skybridge 0.0.0-dev.b0d461b → 0.0.0-dev.b0f7f92

package/dist/server/auth/index.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { JwksVerifyConfig } from "./verify.js";
+/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
+export type OAuthConfig = {
+    /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */
+    baseUrl: string;
+    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
+    oauthMetadata: OAuthMetadata;
+    verify: JwksVerifyConfig;
+    /** Scopes advertised in protected-resource metadata. */
+    scopesSupported?: string[];
+    /** Server-wide required-scope floor. */
+    requiredScopes?: string[];
+    /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */
+    enforcement?: "required" | "optional";
+};

package/dist/server/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */\n  baseUrl: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */\n  enforcement?: \"required\" | \"optional\";\n};\n"]}

package/dist/server/auth/setup.d.ts

@@ -0,0 +1,4 @@
+import type { Express } from "express";
+import type { OAuthConfig } from "./index.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export declare function setupOAuth(app: Express, config: OAuthConfig): void;

package/dist/server/auth/setup.js

@@ -0,0 +1,28 @@
+import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
+import { createJwksVerifier } from "./verify.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export function setupOAuth(app, config) {
+    let baseUrl;
+    try {
+        baseUrl = new URL(config.baseUrl);
+    }
+    catch {
+        throw new Error(`oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(config.baseUrl)}`);
+    }
+    if (!config.verify?.issuer || !config.verify?.audience) {
+        throw new Error("oauth.verify requires both `issuer` and `audience`");
+    }
+    app.use(mcpAuthMetadataRouter({
+        oauthMetadata: config.oauthMetadata,
+        resourceServerUrl: baseUrl,
+        scopesSupported: config.scopesSupported,
+    }));
+    const bearer = config.enforcement === "optional" ? optionalBearerAuth : requireBearerAuth;
+    app.use("/mcp", bearer({
+        verifier: createJwksVerifier(config.verify),
+        requiredScopes: config.requiredScopes,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
+    }));
+}
+//# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,OAAO;QAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GACV,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,MAAM,EACN,MAAM,CAAC;QACL,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;KACnE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport type { Express } from \"express\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  let baseUrl: URL;\n  try {\n    baseUrl = new URL(config.baseUrl);\n  } catch {\n    throw new Error(\n      `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n        config.baseUrl,\n      )}`,\n    );\n  }\n  if (!config.verify?.issuer || !config.verify?.audience) {\n    throw new Error(\"oauth.verify requires both `issuer` and `audience`\");\n  }\n\n  app.use(\n    mcpAuthMetadataRouter({\n      oauthMetadata: config.oauthMetadata,\n      resourceServerUrl: baseUrl,\n      scopesSupported: config.scopesSupported,\n    }),\n  );\n\n  const bearer =\n    config.enforcement === \"optional\" ? optionalBearerAuth : requireBearerAuth;\n  app.use(\n    \"/mcp\",\n    bearer({\n      verifier: createJwksVerifier(config.verify),\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n    }),\n  );\n}\n"]}

package/dist/server/auth/setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/setup.test.js

@@ -0,0 +1,161 @@
+// @vitest-environment node
+import http from "node:http";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import * as jose from "jose";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { McpServer } from "../server.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("../viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
+const ISSUER = "https://issuer.test";
+const AUDIENCE = "api://default";
+let jwksServer;
+let appServer;
+afterEach(() => {
+    jwksServer?.close();
+    appServer?.close();
+});
+async function startJwks() {
+    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
+    const jwk = {
+        ...(await jose.exportJWK(publicKey)),
+        kid: "test-key",
+        alg: "RS256",
+        use: "sig",
+    };
+    const server = http.createServer((_req, res) => {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ keys: [jwk] }));
+    });
+    await new Promise((resolve) => server.listen(0, resolve));
+    jwksServer = server;
+    const port = server.address().port;
+    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
+}
+function signToken(key) {
+    return new jose.SignJWT({
+        client_id: "client-1",
+        scope: "openid email",
+        sub: "user-1",
+    })
+        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+        .setIssuer(ISSUER)
+        .setAudience(AUDIENCE)
+        .setExpirationTime("1h")
+        .sign(key);
+}
+async function bootServer(jwksUri, { baseUrl = "https://app.example.test", enforcement = "required", } = {}) {
+    const { createApp } = await import("../express.js");
+    const server = new McpServer({ name: "auth-test", version: "0.0.0" }, { capabilities: {} }, {
+        oauth: {
+            baseUrl,
+            oauthMetadata: {
+                issuer: ISSUER,
+                authorization_endpoint: `${ISSUER}/authorize`,
+                token_endpoint: `${ISSUER}/token`,
+                response_types_supported: ["code"],
+            },
+            verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },
+            scopesSupported: ["openid", "email"],
+            requiredScopes: ["openid"],
+            enforcement,
+        },
+    }).registerTool({
+        name: "whoami",
+        description: "Returns the caller identity.",
+        inputSchema: {},
+    }, (_args, extra) => ({
+        structuredContent: { clientId: extra.authInfo?.clientId ?? null },
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }));
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    appServer = listening;
+    const port = listening.address().port;
+    return `http://localhost:${port}`;
+}
+describe("setupOAuth wiring", () => {
+    it("serves protected-resource metadata", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`);
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toBe("https://app.example.test/");
+        expect(body.authorization_servers).toContain(ISSUER);
+        expect(body.scopes_supported).toEqual(["openid", "email"]);
+    });
+    it("rejects /mcp without a token (401 + WWW-Authenticate)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata=/);
+    });
+    it("threads authInfo into the tool handler for a valid token", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const token = await signToken(privateKey);
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        const transport = new StreamableHTTPClientTransport(new URL(`${base}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${token}` } } });
+        await client.connect(transport);
+        const result = (await client.callTool({
+            name: "whoami",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("client-1");
+        await client.close();
+    });
+});
+describe("enforcement: optional", () => {
+    it("lets an anonymous /mcp request through", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { enforcement: "optional" });
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                method: "initialize",
+                id: 1,
+                params: {
+                    protocolVersion: "2025-06-18",
+                    capabilities: {},
+                    clientInfo: { name: "anon", version: "0.0.0" },
+                },
+            }),
+        });
+        expect(res.status).toBe(200);
+    });
+});
+describe("oauth config validation", () => {
+    const validMetadata = {
+        issuer: ISSUER,
+        authorization_endpoint: `${ISSUER}/authorize`,
+        token_endpoint: `${ISSUER}/token`,
+        response_types_supported: ["code"],
+    };
+    it("throws on a non-absolute baseUrl", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }, undefined, {
+            oauth: {
+                baseUrl: "not-a-url",
+                oauthMetadata: validMetadata,
+                verify: { issuer: ISSUER, audience: AUDIENCE },
+            },
+        })).toThrow(/baseUrl must be a valid absolute URL/);
+    });
+});
+//# sourceMappingURL=setup.test.js.map

package/dist/server/auth/setup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,cAAc;QACrB,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EACE,OAAO,GAAG,0BAA0B,EACpC,WAAW,GAAG,UAAU,MACuC,EAAE;IAEnE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO;YACP,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvD,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,WAAW;SACZ;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC/C;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC/C;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey) {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope: \"openid email\",\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  {\n    baseUrl = \"https://app.example.test\",\n    enforcement = \"required\",\n  }: { baseUrl?: string; enforcement?: \"required\" | \"optional\" } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl,\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n        enforcement,\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"enforcement: optional\", () => {\n  it(\"lets an anonymous /mcp request through\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { enforcement: \"optional\" });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        method: \"initialize\",\n        id: 1,\n        params: {\n          protocolVersion: \"2025-06-18\",\n          capabilities: {},\n          clientInfo: { name: \"anon\", version: \"0.0.0\" },\n        },\n      }),\n    });\n    expect(res.status).toBe(200);\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verify: { issuer: ISSUER, audience: AUDIENCE },\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+export type JwksVerifyConfig = {
+    /** Expected `iss` claim. */
+    issuer: string;
+    /** Expected `aud` claim. */
+    audience: string;
+    /** Defaults to `${issuer}/.well-known/jwks.json`. */
+    jwksUri?: string;
+};
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export declare function createJwksVerifier(config: JwksVerifyConfig): OAuthTokenVerifier;

package/dist/server/auth/verify.js

@@ -0,0 +1,37 @@
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import * as jose from "jose";
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export function createJwksVerifier(config) {
+    const jwksUri = config.jwksUri ??
+        `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    return {
+        async verifyAccessToken(token) {
+            let payload;
+            try {
+                ({ payload } = await jose.jwtVerify(token, jwks, {
+                    issuer: config.issuer,
+                    audience: config.audience,
+                }));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                throw new InvalidTokenError(`Token verification failed: ${message}`);
+            }
+            const { client_id, scope, exp, sub, ...rest } = payload;
+            const scopes = Array.isArray(scope)
+                ? scope.map(String)
+                : typeof scope === "string"
+                    ? scope.split(/\s+/).filter(Boolean)
+                    : [];
+            return {
+                token,
+                clientId: client_id ?? "",
+                scopes,
+                expiresAt: exp,
+                extra: { subject: sub, ...rest },
+            };
+        },
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/server/auth/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAW7B,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;aACd,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport type { OAuthTokenVerifier } from \"@modelcontextprotocol/sdk/server/auth/provider.js\";\nimport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\nimport * as jose from \"jose\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. */\n  audience: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */\nexport function createJwksVerifier(\n  config: JwksVerifyConfig,\n): OAuthTokenVerifier {\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          audience: config.audience,\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        throw new InvalidTokenError(`Token verification failed: ${message}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest },\n      } satisfies AuthInfo;\n    },\n  };\n}\n"]}

package/dist/server/auth/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/verify.test.js

