0]?._meta).toMatchObject({\n      \"openai/extensions\": { \"mentions/search\": {} },\n      ui: { visibility: [\"app\"] },\n    });\n    const result = await client.callTool({\n      name: \"search_parts\",\n      arguments: { query: \"bolt\" },\n    });\n    expect(result.structuredContent).toEqual({\n      items: [{ type: \"resource_link\", uri: \"parts://bolt\", name: \"bolt\" }],\n    });\n\n    await client.close();\n    await instance.close();\n  });\n});\n"]}

package/dist/server/requestOrigin.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolves this server's public origin from request headers, in precedence
+ * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
+ * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:
+ * it carries the *caller's* site, not this server's.
+ */
+export declare function resolveServerOrigin(header: (key: string) => string | undefined): string;

package/dist/server/requestOrigin.js

@@ -0,0 +1,41 @@
+/**
+ * Resolves this server's public origin from request headers, in precedence
+ * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
+ * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:
+ * it carries the *caller's* site, not this server's.
+ */
+export function resolveServerOrigin(header) {
+    // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing
+    // hop is the first entry.
+    const firstHop = (value) => value?.split(",")[0]?.trim();
+    const forwardedHost = firstHop(header("x-forwarded-host"));
+    if (forwardedHost) {
+        const proto = firstHop(header("x-forwarded-proto")) ||
+            (isLoopbackHost(forwardedHost) ? "http" : "https");
+        return `${proto}://${forwardedHost}`;
+    }
+    const host = header("host");
+    if (host) {
+        const proto = isLoopbackHost(host) ? "http" : "https";
+        return `${proto}://${host}`;
+    }
+    return `http://localhost:${process.env.__PORT || "3000"}`;
+}
+/**
+ * Loopback names that are served over HTTP in local development.
+ * Includes bare `localhost` and any name ending in `.localhost` (RFC 6761 §6.3).
+ */
+function isLoopbackHost(host) {
+    let hostname;
+    try {
+        hostname = new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return false;
+    }
+    return (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1");
+}
+//# sourceMappingURL=requestOrigin.js.map

package/dist/server/requestOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestOrigin.js","sourceRoot":"","sources":["../../src/server/requestOrigin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2C;IAE3C,+EAA+E;IAC/E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Resolves this server's public origin from request headers, in precedence\n * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving\n * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:\n * it carries the *caller's* site, not this server's.\n */\nexport function resolveServerOrigin(\n  header: (key: string) => string | undefined,\n): string {\n  // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing\n  // hop is the first entry.\n  const firstHop = (value: string | undefined) => value?.split(\",\")[0]?.trim();\n  const forwardedHost = firstHop(header(\"x-forwarded-host\"));\n  if (forwardedHost) {\n    const proto =\n      firstHop(header(\"x-forwarded-proto\")) ||\n      (isLoopbackHost(forwardedHost) ? \"http\" : \"https\");\n    return `${proto}://${forwardedHost}`;\n  }\n  const host = header(\"host\");\n  if (host) {\n    const proto = isLoopbackHost(host) ? \"http\" : \"https\";\n    return `${proto}://${host}`;\n  }\n  return `http://localhost:${process.env.__PORT || \"3000\"}`;\n}\n\n/**\n * Loopback names that are served over HTTP in local development.\n * Includes bare `localhost` and any name ending in `.localhost` (RFC 6761 §6.3).\n */\nfunction isLoopbackHost(host: string): boolean {\n  let hostname: string;\n  try {\n    hostname = new URL(`http://${host}`).hostname;\n  } catch {\n    return false;\n  }\n  return (\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\") ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"::1\"\n  );\n}\n"]}