@@ -0,0 +1,87 @@
+// @vitest-environment node
+import http from "node:http";
+import * as jose from "jose";
+import { afterEach, describe, expect, it } from "vitest";
+import { createJwksVerifier } from "./verify.js";
+const ISSUER = "https://issuer.test";
+const AUDIENCE = "api://default";
+let jwksServer;
+afterEach(() => jwksServer?.close());
+async function startJwks() {
+    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
+    const jwk = {
+        ...(await jose.exportJWK(publicKey)),
+        kid: "test-key",
+        alg: "RS256",
+        use: "sig",
+    };
+    const server = http.createServer((_req, res) => {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ keys: [jwk] }));
+    });
+    await new Promise((resolve) => server.listen(0, resolve));
+    jwksServer = server;
+    const port = server.address().port;
+    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
+}
+function sign(key, claims, opts = {}) {
+    return new jose.SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+        .setIssuer(opts.issuer ?? ISSUER)
+        .setAudience(opts.audience ?? AUDIENCE)
+        .setExpirationTime(opts.expiresAt ?? "1h")
+        .sign(key);
+}
+describe("createJwksVerifier", () => {
+    it("verifies a valid token and maps claims to AuthInfo", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const token = await sign(privateKey, {
+            client_id: "client-1",
+            scope: "openid email",
+            sub: "user-1",
+            email: "a@b.test",
+        });
+        const auth = await verifier.verifyAccessToken(token);
+        expect(auth.token).toBe(token);
+        expect(auth.clientId).toBe("client-1");
+        expect(auth.scopes).toEqual(["openid", "email"]);
+        expect(auth.extra?.subject).toBe("user-1");
+        expect(auth.extra?.email).toBe("a@b.test");
+    });
+    it("rejects a token with the wrong audience", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const token = await sign(privateKey, { client_id: "c" }, { audience: "api://other" });
+        await expect(verifier.verifyAccessToken(token)).rejects.toThrow(/Token verification failed/);
+    });
+    it("parses array scope claims and trims extra whitespace", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const arrayToken = await sign(privateKey, {
+            scope: ["openid", "email"],
+        });
+        expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([
+            "openid",
+            "email",
+        ]);
+        const messyToken = await sign(privateKey, { scope: " openid  email " });
+        expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([
+            "openid",
+            "email",
+        ]);
+    });
+});
+//# sourceMappingURL=verify.test.js.map

package/dist/server/auth/verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../../src/server/auth/verify.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,GAAc,EACd,MAA+B,EAC/B,OAAmE,EAAE;IAErE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;SAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;SACtC,iBAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,SAAS,EAAE,UAAU;YACrB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nafterEach(() => jwksServer?.close());\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction sign(\n  key: CryptoKey,\n  claims: Record<string, unknown>,\n  opts: { issuer?: string; audience?: string; expiresAt?: string } = {},\n) {\n  return new jose.SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(opts.issuer ?? ISSUER)\n    .setAudience(opts.audience ?? AUDIENCE)\n    .setExpirationTime(opts.expiresAt ?? \"1h\")\n    .sign(key);\n}\n\ndescribe(\"createJwksVerifier\", () => {\n  it(\"verifies a valid token and maps claims to AuthInfo\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(privateKey, {\n      client_id: \"client-1\",\n      scope: \"openid email\",\n      sub: \"user-1\",\n      email: \"a@b.test\",\n    });\n\n    const auth = await verifier.verifyAccessToken(token);\n\n    expect(auth.token).toBe(token);\n    expect(auth.clientId).toBe(\"client-1\");\n    expect(auth.scopes).toEqual([\"openid\", \"email\"]);\n    expect(auth.extra?.subject).toBe(\"user-1\");\n    expect(auth.extra?.email).toBe(\"a@b.test\");\n  });\n\n  it(\"rejects a token with the wrong audience\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"api://other\" },\n    );\n\n    await expect(verifier.verifyAccessToken(token)).rejects.toThrow(\n      /Token verification failed/,\n    );\n  });\n\n  it(\"parses array scope claims and trims extra whitespace\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n\n    const arrayToken = await sign(privateKey, {\n      scope: [\"openid\", \"email\"],\n    });\n    expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n\n    const messyToken = await sign(privateKey, { scope: \" openid  email \" });\n    expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n  });\n});\n"]}

package/dist/server/index.d.ts

@@ -1,3 +1,4 @@
+export type { OAuthConfig } from "./auth/index.js";
 export { type AuthInfo, type AuthMetadataOptions, type BearerAuthMiddlewareOptions, InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
 export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
 export { FileRef } from "./file-ref.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAiCxC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  type AuthInfo,\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  InvalidTokenError,\n  mcpAuthMetadataRouter,\n  optionalBearerAuth,\n  requireBearerAuth,\n} from \"./auth.js\";\nexport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  JsonOptions,\n  KnownToolMeta,\n  McpServerTypes,\n  SecurityScheme,\n  SkybridgeServerOptions,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  __setBuildManifest,\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAiCxC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export type { OAuthConfig } from \"./auth/index.js\";\nexport {\n  type AuthInfo,\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  InvalidTokenError,\n  mcpAuthMetadataRouter,\n  optionalBearerAuth,\n  requireBearerAuth,\n} from \"./auth.js\";\nexport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  JsonOptions,\n  KnownToolMeta,\n  McpServerTypes,\n  SecurityScheme,\n  SkybridgeServerOptions,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  __setBuildManifest,\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}

package/dist/server/server.d.ts

@@ -5,6 +5,7 @@ import type { AnySchema, SchemaOutput, ZodRawShapeCompat } from "@modelcontextpr
 import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
 import type { ContentBlock, Implementation, RequestMeta, ServerNotification, ServerRequest, ServerResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import express, { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import type { OAuthConfig } from "./auth/index.js";
 import type { McpExtra, McpExtraFor, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard } from "./middleware.js";
 /**
  * Type marker for a registered tool — carries its input, output, and response
@@ -81,6 +82,8 @@ export type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;
 export interface SkybridgeServerOptions {
     /** Options for the built-in `express.json()` middleware, e.g. `{ limit: "10mb" }`. */
     json?: JsonOptions;
+    /** Resource-server OAuth config. When set, mounts well-known metadata and bearer auth on `/mcp`. */
+    oauth?: OAuthConfig;
 }
 /**
  * Well-known keys recognized by host runtimes when set on a tool's `_meta`.
@@ -240,6 +243,13 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
     private mcpMiddlewareApplied;
     private claimedViews;
     private viewMetaBuilders;
+    /**
+     * Maps a view resource's query-less path to its canonical registered URI
+     * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the
+     * underlying view no matter which version param the consumer sends, since
+     * the param is only a cache key, not part of the resource's identity.
+     */
+    private viewUriByPath;
     private viteManifest;
     private readonly serverInfo;
     private readonly serverOptions?;

package/dist/server/server.js

@@ -6,6 +6,7 @@ import { Server as SdkServer, } from "@modelcontextprotocol/sdk/server/index.js"
 import { McpServer as McpServerBase } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { mergeWith, union } from "es-toolkit";
 import express, {} from "express";
+import { setupOAuth } from "./auth/setup.js";
 import { createApp } from "./express.js";
 import { createMiddlewareEntry } from "./metric.js";
 import { buildMiddlewareChain, getHandlerMaps } from "./middleware.js";
@@ -17,6 +18,15 @@ const mergeWithUnion = (target, source) => {
         }
     });
 };
+/**
+ * Drop the query string from a `ui://` view URI, leaving the bare path. The
+ * `?v=` cache key is the only query we append, so a plain split is enough and
+ * sidesteps `URL` normalization quirks on the non-special `ui:` scheme.
+ */
+function stripQuery(uri) {
+    const queryIndex = uri.indexOf("?");
+    return queryIndex === -1 ? uri : uri.slice(0, queryIndex);
+}
 /**
  * Coerce a tool handler's return value into an MCP `content` array. Strings
  * become a single `TextContent`; a single block is wrapped in an array;
@@ -102,6 +112,13 @@ export class McpServer extends McpServerBaseOmitted {
     mcpMiddlewareApplied = false;
     claimedViews = new Map();
     viewMetaBuilders = new Map();
+    /**
+     * Maps a view resource's query-less path to its canonical registered URI
+     * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the
+     * underlying view no matter which version param the consumer sends, since
+     * the param is only a cache key, not part of the resource's identity.
+     */
+    viewUriByPath = new Map();
     viteManifest = null;
     serverInfo;
     serverOptions;
@@ -111,6 +128,9 @@ export class McpServer extends McpServerBaseOmitted {
         this.serverOptions = options;
         this.express = express();
         this.express.use(express.json(skybridgeOptions?.json));
+        if (skybridgeOptions?.oauth) {
+            setupOAuth(this.express, skybridgeOptions.oauth);
+        }
         // Pick up the manifest if `dist/__entry.js` primed it before importing
         // user code. Consume-once: clear after the first construction so a
         // subsequent test that doesn't prime can't inherit stale state.
@@ -192,10 +212,47 @@ export class McpServer extends McpServerBaseOmitted {
                 return result;
             },
         };
+        // Resolve a view's `resources/read` by its query-less path so the
+        // underlying asset is served no matter the `?v=` value (stale cache key,
+        // no param, etc.). The version param is a cache-busting hint for external
+        // consumers; it must not gate resolution. We rewrite the lookup URI to the
+        // canonical registered one, then restore the requested URI on the response
+        // so the consumer-facing URI is never rewritten.
+        const viewReadResolveEntry = {
+            filter: "resources/read",
+            handler: async (req, _extra, next) => {
+                const requested = req.params.uri;
+                if (typeof requested !== "string") {
+                    return next();
+                }
+                const path = stripQuery(requested);
+                const canonical = this.viewUriByPath.get(path);
+                if (!canonical) {
+                    return next();
+                }
+                req.params.uri = canonical;
+                try {
+                    const result = (await next());
+                    for (const content of result.contents ?? []) {
+                        if (typeof content.uri === "string" &&
+                            stripQuery(content.uri) === path) {
+                            content.uri = requested;
+                        }
+                    }
+                    return result;
+                }
+                finally {
+                    // Restore the shared request params so middleware outer to us never
+                    // observes the rewritten lookup URI after next() unwinds.
+                    req.params.uri = requested;
+                }
+            },
+        };
         const monitoringEntry = createMiddlewareEntry();
         const entries = [
             ...(monitoringEntry ? [monitoringEntry] : []),
             viewListMetaEntry,
+            viewReadResolveEntry,
             ...this.mcpMiddlewareEntries,
         ];
         if (entries.length === 0) {
@@ -486,6 +543,7 @@ export class McpServer extends McpServerBaseOmitted {
             }, contentMetaOverrides);
         };
         this.viewMetaBuilders.set(viewUri, buildMeta);
+        this.viewUriByPath.set(stripQuery(viewUri), viewUri);
         this.registerResource(name, viewUri, { description: view.description }, async (uri, extra) => {
             const isProduction = process.env.NODE_ENV === "production";
             const { serverUrl } = this.resolveViewRequestContext(extra);

package/dist/server/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EACL,MAAM,IAAI,SAAS,GAEpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAgBrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,OAAO,EAAE,EAIf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAYpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,cAAc,GAAG,CACrB,MAAS,EACT,MAAS,EACF,EAAE;IACT,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAuUF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAOD,MAAM,oBAAoB,GAAG,aAEJ,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AACjD,IAAI,oBAAoB,GAA4C,IAAI,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA0C;IAE1C,oBAAoB,GAAG,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,SAEX,SAAQ,oBAAoB;IAE5B;;;;;;;;;;;;;OAaG;IACM,OAAO,CAAU;IAClB,qBAAqB,GAA4B,EAAE,CAAC;IACpD,oBAAoB,GAAyB,EAAE,CAAC;IAChD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,gBAAgB,GAAG,IAAI,GAAG,EAG/B,CAAC;IACI,YAAY,GAA6C,IAAI,CAAC;IACrD,UAAU,CAAiB;IAC3B,aAAa,CAAiB;IAE/C,YACE,UAA0B,EAC1B,OAAuB,EACvB,gBAAyC;QAEzC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,uEAAuE;QACvE,mEAAmE;QACnE,gEAAgE;QAChE,uEAAuE;QACvE,gBAAgB;QAChB,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;YAC3C,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAYD,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAgDD,aAAa,CACX,eAAsD;IACtD,uIAAuI;IACvI,YAAkB;QAElB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAA2C,CAAC;QAE5D,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,eAAe;gBACvB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAEjC,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,iBAAiB,GAAuB;YAC5C,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAE3B,CAAC;gBACF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACxD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,QAAQ,CAAC,KAAK,GAAG;wBACf,GAAG,CAAE,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAC;wBACtD,GAAG,IAAI;qBACR,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC;QAEF,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,iBAAiB;YACjB,GAAG,IAAI,CAAC,oBAAoB;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAGd,CAAC;QACF,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC;QAC1C,MAAM,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAEpD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG;QAGP,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,6DAA6D;YAC7D,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,UAAU;gBACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEvC,MAAM,SAAS,CAAC;YACd,SAAS,EAAE,IAAI;YACf,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;SAC5C,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,8BAA8B,YAAY,YAAY,QAAQ,gEAAgE,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,yBAAyB,CAAC,KAA2B;QAK3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC;QAExD,IAAI,SAAiB,CAAC;QACtB,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC;YACrD,SAAS,GAAG,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;QAC5C,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC;YACZ,SAAS,GAAG,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;YAC7C,SAAS,GAAG,oBAAoB,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,oBAAoB,GAAwB,EAAE,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YACzD,MAAM,MAAM,GACV,MAAM,CAAC,uBAAuB,CAAC,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC/D,oEAAoE;YACpE,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,oBAAoB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,uBAAuB,EAAE,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IAC7D,CAAC;IAEO,qBAAqB,CAC3B,QAAgB,EAChB,IAAgB,EAChB,QAA0B;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,CAAC,UAAU,EAAE,SAAS,CAAW,CAAC;QAE/D,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,YAAY,GAA2C;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,qBAAqB;gBAC/B,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAC3C,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAuB;wBACnC,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,eAAe;4BACjC,eAAe,EAAE,cAAc;yBAChC;wBACD,qBAAqB,EAAE,MAAM;wBAC7B,0BAA0B,EAAE,IAAI,CAAC,WAAW;qBAC7C,CAAC;oBAEF,MAAM,QAAQ,GAOV;wBACF,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;4BAC3C,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc;4BACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;4BACrC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;yBAC5C;wBACD,qBAAqB,EAAE,IAAI,CAAC,MAAM;wBAClC,4BAA4B,EAAE,IAAI,CAAC,aAAa;qBACjD,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,qBAAqB,EAAE,SAAS,CAAC,MAAM;qBACxC,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAwB,CAAC;oBAC1D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,QAAQ,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,YAAY,GAA4C;gBAC5D,QAAQ,EAAE,SAAS;gBACnB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,2BAA2B;gBACrC,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,EAC3D,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,eAAe;gCACf,cAAc;gCACd,cAAc;6BACf;4BACD,MAAM;yBACP;qBACF,CAAC;oBAEF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;4BAC1D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gCACtC,aAAa,EAAE,IAAI,CAAC,aAAa;6BAClC,CAAC;4BACF,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;4BAC3C,GAAG,EAAE;gCACH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI;oCAC5B,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;iCACpC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;6BACH;yBACF;qBACF,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAyB,CAAC;oBAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,iGAAiG;YACjG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;YAE9C,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,EAC3B,IAAI,EACJ,YAAY,EACZ,IAAI,GAKL;QACC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE5E,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAgB,EAAE;YAC9D,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,GACvD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,gBAAgB,CACrB;gBACE,eAAe,EAAE,CAAC,SAAS,CAAC;gBAC5B,cAAc;gBACd,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,CAAC,SAAS,CAAC;aAC5B,EACD,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9C,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,OAAO,EACP,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACjC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,YAAY;gBACvB,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBAC9B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;iBAClD,CAAC;gBACJ,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC/B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,SAAS;iBACzB,CAAC,CAAC;YAEP,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;iBACjE;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,EAA0B,EAC1B,EAAE,cAAc,EAA+B;QAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzC,GAAG,CAAC,cAAc,IAAI;oBACpB,KAAK,EAAE;wBACL,GAAI,MAA8C,CAAC,KAAK;wBACxD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;qBAC9B;iBACF,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAAgB;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACf,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,mGAAmG,QAAQ,uCAAuC,CACpK,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAA0C;QACxD,IAAI,CAAC,YAAY,GAAG,QAA6C,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EACpE,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAiDD,YAAY,CAAC,GAAG,IAAe;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,YAE3B,CAAC;QAEb,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAmC,CAAC;QAErD,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,eAAe,EACf,KAAK,EAAE,YAAY,EACnB,GAAG,UAAU,EACd,GAAG,MAAM,CAAC;QAEX,MAAM,QAAQ,GAAqB,EAAE,GAAG,YAAY,EAAE,CAAC;QAEvD,IAAI,eAAe,EAAE,CAAC;YACpB,+DAA+D;YAC/D,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,uDAAuD;YACvD,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import crypto from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport http from \"node:http\";\nimport path from \"node:path\";\nimport type {\n  McpUiResourceMeta,\n  McpUiToolMeta,\n} from \"@modelcontextprotocol/ext-apps\";\nimport {\n  Server as SdkServer,\n  type ServerOptions,\n} from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { McpServer as McpServerBase } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  AnySchema,\n  SchemaOutput,\n  ZodRawShapeCompat,\n} from \"@modelcontextprotocol/sdk/server/zod-compat.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  ContentBlock,\n  Implementation,\n  RequestMeta,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n  ToolAnnotations,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { mergeWith, union } from \"es-toolkit\";\nimport express, {\n  type ErrorRequestHandler,\n  type Express,\n  type RequestHandler,\n} from \"express\";\nimport { createApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type {\n  McpExtra,\n  McpExtraFor,\n  McpMethodString,\n  McpMiddlewareEntry,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport { templateHelper } from \"./templateHelper.js\";\n\nconst mergeWithUnion = <T extends object, S extends object>(\n  target: T,\n  source: S,\n): T & S => {\n  return mergeWith(target, source, (targetVal, sourceVal) => {\n    if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {\n      return union(targetVal, sourceVal);\n    }\n  });\n};\n\n/**\n * Type marker for a registered tool — carries its input, output, and response\n * metadata shapes so views can infer types from `typeof server`.\n *\n * You normally never construct this by hand; it is produced by `registerTool`\n * and consumed by helpers like {@link InferTools} and {@link generateHelpers}.\n */\nexport type ToolDef<\n  TInput = unknown,\n  TOutput = unknown,\n  TResponseMetadata = unknown,\n> = {\n  input: TInput;\n  output: TOutput;\n  responseMetadata: TResponseMetadata;\n};\n\n/** Which host runtime a view targets — `\"apps-sdk\"` (ChatGPT) or `\"mcp-app\"` (MCP Apps spec). */\nexport type ViewHostType = \"apps-sdk\" | \"mcp-app\";\n\n/**\n * Content Security Policy origins attached to a view's resource. Each list is\n * passed through to the host's CSP for the view iframe; omit a field to inherit\n * the host's default for that directive.\n */\nexport interface ViewCsp {\n  /** Origins for static assets (images, fonts, scripts, styles). */\n  resourceDomains?: string[];\n  /** Origins the view may contact via fetch/XHR. */\n  connectDomains?: string[];\n  /** Origins allowed for iframe embeds (opts into stricter app review). */\n  frameDomains?: string[];\n  /** Origins that can receive openExternal redirects without the safe-link modal. */\n  redirectDomains?: string[];\n  /** Origins allowed in `<base href>` tags (mcp-apps only). */\n  baseUriDomains?: string[];\n}\n\n/**\n * Registry of view component names. The Skybridge Vite plugin augments this\n * interface in the generated `.skybridge/views.d.ts` with one key per view\n * file, which narrows {@link ViewName} from `string` to the concrete union.\n */\n// Must be exported: TS module augmentation only merges with exported\n// declarations. Without `export`, `.skybridge/views.d.ts` augmentation\n// would create a separate interface and `ViewName` would stay `string`.\n// biome-ignore lint/suspicious/noEmptyInterface: register pattern — augmented by `.skybridge/views.d.ts` to narrow ViewName\nexport interface ViewNameRegistry {}\n\n/** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */\nexport type ViewName = keyof ViewNameRegistry & string;\n\n/**\n * Pass under `view` in a tool's `registerTool` config to render the tool's\n * result through a Skybridge view instead of a plain text response.\n */\nexport interface ViewConfig {\n  /** Filename of the view module (without extension) — matches a file in your `viewsDir`. */\n  component: ViewName;\n  /** Human-readable label the host may show alongside the view. */\n  description?: string;\n  /** Restrict where the view is rendered. Defaults to all known hosts. */\n  hosts?: ViewHostType[];\n  /** Apps SDK only: request a visible border around the widget. */\n  prefersBorder?: boolean;\n  /** Apps SDK only: override the iframe's served domain (advanced). */\n  domain?: string;\n  /** Per-view CSP overrides — see {@link ViewCsp}. */\n  csp?: ViewCsp;\n  /** Free-form metadata forwarded on the view resource's `_meta`. */\n  _meta?: Record<string, unknown>;\n}\n\nexport type SecurityScheme =\n  | { type: \"noauth\" }\n  | { type: \"oauth2\"; scopes?: string[] };\n\n/**\n * Options forwarded to the built-in `express.json()` body parser. Derived\n * from Express's own types so the public API doesn't depend on `body-parser`.