package/dist/server/requestOrigin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/requestOrigin.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { resolveServerOrigin } from "./requestOrigin.js";
+const headers = (map) => (key) => map[key];
+describe("resolveServerOrigin", () => {
+    it("uses http for loopback hosts, including *.localhost", () => {
+        expect(resolveServerOrigin(headers({ host: "localhost:3000" }))).toBe("http://localhost:3000");
+        expect(resolveServerOrigin(headers({ host: "127.0.0.1:3000" }))).toBe("http://127.0.0.1:3000");
+        expect(resolveServerOrigin(headers({ host: "[::1]:3000" }))).toBe("http://[::1]:3000");
+        expect(resolveServerOrigin(headers({ host: "chift.localhost:4000" }))).toBe("http://chift.localhost:4000");
+    });
+    it("uses https for public hosts", () => {
+        expect(resolveServerOrigin(headers({ host: "app.example.com" }))).toBe("https://app.example.com");
+        expect(resolveServerOrigin(headers({ host: "localhost.example.com:3000" }))).toBe("https://localhost.example.com:3000");
+    });
+    it("defaults a forwarded loopback host to http when proto is absent", () => {
+        expect(resolveServerOrigin(headers({ "x-forwarded-host": "chift.localhost:4000" }))).toBe("http://chift.localhost:4000");
+    });
+    it("keeps an explicit forwarded proto", () => {
+        expect(resolveServerOrigin(headers({
+            "x-forwarded-host": "chift.localhost:4000",
+            "x-forwarded-proto": "https",
+        }))).toBe("https://chift.localhost:4000");
+    });
+    it("falls back to the local dev origin when no host is present", () => {
+        expect(resolveServerOrigin(headers({}))).toBe("http://localhost:3000");
+    });
+});
+//# sourceMappingURL=requestOrigin.test.js.map

package/dist/server/requestOrigin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestOrigin.test.js","sourceRoot":"","sources":["../../src/server/requestOrigin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,OAAO,GACX,CAAC,GAA2B,EAAE,EAAE,CAChC,CAAC,GAAW,EAAsB,EAAE,CAClC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEb,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,uBAAuB,CACxB,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,uBAAuB,CACxB,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/D,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACzE,6BAA6B,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACpE,yBAAyB,CAC1B,CAAC;QACF,MAAM,CACJ,mBAAmB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CACJ,mBAAmB,CACjB,OAAO,CAAC,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,CAAC,CACxD,CACF,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CACJ,mBAAmB,CACjB,OAAO,CAAC;YACN,kBAAkB,EAAE,sBAAsB;YAC1C,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CACH,CACF,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { resolveServerOrigin } from \"./requestOrigin.js\";\n\nconst headers =\n  (map: Record<string, string>) =>\n  (key: string): string | undefined =>\n    map[key];\n\ndescribe(\"resolveServerOrigin\", () => {\n  it(\"uses http for loopback hosts, including *.localhost\", () => {\n    expect(resolveServerOrigin(headers({ host: \"localhost:3000\" }))).toBe(\n      \"http://localhost:3000\",\n    );\n    expect(resolveServerOrigin(headers({ host: \"127.0.0.1:3000\" }))).toBe(\n      \"http://127.0.0.1:3000\",\n    );\n    expect(resolveServerOrigin(headers({ host: \"[::1]:3000\" }))).toBe(\n      \"http://[::1]:3000\",\n    );\n    expect(resolveServerOrigin(headers({ host: \"chift.localhost:4000\" }))).toBe(\n      \"http://chift.localhost:4000\",\n    );\n  });\n\n  it(\"uses https for public hosts\", () => {\n    expect(resolveServerOrigin(headers({ host: \"app.example.com\" }))).toBe(\n      \"https://app.example.com\",\n    );\n    expect(\n      resolveServerOrigin(headers({ host: \"localhost.example.com:3000\" })),\n    ).toBe(\"https://localhost.example.com:3000\");\n  });\n\n  it(\"defaults a forwarded loopback host to http when proto is absent\", () => {\n    expect(\n      resolveServerOrigin(\n        headers({ \"x-forwarded-host\": \"chift.localhost:4000\" }),\n      ),\n    ).toBe(\"http://chift.localhost:4000\");\n  });\n\n  it(\"keeps an explicit forwarded proto\", () => {\n    expect(\n      resolveServerOrigin(\n        headers({\n          \"x-forwarded-host\": \"chift.localhost:4000\",\n          \"x-forwarded-proto\": \"https\",\n        }),\n      ),\n    ).toBe(\"https://chift.localhost:4000\");\n  });\n\n  it(\"falls back to the local dev origin when no host is present\", () => {\n    expect(resolveServerOrigin(headers({}))).toBe(\"http://localhost:3000\");\n  });\n});\n"]}