\n */\nexport type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;\n\n/** Skybridge-specific server options, passed as the third `McpServer` constructor argument. */\nexport interface SkybridgeServerOptions {\n  /** Options for the built-in `express.json()` middleware, e.g. `{ limit: \"10mb\" }`. */\n  json?: JsonOptions;\n}\n\n/**\n * Well-known keys recognized by host runtimes when set on a tool's `_meta`.\n * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.\n *\n * @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters\n */\nexport interface KnownToolMeta {\n  /** Apps SDK: allow the rendered view to call this tool from inside its iframe. */\n  \"openai/widgetAccessible\"?: boolean;\n  /** Apps SDK: status text shown while the tool is running (e.g. `\"Searching trips\"`). */\n  \"openai/toolInvocation/invoking\"?: string;\n  /** Apps SDK: status text shown once the tool returns (e.g. `\"Found 3 trips\"`). */\n  \"openai/toolInvocation/invoked\"?: string;\n  /** Apps SDK: input parameters that hold file references — the host attaches uploaded files to them. */\n  \"openai/fileParams\"?: string[];\n  /** MCP Apps: control whether the tool is exposed to the model, the app, or both. */\n  ui?: Pick<McpUiToolMeta, \"visibility\">;\n  securitySchemes?: SecurityScheme[];\n}\n\n/** {@link KnownToolMeta} merged with arbitrary string-keyed metadata for custom flags. */\nexport type ToolMeta = KnownToolMeta & Record<string, unknown>;\n\n/**\n * Convenient return type for tool handlers — a plain string, a single\n * {@link ContentBlock}, or an array. Skybridge normalizes it to the MCP\n * `content: ContentBlock[]` shape before responding.\n */\nexport type HandlerContent = string | ContentBlock | ContentBlock[];\n\n/** @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters */\ntype ViteManifestEntry = {\n  file: string;\n  name?: string;\n  src?: string;\n  isEntry?: boolean;\n  isDynamicEntry?: boolean;\n  css?: string[];\n  assets?: string[];\n  imports?: string[];\n  dynamicImports?: string[];\n};\n\ntype OpenaiToolMeta = {\n  \"openai/outputTemplate\": string;\n  \"openai/widgetAccessible\"?: boolean;\n  \"openai/toolInvocation/invoking\"?: string;\n  \"openai/toolInvocation/invoked\"?: string;\n  \"openai/fileParams\"?: string[];\n};\n\n/** @see https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx#resource-discovery */\ntype McpAppsToolMeta = {\n  ui: McpUiToolMeta;\n};\n\ntype SecuritySchemesToolMeta = {\n  securitySchemes: SecurityScheme[];\n};\n\ntype InternalToolMeta = Partial<\n  OpenaiToolMeta & McpAppsToolMeta & SecuritySchemesToolMeta\n>;\n\n/** @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields */\ntype OpenaiViewCSP = {\n  connect_domains: string[];\n  resource_domains: string[];\n  frame_domains?: string[];\n  redirect_domains?: string[];\n};\n\ntype OpenaiResourceMeta = {\n  \"openai/widgetDescription\"?: string;\n  \"openai/widgetPrefersBorder\"?: boolean;\n  \"openai/widgetCSP\"?: OpenaiViewCSP;\n  \"openai/widgetDomain\"?: string;\n};\n\n/**\n * MCP Apps CSP extended with upcoming / Skybridge-specific fields.\n * @see https://github.com/modelcontextprotocol/ext-apps/pull/158\n */\ntype ExtendedMcpUiResourceCsp = McpUiResourceMeta[\"csp\"] & {\n  /**\n   * Origins that can receive openExternal redirects without the safe-link modal.\n   * OpenAI-specific; mirrored into the mcp-apps CSP for cross-host parity.\n   * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields\n   */\n  redirectDomains?: string[];\n};\n\ntype ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, \"csp\"> & {\n  csp?: ExtendedMcpUiResourceCsp;\n};\n\ntype McpAppsResourceMeta = {\n  ui?: ExtendedMcpUiResourceMeta;\n};\n\ntype ResourceMeta = OpenaiResourceMeta | McpAppsResourceMeta;\n\ntype ViewResourceConfig<T extends ResourceMeta = ResourceMeta> = {\n  hostType: ViewHostType;\n  uri: string;\n  mimeType: string;\n  buildContentMeta: (\n    defaults: {\n      resourceDomains: string[];\n      connectDomains: string[];\n      domain: string;\n      baseUriDomains: string[];\n    },\n    overrides: { domain?: string },\n  ) => T;\n};\n\n/**\n * Type-level marker interface for cross-package type inference.\n *\n * Consumers infer tool types via the structural `$types` property rather than\n * the `McpServer` class generic, because class-generic inference breaks when\n * `McpServer` comes from different package installations (e.g. a consumer\n * with its own `skybridge` dep vs. the in-tree workspace version).\n *\n * Inspired by tRPC's `_def` pattern and Hono's type markers.\n */\nexport interface McpServerTypes<TTools extends Record<string, ToolDef>> {\n  readonly tools: TTools;\n}\n\ntype Simplify<T> = { [K in keyof T]: T[K] };\n\ntype ShapeOutput<Shape extends ZodRawShapeCompat> = Simplify<\n  {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? never\n      : K]: SchemaOutput<Shape[K]>;\n  } & {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? K\n      : never]?: SchemaOutput<Shape[K]>;\n  }\n>;\n\ntype ExtractStructuredContent<T> = T extends { structuredContent: infer SC }\n  ? Simplify<SC>\n  : never;\n\ntype ExtractMeta<T> = [Extract<T, { _meta: unknown }>] extends [never]\n  ? unknown\n  : Extract<T, { _meta: unknown }> extends { _meta: infer M }\n    ? Simplify<M>\n    : unknown;\n\ntype AddTool<\n  TTools,\n  TName extends string,\n  TInput extends ZodRawShapeCompat,\n  TOutput,\n  TResponseMetadata = unknown,\n> = McpServer<\n  TTools & {\n    [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;\n  }\n>;\n\ninterface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {\n  name: string;\n  title?: string;\n  description?: string;\n  inputSchema?: TInput;\n  outputSchema?: ZodRawShapeCompat | AnySchema;\n  annotations?: ToolAnnotations;\n  view?: ViewConfig;\n  /**\n   * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).\n   * Lets clients label tools that require sign-in before calling, and pass\n   * the right scopes through the OAuth flow. Listing both `noauth` and\n   * `oauth2` signals that the tool works for anonymous callers and gives\n   * enhanced behavior to authenticated ones.\n   */\n  securitySchemes?: SecurityScheme[];\n  _meta?: ToolMeta;\n}\n\n/**\n * Optional client-supplied hints attached to `params._meta` on every tool call\n * by the Apps SDK host. Hints only: never use for authorization, and tolerate\n * absence.\n * @see https://developers.openai.com/apps-sdk/reference#_meta-fields-the-client-provides\n */\nexport interface ClientHintsMeta {\n  /** Requested locale (BCP-47, e.g. `\"en-US\"`). */\n  \"openai/locale\"?: string;\n  /** Browser user-agent */\n  \"openai/userAgent\"?: string;\n  /** Coarse user location. May be partially populated. */\n  \"openai/userLocation\"?: {\n    city?: string;\n    region?: string;\n    country?: string;\n    timezone?: string;\n    longitude?: number;\n    latitude?: number;\n  };\n  /** Anonymized user id. */\n  \"openai/subject\"?: string;\n  /** Anonymized conversation id, stable within a ChatGPT session. */\n  \"openai/session\"?: string;\n  /** Anonymized organization id, when the user account is part of an organization. */\n  \"openai/organization\"?: string;\n  /** Stable id for the currently mounted widget instance. */\n  \"openai/widgetSessionId\"?: string;\n}\n\ntype ToolHandlerExtra = Omit<\n  RequestHandlerExtra<ServerRequest, ServerNotification>,\n  \"_meta\"\n> & {\n  _meta?: RequestMeta & ClientHintsMeta;\n};\n\ntype ToolHandler<\n  TInput extends ZodRawShapeCompat,\n  TReturn extends { content?: HandlerContent } = { content?: HandlerContent },\n> = (\n  args: ShapeOutput<TInput>,\n  extra: ToolHandlerExtra,\n) => TReturn | Promise<TReturn>;\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\n/**\n * Coerce a tool handler's return value into an MCP `content` array. Strings\n * become a single `TextContent`; a single block is wrapped in an array;\n * `undefined` produces `[]`. Mostly used internally — exported so consumers\n * who build content lazily can apply the same normalization.\n */\nexport function normalizeContent(\n  content: HandlerContent | undefined,\n): ContentBlock[] {\n  if (content === undefined) {\n    return [];\n  }\n  if (typeof content === \"string\") {\n    return [{ type: \"text\", text: content }];\n  }\n  if (Array.isArray(content)) {\n    return content;\n  }\n  return [content];\n}\n\n// We Omit `registerTool` from the base class at the type level so our\n// unified 2-arg signature can replace the SDK's 3-arg one without an\n// incompatible override.  The runtime prototype chain is unaffected.\ninterface McpServerBaseOmitted\n  extends Omit<McpServerBase, \"registerTool\" | \"connect\"> {}\nconst McpServerBaseOmitted = McpServerBase as unknown as new (\n  ...args: ConstructorParameters<typeof McpServerBase>\n) => McpServerBaseOmitted;\n\n/**\n * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool\n * registry, view resources, an embedded Express app, and protocol-level\n * middleware. Construct it with the same `Implementation` info you would pass\n * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,\n * then call {@link McpServer.run} to start the HTTP server.\n *\n * The `TTools` generic accumulates each registered tool's input/output/meta\n * shape, so `typeof server` carries enough information for view-side helpers\n * like {@link generateHelpers} to produce fully-typed hooks.\n *\n * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`\n * chaining; you almost never set this manually.\n *\n * @example\n * ```ts\n * const server = new McpServer({ name: \"my-app\", version: \"1.0.0\" }, {})\n *   .registerTool({\n *     name: \"search\",\n *     inputSchema: { query: z.string() },\n *     view: { component: \"search\" },\n *   }, async ({ query }) => ({ content: `Results for ${query}` }));\n *\n * await server.run();\n * export type AppType = typeof server;\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/mcp-server\n */\n// Side channel populated by `dist/__entry.js` before user code is imported.\n// Set at module scope rather than passed through the constructor because the\n// wrapper has the manifest before the user's `new McpServer(...)` runs, and\n// threading it through every call site (including user templates) is exactly\n// the boilerplate this design is trying to hide.\nlet pendingBuildManifest: Record<string, { file: string }> | null = null;\n\n/**\n * Prime the build-time Vite manifest before user code constructs its\n * `McpServer`. Called from the generated `dist/__entry.js`; not part of the\n * user-facing API.\n *\n * @internal\n */\nexport function __setBuildManifest(\n  manifest: Record<string, { file: string }>,\n): void {\n  pendingBuildManifest = manifest;\n}\n\nexport class McpServer<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n> extends McpServerBaseOmitted {\n  declare readonly $types: McpServerTypes<TTools>;\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `server.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied — tune it via the constructor's third\n   * argument, e.g. `new McpServer(info, {}, { json: { limit: \"10mb\" } })`.\n   * Register your handlers before `run()`;\n   * after `run()`, dev-mode middleware, the `/mcp` route, and the default\n   * error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  readonly express: Express;\n  private customErrorMiddleware: ErrorMiddlewareConfig[] = [];\n  private mcpMiddlewareEntries: McpMiddlewareEntry[] = [];\n  private mcpMiddlewareApplied = false;\n  private claimedViews = new Map<string, string>();\n  private viewMetaBuilders = new Map<\n    string,\n    (extra: McpExtra | undefined) => ResourceMeta\n  >();\n  private viteManifest: Record<string, ViteManifestEntry> | null = null;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions?: ServerOptions;\n\n  constructor(\n    serverInfo: Implementation,\n    options?: ServerOptions,\n    skybridgeOptions?: SkybridgeServerOptions,\n  ) {\n    super(serverInfo, options);\n    this.serverInfo = serverInfo;\n    this.serverOptions = options;\n    this.express = express();\n    this.express.use(express.json(skybridgeOptions?.json));\n    // Pick up the manifest if `dist/__entry.js` primed it before importing\n    // user code. Consume-once: clear after the first construction so a\n    // subsequent test that doesn't prime can't inherit stale state.\n    // Explicit `setViteManifest` calls still win because they happen after\n    // construction.\n    if (pendingBuildManifest) {\n      this.setViteManifest(pendingBuildManifest);\n      pendingBuildManifest = null;\n    }\n  }\n\n  /**\n   * Register Express middleware on the underlying app. Mirrors `app.use` —\n   * pass handlers directly or a path-prefixed handler list. Register before\n   * {@link McpServer.run}; ordering matches Express.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work\n   * locally and on self-hosted deployments.\n   */\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.express.use(pathOrHandler, ...handlers);\n    } else {\n      this.express.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  /**\n   * Register Express error-handling middleware to run after the built-in\n   * `/mcp` route (or your custom route). Use this to log or transform errors\n   * thrown by tool handlers before the default error handler responds.\n   *\n   * @example\n   * ```ts\n   * server.useOnError((err, _req, _res, next) => {\n   *   logger.error(err);\n   *   next(err);\n   * });\n   * ```\n   */\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.customErrorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.customErrorMiddleware.push({\n        handlers: [pathOrHandler, ...handlers],\n      });\n    }\n    return this;\n  }\n\n  /** Register MCP protocol-level middleware (catch-all). */\n  mcpMiddleware(handler: McpMiddlewareFn): this;\n  /** Register MCP protocol-level middleware for all requests (`extra` is `McpExtra`). */\n  mcpMiddleware(\n    filter: \"request\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtra,\n      next: () => Promise<ServerResult>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /** Register MCP protocol-level middleware for all notifications (`extra` is `undefined`). */\n  mcpMiddleware(\n    filter: \"notification\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: undefined,\n      next: () => Promise<undefined>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for an exact method.\n   * Narrows `params`, `extra`, and `next()` result based on the method string.\n   */\n  mcpMiddleware<M extends McpMethodString>(\n    filter: M,\n    handler: McpTypedMiddlewareFn<M>,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for a wildcard pattern (e.g. `\"tools/*\"`).\n   * `next()` returns the union of result types for matching methods.\n   */\n  mcpMiddleware<W extends McpWildcard>(\n    filter: W,\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtraFor<W>,\n      next: () => Promise<McpResultFor<W>>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware with a method filter.\n   * Filter can be an exact method (`\"tools/call\"`), wildcard (`\"tools/*\"`),\n   * category (`\"request\"` | `\"notification\"`), or an array of those.\n   */\n  mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn): this;\n  mcpMiddleware(\n    filterOrHandler: McpMiddlewareFilter | McpMiddlewareFn,\n    // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants\n    maybeHandler?: any,\n  ): this {\n    if (this.mcpMiddlewareApplied) {\n      throw new Error(\n        \"Cannot register MCP middleware after run() or connect() has been called\",\n      );\n    }\n\n    const handler = maybeHandler as McpMiddlewareFn | undefined;\n\n    if (typeof filterOrHandler === \"function\") {\n      this.mcpMiddlewareEntries.push({\n        filter: null,\n        handler: filterOrHandler,\n      });\n    } else if (handler) {\n      this.mcpMiddlewareEntries.push({\n        filter: filterOrHandler,\n        handler,\n      });\n    } else {\n      throw new Error(\n        \"mcpMiddleware requires a handler function when a filter is provided\",\n      );\n    }\n\n    return this;\n  }\n\n  private applyMcpMiddleware(): void {\n    if (this.mcpMiddlewareApplied) {\n      return;\n    }\n    this.mcpMiddlewareApplied = true;\n\n    // Surface view-resource _meta on `resources/list` (per ext-apps spec:\n    // hosts/checkers read CSP & domain at list time before fetching content).\n    const viewListMetaEntry: McpMiddlewareEntry = {\n      filter: \"resources/list\",\n      handler: async (_req, extra, next) => {\n        const result = (await next()) as {\n          resources: Array<Record<string, unknown> & { uri: string }>;\n        };\n        for (const resource of result.resources) {\n          const builder = this.viewMetaBuilders.get(resource.uri);\n          if (!builder) {\n            continue;\n          }\n          const meta = builder(extra);\n          resource._meta = {\n            ...((resource._meta as Record<string, unknown>) ?? {}),\n            ...meta,\n          };\n        }\n        return result;\n      },\n    };\n\n    const monitoringEntry = createMiddlewareEntry();\n    const entries = [\n      ...(monitoringEntry ? [monitoringEntry] : []),\n      viewListMetaEntry,\n      ...this.mcpMiddlewareEntries,\n    ];\n\n    if (entries.length === 0) {\n      return;\n    }\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n\n  /**\n   * Connect to an MCP transport (override of the SDK's `connect`). Use this\n   * when you're embedding Skybridge in a host that already manages its own\n   * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}\n   * which sets the transport up for you. Locks in any middleware registered\n   * via {@link McpServer.mcpMiddleware} — further calls to that method will\n   * throw afterwards.\n   */\n  async connect(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n    return McpServerBase.prototype.connect.call(this, transport);\n  }\n\n  /**\n   * Per-request stateless connect. The SDK's `Protocol` only allows one\n   * transport per instance, so we can't reuse this `McpServer` across\n   * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`\n   * factory, but that would break Skybridge's singleton API — so instead\n   * we build a fresh underlying `Server` per request and share the main\n   * server's handler maps by reference. The cast is unavoidable: there's\n   * no public API to inject handler maps. `getHandlerMaps` validates the\n   * read side and fails fast on SDK field renames.\n   */\n  async connectStatelessTransport(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n    const fresh = new SdkServer(this.serverInfo, this.serverOptions);\n    const target = fresh as unknown as {\n      _requestHandlers: unknown;\n      _notificationHandlers: unknown;\n    };\n    target._requestHandlers = requestHandlers;\n    target._notificationHandlers = notificationHandlers;\n\n    await fresh.connect(transport);\n  }\n\n  /**\n   * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),\n   * mounts the `/mcp` route, applies any custom Express middleware registered\n   * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in\n   * any MCP middleware registered via {@link McpServer.mcpMiddleware}.\n   *\n   * On Cloudflare Workers / workerd, returns an object exposing `fetch` so\n   * the runtime can bridge incoming requests to the Node HTTP server. On\n   * Vercel (`VERCEL === \"1\"`), returns the Express app directly so the\n   * serverless function entry can call it as a `(req, res)` handler. On\n   * Node, returns `undefined` once listening.\n   */\n  async run(): Promise<\n    { fetch: (...args: unknown[]) => unknown } | Express | undefined\n  > {\n    this.applyMcpMiddleware();\n\n    if (process.env.VERCEL === \"1\") {\n      // createApp only reads httpServer inside its dev-only branch\n      // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a\n      // bare object passed to satisfy the required parameter.\n      const httpServer = http.createServer();\n      await createApp({\n        mcpServer: this,\n        httpServer,\n        errorMiddleware: this.customErrorMiddleware,\n      });\n      return this.express;\n    }\n\n    const httpServer = http.createServer();\n\n    await createApp({\n      mcpServer: this,\n      httpServer,\n      errorMiddleware: this.customErrorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.express);\n    const port = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(port, () => {\n        resolve();\n      });\n    });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private enforceOneToolPerView(component: string, toolName: string): void {\n    const existingTool = this.claimedViews.get(component);\n    if (existingTool) {\n      throw new Error(\n        `skybridge: view \"${component}\" is already used by tool \"${existingTool}\". Tool \"${toolName}\" cannot also reference it — each view backs exactly one tool.`,\n      );\n    }\n    this.claimedViews.set(component, toolName);\n  }\n\n  private resolveViewRequestContext(extra: McpExtra | undefined): {\n    serverUrl: string;\n    connectDomains: string[];\n    contentMetaOverrides: { domain?: string };\n  } {\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const headers = extra?.requestInfo?.headers || {};\n    const header = (key: string) => {\n      const val = headers[key];\n      return Array.isArray(val) ? val[0] : val;\n    };\n    const isClaude = header(\"user-agent\") === \"Claude-User\";\n\n    let serverUrl: string;\n    const forwardedHost = header(\"x-forwarded-host\");\n    const origin = header(\"origin\");\n    const host = header(\"host\");\n\n    if (forwardedHost) {\n      const proto = header(\"x-forwarded-proto\") || \"https\";\n      serverUrl = `${proto}://${forwardedHost}`;\n    } else if (origin) {\n      serverUrl = origin;\n    } else if (host) {\n      const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) => host.startsWith(p))\n        ? \"http\"\n        : \"https\";\n      serverUrl = `${proto}://${host}`;\n    } else {\n      const devPort = process.env.__PORT || \"3000\";\n      serverUrl = `http://localhost:${devPort}`;\n    }\n\n    const connectDomains = [serverUrl];\n    if (!isProduction) {\n      const wsUrl = new URL(serverUrl);\n      wsUrl.protocol = wsUrl.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n      connectDomains.push(wsUrl.origin);\n    }\n\n    let contentMetaOverrides: { domain?: string } = {};\n    if (isClaude) {\n      const pathname = extra?.requestInfo?.url?.pathname ?? \"\";\n      const rawUrl =\n        header(\"x-alpic-forwarded-url\") ?? `${serverUrl}${pathname}`;\n      // Strip a lone trailing slash so the hash matches the connector URL\n      // as registered with Claude (which has no trailing slash on bare origins).\n      const url = rawUrl.endsWith(\"/\") ? rawUrl.slice(0, -1) : rawUrl;\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(url)\n        .digest(\"hex\")\n        .slice(0, 32);\n      contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };\n    }\n\n    return { serverUrl, connectDomains, contentMetaOverrides };\n  }\n\n  private registerViewResources(\n    toolName: string,\n    view: ViewConfig,\n    toolMeta: InternalToolMeta,\n  ): void {\n    const hosts = view.hosts ?? ([\"apps-sdk\", \"mcp-app\"] as const);\n\n    // Append a content-derived version param so hosts (e.g. ChatGPT) bust\n    // their cache when the bundle changes, but keep the URI stable across\n    // `tools/list` calls when the bundle hasn't changed.\n    const versionParam = this.computeViewVersionParam(view.component);\n\n    if (hosts.includes(\"apps-sdk\")) {\n      const viewResource: ViewResourceConfig<OpenaiResourceMeta> = {\n        hostType: \"apps-sdk\",\n        uri: `ui://views/apps-sdk/${view.component}.html${versionParam}`,\n        mimeType: \"text/html+skybridge\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain },\n          overrides,\n        ) => {\n          const defaults: OpenaiResourceMeta = {\n            \"openai/widgetCSP\": {\n              resource_domains: resourceDomains,\n              connect_domains: connectDomains,\n            },\n            \"openai/widgetDomain\": domain,\n            \"openai/widgetDescription\": view.description,\n          };\n\n          const fromView: Partial<\n            Omit<\n              OpenaiResourceMeta,\n              \"openai/widgetCSP\" | \"openai/widgetDescription\"\n            > & {\n              \"openai/widgetCSP\": Partial<OpenaiViewCSP>;\n            }\n          > = {\n            \"openai/widgetCSP\": {\n              resource_domains: view.csp?.resourceDomains,\n              connect_domains: view.csp?.connectDomains,\n              frame_domains: view.csp?.frameDomains,\n              redirect_domains: view.csp?.redirectDomains,\n            },\n            \"openai/widgetDomain\": view.domain,\n            \"openai/widgetPrefersBorder\": view.prefersBorder,\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            \"openai/widgetDomain\": overrides.domain,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as OpenaiResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      toolMeta[\"openai/outputTemplate\"] = viewResource.uri;\n    }\n\n    if (hosts.includes(\"mcp-app\")) {\n      const viewResource: ViewResourceConfig<McpAppsResourceMeta> = {\n        hostType: \"mcp-app\",\n        uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,\n        mimeType: \"text/html;profile=mcp-app\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain, baseUriDomains },\n          overrides,\n        ) => {\n          const defaults: McpAppsResourceMeta = {\n            ui: {\n              csp: {\n                resourceDomains,\n                connectDomains,\n                baseUriDomains,\n              },\n              domain,\n            },\n          };\n\n          const fromView: McpAppsResourceMeta = {\n            ui: {\n              ...(view.description && { description: view.description }),\n              ...(view.prefersBorder !== undefined && {\n                prefersBorder: view.prefersBorder,\n              }),\n              ...(view.domain && { domain: view.domain }),\n              csp: {\n                ...(view.csp?.resourceDomains && {\n                  resourceDomains: view.csp.resourceDomains,\n                }),\n                ...(view.csp?.connectDomains && {\n                  connectDomains: view.csp.connectDomains,\n                }),\n                ...(view.csp?.frameDomains && {\n                  frameDomains: view.csp.frameDomains,\n                }),\n                ...(view.csp?.baseUriDomains && {\n                  baseUriDomains: view.csp.baseUriDomains,\n                }),\n                ...(view.csp?.redirectDomains && {\n                  redirectDomains: view.csp.redirectDomains,\n                }),\n              },\n            },\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            ui: overrides,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as McpAppsResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      // @ts-expect-error - For backwards compatibility with Claude current implementation of the specs\n      toolMeta[\"ui/resourceUri\"] = viewResource.uri;\n\n      toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };\n    }\n  }\n\n  private registerViewResource({\n    name,\n    viewResource,\n    view,\n  }: {\n    name: string;\n    viewResource: ViewResourceConfig;\n    view: ViewConfig;\n  }): void {\n    const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;\n\n    const buildMeta = (extra: McpExtra | undefined): ResourceMeta => {\n      const { serverUrl, connectDomains, contentMetaOverrides } =\n        this.resolveViewRequestContext(extra);\n      return buildContentMeta(\n        {\n          resourceDomains: [serverUrl],\n          connectDomains,\n          domain: serverUrl,\n          baseUriDomains: [serverUrl],\n        },\n        contentMetaOverrides,\n      );\n    };\n    this.viewMetaBuilders.set(viewUri, buildMeta);\n\n    this.registerResource(\n      name,\n      viewUri,\n      { description: view.description },\n      async (uri, extra) => {\n        const isProduction = process.env.NODE_ENV === \"production\";\n        const { serverUrl } = this.resolveViewRequestContext(extra);\n\n        const html = isProduction\n          ? templateHelper.renderProduction({\n              hostType,\n              serverUrl,\n              viewFile: this.lookupViewFile(view.component),\n              styleFile: this.lookupDistFile(\"style.css\") ?? \"\",\n            })\n          : templateHelper.renderDevelopment({\n              hostType,\n              serverUrl,\n              viewName: view.component,\n            });\n\n        return {\n          contents: [\n            { uri: uri.href, mimeType, text: html, _meta: buildMeta(extra) },\n          ],\n        };\n      },\n    );\n  }\n\n  private wrapHandler<InputArgs extends ZodRawShapeCompat>(\n    cb: ToolHandler<InputArgs>,\n    { attachViewUUID }: { attachViewUUID: boolean },\n  ): ToolHandler<InputArgs> {\n    return async (args, extra) => {\n      const result = await cb(args, extra);\n      return {\n        ...result,\n        content: normalizeContent(result.content),\n        ...(attachViewUUID && {\n          _meta: {\n            ...(result as { _meta?: Record<string, unknown> })._meta,\n            viewUUID: crypto.randomUUID(),\n          },\n        }),\n      };\n    };\n  }\n\n  private computeViewVersionParam(viewName: string): string {\n    if (process.env.NODE_ENV !== \"production\") {\n      return \"\";\n    }\n    try {\n      const viewFile = this.lookupViewFile(viewName);\n      const styleFile = this.lookupDistFile(\"style.css\") ?? \"\";\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(viewFile)\n        .update(\"\\0\")\n        .update(styleFile)\n        .digest(\"hex\")\n        .slice(0, 8);\n      return `?v=${hash}`;\n    } catch {\n      return \"\";\n    }\n  }\n\n  private lookupViewFile(viewName: string) {\n    const manifest = this.readManifest();\n    for (const entry of Object.values(manifest)) {\n      if (entry?.isEntry && entry.name === viewName && entry.file) {\n        return entry.file;\n      }\n    }\n    throw new Error(\n      `View \"${viewName}\" not found in Vite manifest. Did the build complete successfully? Look for an entry with name \"${viewName}\" in dist/assets/.vite/manifest.json.`,\n    );\n  }\n\n  private lookupDistFile(key: string) {\n    const manifest = this.readManifest();\n    return manifest[key]?.file;\n  }\n\n  /**\n   * Inject the Vite manifest as a value rather than letting `readManifest()`\n   * load it from disk. Required for runtimes without a usable filesystem\n   * (Cloudflare Workers, etc.) — the user's `skybridge build` emits the\n   * manifest as a JS module which the entry imports and passes here.\n   */\n  setViteManifest(manifest: Record<string, { file: string }>): this {\n    this.viteManifest = manifest as Record<string, ViteManifestEntry>;\n    return this;\n  }\n\n  private readManifest(): Record<string, ViteManifestEntry> {\n    if (this.viteManifest) {\n      return this.viteManifest;\n    }\n    return JSON.parse(\n      readFileSync(\n        path.join(process.cwd(), \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        \"utf-8\",\n      ),\n    );\n  }\n\n  /**\n   * Register a tool. Pass a `config` describing the tool (name, schemas,\n   * optional {@link ViewConfig}, optional {@link ToolMeta}) and a handler that\n   * returns the tool's result.\n   *\n   * Chain calls to build up a server: each call returns a new `McpServer`\n   * type that captures the tool's input/output/`_meta` shape so the\n   * resulting `typeof server` can drive {@link generateHelpers}.\n   *\n   * The handler's return shape determines the output types: the\n   * `structuredContent` field becomes the tool's typed output, and `_meta`\n   * becomes its `responseMetadata`. The `content` field is normalized through\n   * {@link normalizeContent}.\n   *\n   * @example\n   * ```ts\n   * server.registerTool({\n   *   name: \"search\",\n   *   inputSchema: { query: z.string() },\n   *   outputSchema: { results: z.array(z.string()) },\n   *   view: { component: \"search\" },\n   * }, async ({ query }) => ({\n   *   content: `Found results for ${query}`,\n   *   structuredContent: { results: [...] },\n   * }));\n   * ```\n   *\n   * @see https://docs.skybridge.tech/api-reference/register-tool\n   */\n  registerTool<\n    TName extends string,\n    InputArgs extends ZodRawShapeCompat,\n    TReturn extends { content?: HandlerContent },\n  >(\n    config: ToolConfig<InputArgs> & { name: TName },\n    cb: ToolHandler<InputArgs, TReturn>,\n  ): AddTool<\n    TTools,\n    TName,\n    InputArgs,\n    ExtractStructuredContent<TReturn>,\n    ExtractMeta<TReturn>\n  >;\n  registerTool<InputArgs extends ZodRawShapeCompat>(\n    config: ToolConfig<InputArgs>,\n    cb: ToolHandler<InputArgs>,\n  ): this;\n  registerTool(...args: unknown[]): unknown {\n    const baseFn = McpServerBase.prototype.registerTool as (\n      ...args: unknown[]\n    ) => unknown;\n\n    if (typeof args[0] === \"string\") {\n      baseFn.call(this, args[0], args[1], args[2]);\n      return this;\n    }\n\n    const config = args[0] as ToolConfig<ZodRawShapeCompat>;\n    const cb = args[1] as ToolHandler<ZodRawShapeCompat>;\n\n    const {\n      name,\n      view,\n      securitySchemes,\n      _meta: userToolMeta,\n      ...toolFields\n    } = config;\n\n    const toolMeta: InternalToolMeta = { ...userToolMeta };\n\n    if (securitySchemes) {\n      // SEP-1488 puts `securitySchemes` at the top level of the tool\n      // descriptor, but the SDK's `registerTool` drops unknown top-level\n      // fields, so the canonical spot isn't reachable without intercepting\n      // `tools/list`. Use the `_meta` back-compat mirror documented in the\n      // Apps SDK reference until SEP-1488 lands in the spec.\n      toolMeta.securitySchemes = securitySchemes;\n    }\n\n    if (view) {\n      this.enforceOneToolPerView(view.component, name);\n      this.registerViewResources(name, view, toolMeta);\n    }\n\n    const wrappedCb = this.wrapHandler(cb, { attachViewUUID: Boolean(view) });\n\n    baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);\n\n    return this;\n  }\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EACL,MAAM,IAAI,SAAS,GAEpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAgBrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,OAAO,EAAE,EAIf,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAYpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,cAAc,GAAG,CACrB,MAAS,EACT,MAAS,EACF,EAAE;IACT,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAyUF;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAOD,MAAM,oBAAoB,GAAG,aAEJ,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AACjD,IAAI,oBAAoB,GAA4C,IAAI,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA0C;IAE1C,oBAAoB,GAAG,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,SAEX,SAAQ,oBAAoB;IAE5B;;;;;;;;;;;;;OAaG;IACM,OAAO,CAAU;IAClB,qBAAqB,GAA4B,EAAE,CAAC;IACpD,oBAAoB,GAAyB,EAAE,CAAC;IAChD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,gBAAgB,GAAG,IAAI,GAAG,EAG/B,CAAC;IACJ;;;;;OAKG;IACK,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,YAAY,GAA6C,IAAI,CAAC;IACrD,UAAU,CAAiB;IAC3B,aAAa,CAAiB;IAE/C,YACE,UAA0B,EAC1B,OAAuB,EACvB,gBAAyC;QAEzC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,gEAAgE;QAChE,uEAAuE;QACvE,gBAAgB;QAChB,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;YAC3C,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAYD,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAgDD,aAAa,CACX,eAAsD;IACtD,uIAAuI;IACvI,YAAkB;QAElB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAA2C,CAAC;QAE5D,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,eAAe;gBACvB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAEjC,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,iBAAiB,GAAuB;YAC5C,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAE3B,CAAC;gBACF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACxD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,QAAQ,CAAC,KAAK,GAAG;wBACf,GAAG,CAAE,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAC;wBACtD,GAAG,IAAI;qBACR,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC;QAEF,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,oBAAoB,GAAuB;YAC/C,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAClC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAE3B,CAAC;oBACF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;wBAC5C,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;4BAC/B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAChC,CAAC;4BACD,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;wBAC1B,CAAC;oBACH,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;wBAAS,CAAC;oBACT,oEAAoE;oBACpE,0DAA0D;oBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC;gBAC7B,CAAC;YACH,CAAC;SACF,CAAC;QAEF,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,iBAAiB;YACjB,oBAAoB;YACpB,GAAG,IAAI,CAAC,oBAAoB;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAGd,CAAC;QACF,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC;QAC1C,MAAM,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAEpD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG;QAGP,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,6DAA6D;YAC7D,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,UAAU;gBACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEvC,MAAM,SAAS,CAAC;YACd,SAAS,EAAE,IAAI;YACf,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;SAC5C,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,8BAA8B,YAAY,YAAY,QAAQ,gEAAgE,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,yBAAyB,CAAC,KAA2B;QAK3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC;QAExD,IAAI,SAAiB,CAAC;QACtB,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC;YACrD,SAAS,GAAG,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;QAC5C,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC;YACZ,SAAS,GAAG,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;YAC7C,SAAS,GAAG,oBAAoB,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,oBAAoB,GAAwB,EAAE,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YACzD,MAAM,MAAM,GACV,MAAM,CAAC,uBAAuB,CAAC,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC/D,oEAAoE;YACpE,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,oBAAoB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,uBAAuB,EAAE,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IAC7D,CAAC;IAEO,qBAAqB,CAC3B,QAAgB,EAChB,IAAgB,EAChB,QAA0B;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,CAAC,UAAU,EAAE,SAAS,CAAW,CAAC;QAE/D,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,YAAY,GAA2C;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,qBAAqB;gBAC/B,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAC3C,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAuB;wBACnC,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,eAAe;4BACjC,eAAe,EAAE,cAAc;yBAChC;wBACD,qBAAqB,EAAE,MAAM;wBAC7B,0BAA0B,EAAE,IAAI,CAAC,WAAW;qBAC7C,CAAC;oBAEF,MAAM,QAAQ,GAOV;wBACF,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;4BAC3C,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc;4BACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;4BACrC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;yBAC5C;wBACD,qBAAqB,EAAE,IAAI,CAAC,MAAM;wBAClC,4BAA4B,EAAE,IAAI,CAAC,aAAa;qBACjD,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,qBAAqB,EAAE,SAAS,CAAC,MAAM;qBACxC,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAwB,CAAC;oBAC1D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,QAAQ,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,YAAY,GAA4C;gBAC5D,QAAQ,EAAE,SAAS;gBACnB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,2BAA2B;gBACrC,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,EAC3D,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,eAAe;gCACf,cAAc;gCACd,cAAc;6BACf;4BACD,MAAM;yBACP;qBACF,CAAC;oBAEF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;4BAC1D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gCACtC,aAAa,EAAE,IAAI,CAAC,aAAa;6BAClC,CAAC;4BACF,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;4BAC3C,GAAG,EAAE;gCACH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI;oCAC5B,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;iCACpC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;6BACH;yBACF;qBACF,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAyB,CAAC;oBAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,iGAAiG;YACjG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;YAE9C,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,EAC3B,IAAI,EACJ,YAAY,EACZ,IAAI,GAKL;QACC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE5E,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAgB,EAAE;YAC9D,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,GACvD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,gBAAgB,CACrB;gBACE,eAAe,EAAE,CAAC,SAAS,CAAC;gBAC5B,cAAc;gBACd,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,CAAC,SAAS,CAAC;aAC5B,EACD,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAErD,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,OAAO,EACP,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACjC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,YAAY;gBACvB,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBAC9B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;iBAClD,CAAC;gBACJ,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC/B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,SAAS;iBACzB,CAAC,CAAC;YAEP,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;iBACjE;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,EAA0B,EAC1B,EAAE,cAAc,EAA+B;QAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzC,GAAG,CAAC,cAAc,IAAI;oBACpB,KAAK,EAAE;wBACL,GAAI,MAA8C,CAAC,KAAK;wBACxD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;qBAC9B;iBACF,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAAgB;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACf,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,mGAAmG,QAAQ,uCAAuC,CACpK,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAA0C;QACxD,IAAI,CAAC,YAAY,GAAG,QAA6C,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EACpE,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAiDD,YAAY,CAAC,GAAG,IAAe;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,YAE3B,CAAC;QAEb,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAmC,CAAC;QAErD,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,eAAe,EACf,KAAK,EAAE,YAAY,EACnB,GAAG,UAAU,EACd,GAAG,MAAM,CAAC;QAEX,MAAM,QAAQ,GAAqB,EAAE,GAAG,YAAY,EAAE,CAAC;QAEvD,IAAI,eAAe,EAAE,CAAC;YACpB,+DAA+D;YAC/D,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,uDAAuD;YACvD,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import crypto from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport http from \"node:http\";\nimport path from \"node:path\";\nimport type {\n  McpUiResourceMeta,\n  McpUiToolMeta,\n} from \"@modelcontextprotocol/ext-apps\";\nimport {\n  Server as SdkServer,\n  type ServerOptions,\n} from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { McpServer as McpServerBase } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  AnySchema,\n  SchemaOutput,\n  ZodRawShapeCompat,\n} from \"@modelcontextprotocol/sdk/server/zod-compat.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  ContentBlock,\n  Implementation,\n  RequestMeta,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n  ToolAnnotations,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { mergeWith, union } from \"es-toolkit\";\nimport express, {\n  type ErrorRequestHandler,\n  type Express,\n  type RequestHandler,\n} from \"express\";\nimport type { OAuthConfig } from \"./auth/index.js\";\nimport { setupOAuth } from \"./auth/setup.js\";\nimport { createApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type {\n  McpExtra,\n  McpExtraFor,\n  McpMethodString,\n  McpMiddlewareEntry,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport { templateHelper } from \"./templateHelper.js\";\n\nconst mergeWithUnion = <T extends object, S extends object>(\n  target: T,\n  source: S,\n): T & S => {\n  return mergeWith(target, source, (targetVal, sourceVal) => {\n    if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {\n      return union(targetVal, sourceVal);\n    }\n  });\n};\n\n/**\n * Type marker for a registered tool — carries its input, output, and response\n * metadata shapes so views can infer types from `typeof server`.\n *\n * You normally never construct this by hand; it is produced by `registerTool`\n * and consumed by helpers like {@link InferTools} and {@link generateHelpers}.\n */\nexport type ToolDef<\n  TInput = unknown,\n  TOutput = unknown,\n  TResponseMetadata = unknown,\n> = {\n  input: TInput;\n  output: TOutput;\n  responseMetadata: TResponseMetadata;\n};\n\n/** Which host runtime a view targets — `\"apps-sdk\"` (ChatGPT) or `\"mcp-app\"` (MCP Apps spec). */\nexport type ViewHostType = \"apps-sdk\" | \"mcp-app\";\n\n/**\n * Content Security Policy origins attached to a view's resource. Each list is\n * passed through to the host's CSP for the view iframe; omit a field to inherit\n * the host's default for that directive.\n */\nexport interface ViewCsp {\n  /** Origins for static assets (images, fonts, scripts, styles). */\n  resourceDomains?: string[];\n  /** Origins the view may contact via fetch/XHR. */\n  connectDomains?: string[];\n  /** Origins allowed for iframe embeds (opts into stricter app review). */\n  frameDomains?: string[];\n  /** Origins that can receive openExternal redirects without the safe-link modal. */\n  redirectDomains?: string[];\n  /** Origins allowed in `<base href>` tags (mcp-apps only). */\n  baseUriDomains?: string[];\n}\n\n/**\n * Registry of view component names. The Skybridge Vite plugin augments this\n * interface in the generated `.skybridge/views.d.ts` with one key per view\n * file, which narrows {@link ViewName} from `string` to the concrete union.\n */\n// Must be exported: TS module augmentation only merges with exported\n// declarations. Without `export`, `.skybridge/views.d.ts` augmentation\n// would create a separate interface and `ViewName` would stay `string`.\n// biome-ignore lint/suspicious/noEmptyInterface: register pattern — augmented by `.skybridge/views.d.ts` to narrow ViewName\nexport interface ViewNameRegistry {}\n\n/** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */\nexport type ViewName = keyof ViewNameRegistry & string;\n\n/**\n * Pass under `view` in a tool's `registerTool` config to render the tool's\n * result through a Skybridge view instead of a plain text response.\n */\nexport interface ViewConfig {\n  /** Filename of the view module (without extension) — matches a file in your `viewsDir`. */\n  component: ViewName;\n  /** Human-readable label the host may show alongside the view. */\n  description?: string;\n  /** Restrict where the view is rendered. Defaults to all known hosts. */\n  hosts?: ViewHostType[];\n  /** Apps SDK only: request a visible border around the widget. */\n  prefersBorder?: boolean;\n  /** Apps SDK only: override the iframe's served domain (advanced). */\n  domain?: string;\n  /** Per-view CSP overrides — see {@link ViewCsp}. */\n  csp?: ViewCsp;\n  /** Free-form metadata forwarded on the view resource's `_meta`. */\n  _meta?: Record<string, unknown>;\n}\n\nexport type SecurityScheme =\n  | { type: \"noauth\" }\n  | { type: \"oauth2\"; scopes?: string[] };\n\n/**\n * Options forwarded to the built-in `express.json()` body parser. Derived\n * from Express's own types so the public API doesn't depend on `body-parser`.\n */\nexport type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;\n\n/** Skybridge-specific server options, passed as the third `McpServer` constructor argument. */\nexport interface SkybridgeServerOptions {\n  /** Options for the built-in `express.json()` middleware, e.g. `{ limit: \"10mb\" }`. */\n  json?: JsonOptions;\n  /** Resource-server OAuth config. When set, mounts well-known metadata and bearer auth on `/mcp`. */\n  oauth?: OAuthConfig;\n}\n\n/**\n * Well-known keys recognized by host runtimes when set on a tool's `_meta`.\n * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.\n *\n * @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters\n */\nexport interface KnownToolMeta {\n  /** Apps SDK: allow the rendered view to call this tool from inside its iframe. */\n  \"openai/widgetAccessible\"?: boolean;\n  /** Apps SDK: status text shown while the tool is running (e.g. `\"Searching trips\"`). */\n  \"openai/toolInvocation/invoking\"?: string;\n  /** Apps SDK: status text shown once the tool returns (e.g. `\"Found 3 trips\"`). */\n  \"openai/toolInvocation/invoked\"?: string;\n  /** Apps SDK: input parameters that hold file references — the host attaches uploaded files to them. */\n  \"openai/fileParams\"?: string[];\n  /** MCP Apps: control whether the tool is exposed to the model, the app, or both. */\n  ui?: Pick<McpUiToolMeta, \"visibility\">;\n  securitySchemes?: SecurityScheme[];\n}\n\n/** {@link KnownToolMeta} merged with arbitrary string-keyed metadata for custom flags. */\nexport type ToolMeta = KnownToolMeta & Record<string, unknown>;\n\n/**\n * Convenient return type for tool handlers — a plain string, a single\n * {@link ContentBlock}, or an array. Skybridge normalizes it to the MCP\n * `content: ContentBlock[]` shape before responding.\n */\nexport type HandlerContent = string | ContentBlock | ContentBlock[];\n\n/** @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters */\ntype ViteManifestEntry = {\n  file: string;\n  name?: string;\n  src?: string;\n  isEntry?: boolean;\n  isDynamicEntry?: boolean;\n  css?: string[];\n  assets?: string[];\n  imports?: string[];\n  dynamicImports?: string[];\n};\n\ntype OpenaiToolMeta = {\n  \"openai/outputTemplate\": string;\n  \"openai/widgetAccessible\"?: boolean;\n  \"openai/toolInvocation/invoking\"?: string;\n  \"openai/toolInvocation/invoked\"?: string;\n  \"openai/fileParams\"?: string[];\n};\n\n/** @see https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx#resource-discovery */\ntype McpAppsToolMeta = {\n  ui: McpUiToolMeta;\n};\n\ntype SecuritySchemesToolMeta = {\n  securitySchemes: SecurityScheme[];\n};\n\ntype InternalToolMeta = Partial<\n  OpenaiToolMeta & McpAppsToolMeta & SecuritySchemesToolMeta\n>;\n\n/** @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields */\ntype OpenaiViewCSP = {\n  connect_domains: string[];\n  resource_domains: string[];\n  frame_domains?: string[];\n  redirect_domains?: string[];\n};\n\ntype OpenaiResourceMeta = {\n  \"openai/widgetDescription\"?: string;\n  \"openai/widgetPrefersBorder\"?: boolean;\n  \"openai/widgetCSP\"?: OpenaiViewCSP;\n  \"openai/widgetDomain\"?: string;\n};\n\n/**\n * MCP Apps CSP extended with upcoming / Skybridge-specific fields.\n * @see https://github.com/modelcontextprotocol/ext-apps/pull/158\n */\ntype ExtendedMcpUiResourceCsp = McpUiResourceMeta[\"csp\"] & {\n  /**\n   * Origins that can receive openExternal redirects without the safe-link modal.\n   * OpenAI-specific; mirrored into the mcp-apps CSP for cross-host parity.\n   * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields\n   */\n  redirectDomains?: string[];\n};\n\ntype ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, \"csp\"> & {\n  csp?: ExtendedMcpUiResourceCsp;\n};\n\ntype McpAppsResourceMeta = {\n  ui?: ExtendedMcpUiResourceMeta;\n};\n\ntype ResourceMeta = OpenaiResourceMeta | McpAppsResourceMeta;\n\ntype ViewResourceConfig<T extends ResourceMeta = ResourceMeta> = {\n  hostType: ViewHostType;\n  uri: string;\n  mimeType: string;\n  buildContentMeta: (\n    defaults: {\n      resourceDomains: string[];\n      connectDomains: string[];\n      domain: string;\n      baseUriDomains: string[];\n    },\n    overrides: { domain?: string },\n  ) => T;\n};\n\n/**\n * Type-level marker interface for cross-package type inference.\n *\n * Consumers infer tool types via the structural `$types` property rather than\n * the `McpServer` class generic, because class-generic inference breaks when\n * `McpServer` comes from different package installations (e.g. a consumer\n * with its own `skybridge` dep vs. the in-tree workspace version).\n *\n * Inspired by tRPC's `_def` pattern and Hono's type markers.\n */\nexport interface McpServerTypes<TTools extends Record<string, ToolDef>> {\n  readonly tools: TTools;\n}\n\ntype Simplify<T> = { [K in keyof T]: T[K] };\n\ntype ShapeOutput<Shape extends ZodRawShapeCompat> = Simplify<\n  {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? never\n      : K]: SchemaOutput<Shape[K]>;\n  } & {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? K\n      : never]?: SchemaOutput<Shape[K]>;\n  }\n>;\n\ntype ExtractStructuredContent<T> = T extends { structuredContent: infer SC }\n  ? Simplify<SC>\n  : never;\n\ntype ExtractMeta<T> = [Extract<T, { _meta: unknown }>] extends [never]\n  ? unknown\n  : Extract<T, { _meta: unknown }> extends { _meta: infer M }\n    ? Simplify<M>\n    : unknown;\n\ntype AddTool<\n  TTools,\n  TName extends string,\n  TInput extends ZodRawShapeCompat,\n  TOutput,\n  TResponseMetadata = unknown,\n> = McpServer<\n  TTools & {\n    [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;\n  }\n>;\n\ninterface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {\n  name: string;\n  title?: string;\n  description?: string;\n  inputSchema?: TInput;\n  outputSchema?: ZodRawShapeCompat | AnySchema;\n  annotations?: ToolAnnotations;\n  view?: ViewConfig;\n  /**\n   * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).\n   * Lets clients label tools that require sign-in before calling, and pass\n   * the right scopes through the OAuth flow. Listing both `noauth` and\n   * `oauth2` signals that the tool works for anonymous callers and gives\n   * enhanced behavior to authenticated ones.\n   */\n  securitySchemes?: SecurityScheme[];\n  _meta?: ToolMeta;\n}\n\n/**\n * Optional client-supplied hints attached to `params._meta` on every tool call\n * by the Apps SDK host. Hints only: never use for authorization, and tolerate\n * absence.\n * @see https://developers.openai.com/apps-sdk/reference#_meta-fields-the-client-provides\n */\nexport interface ClientHintsMeta {\n  /** Requested locale (BCP-47, e.g. `\"en-US\"`). */\n  \"openai/locale\"?: string;\n  /** Browser user-agent */\n  \"openai/userAgent\"?: string;\n  /** Coarse user location. May be partially populated. */\n  \"openai/userLocation\"?: {\n    city?: string;\n    region?: string;\n    country?: string;\n    timezone?: string;\n    longitude?: number;\n    latitude?: number;\n  };\n  /** Anonymized user id. */\n  \"openai/subject\"?: string;\n  /** Anonymized conversation id, stable within a ChatGPT session. */\n  \"openai/session\"?: string;\n  /** Anonymized organization id, when the user account is part of an organization. */\n  \"openai/organization\"?: string;\n  /** Stable id for the currently mounted widget instance. */\n  \"openai/widgetSessionId\"?: string;\n}\n\ntype ToolHandlerExtra = Omit<\n  RequestHandlerExtra<ServerRequest, ServerNotification>,\n  \"_meta\"\n> & {\n  _meta?: RequestMeta & ClientHintsMeta;\n};\n\ntype ToolHandler<\n  TInput extends ZodRawShapeCompat,\n  TReturn extends { content?: HandlerContent } = { content?: HandlerContent },\n> = (\n  args: ShapeOutput<TInput>,\n  extra: ToolHandlerExtra,\n) => TReturn | Promise<TReturn>;\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\n/**\n * Drop the query string from a `ui://` view URI, leaving the bare path. The\n * `?v=` cache key is the only query we append, so a plain split is enough and\n * sidesteps `URL` normalization quirks on the non-special `ui:` scheme.\n */\nfunction stripQuery(uri: string): string {\n  const queryIndex = uri.indexOf(\"?\");\n  return queryIndex === -1 ? uri : uri.slice(0, queryIndex);\n}\n\n/**\n * Coerce a tool handler's return value into an MCP `content` array. Strings\n * become a single `TextContent`; a single block is wrapped in an array;\n * `undefined` produces `[]`. Mostly used internally — exported so consumers\n * who build content lazily can apply the same normalization.\n */\nexport function normalizeContent(\n  content: HandlerContent | undefined,\n): ContentBlock[] {\n  if (content === undefined) {\n    return [];\n  }\n  if (typeof content === \"string\") {\n    return [{ type: \"text\", text: content }];\n  }\n  if (Array.isArray(content)) {\n    return content;\n  }\n  return [content];\n}\n\n// We Omit `registerTool` from the base class at the type level so our\n// unified 2-arg signature can replace the SDK's 3-arg one without an\n// incompatible override.  The runtime prototype chain is unaffected.\ninterface McpServerBaseOmitted\n  extends Omit<McpServerBase, \"registerTool\" | \"connect\"> {}\nconst McpServerBaseOmitted = McpServerBase as unknown as new (\n  ...args: ConstructorParameters<typeof McpServerBase>\n) => McpServerBaseOmitted;\n\n/**\n * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool\n * registry, view resources, an embedded Express app, and protocol-level\n * middleware. Construct it with the same `Implementation` info you would pass\n * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,\n * then call {@link McpServer.run} to start the HTTP server.\n *\n * The `TTools` generic accumulates each registered tool's input/output/meta\n * shape, so `typeof server` carries enough information for view-side helpers\n * like {@link generateHelpers} to produce fully-typed hooks.\n *\n * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`\n * chaining; you almost never set this manually.\n *\n * @example\n * ```ts\n * const server = new McpServer({ name: \"my-app\", version: \"1.0.0\" }, {})\n *   .registerTool({\n *     name: \"search\",\n *     inputSchema: { query: z.string() },\n *     view: { component: \"search\" },\n *   }, async ({ query }) => ({ content: `Results for ${query}` }));\n *\n * await server.run();\n * export type AppType = typeof server;\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/mcp-server\n */\n// Side channel populated by `dist/__entry.js` before user code is imported.\n// Set at module scope rather than passed through the constructor because the\n// wrapper has the manifest before the user's `new McpServer(...)` runs, and\n// threading it through every call site (including user templates) is exactly\n// the boilerplate this design is trying to hide.\nlet pendingBuildManifest: Record<string, { file: string }> | null = null;\n\n/**\n * Prime the build-time Vite manifest before user code constructs its\n * `McpServer`. Called from the generated `dist/__entry.js`; not part of the\n * user-facing API.\n *\n * @internal\n */\nexport function __setBuildManifest(\n  manifest: Record<string, { file: string }>,\n): void {\n  pendingBuildManifest = manifest;\n}\n\nexport class McpServer<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n> extends McpServerBaseOmitted {\n  declare readonly $types: McpServerTypes<TTools>;\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `server.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied — tune it via the constructor's third\n   * argument, e.g. `new McpServer(info, {}, { json: { limit: \"10mb\" } })`.\n   * Register your handlers before `run()`;\n   * after `run()`, dev-mode middleware, the `/mcp` route, and the default\n   * error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  readonly express: Express;\n  private customErrorMiddleware: ErrorMiddlewareConfig[] = [];\n  private mcpMiddlewareEntries: McpMiddlewareEntry[] = [];\n  private mcpMiddlewareApplied = false;\n  private claimedViews = new Map<string, string>();\n  private viewMetaBuilders = new Map<\n    string,\n    (extra: McpExtra | undefined) => ResourceMeta\n  >();\n  /**\n   * Maps a view resource's query-less path to its canonical registered URI\n   * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the\n   * underlying view no matter which version param the consumer sends, since\n   * the param is only a cache key, not part of the resource's identity.\n   */\n  private viewUriByPath = new Map<string, string>();\n  private viteManifest: Record<string, ViteManifestEntry> | null = null;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions?: ServerOptions;\n\n  constructor(\n    serverInfo: Implementation,\n    options?: ServerOptions,\n    skybridgeOptions?: SkybridgeServerOptions,\n  ) {\n    super(serverInfo, options);\n    this.serverInfo = serverInfo;\n    this.serverOptions = options;\n    this.express = express();\n    this.express.use(express.json(skybridgeOptions?.json));\n    if (skybridgeOptions?.oauth) {\n      setupOAuth(this.express, skybridgeOptions.oauth);\n    }\n    // Pick up the manifest if `dist/__entry.js` primed it before importing\n    // user code. Consume-once: clear after the first construction so a\n    // subsequent test that doesn't prime can't inherit stale state.\n    // Explicit `setViteManifest` calls still win because they happen after\n    // construction.\n    if (pendingBuildManifest) {\n      this.setViteManifest(pendingBuildManifest);\n      pendingBuildManifest = null;\n    }\n  }\n\n  /**\n   * Register Express middleware on the underlying app. Mirrors `app.use` —\n   * pass handlers directly or a path-prefixed handler list. Register before\n   * {@link McpServer.run}; ordering matches Express.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work\n   * locally and on self-hosted deployments.\n   */\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.express.use(pathOrHandler, ...handlers);\n    } else {\n      this.express.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  /**\n   * Register Express error-handling middleware to run after the built-in\n   * `/mcp` route (or your custom route). Use this to log or transform errors\n   * thrown by tool handlers before the default error handler responds.\n   *\n   * @example\n   * ```ts\n   * server.useOnError((err, _req, _res, next) => {\n   *   logger.error(err);\n   *   next(err);\n   * });\n   * ```\n   */\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.customErrorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.customErrorMiddleware.push({\n        handlers: [pathOrHandler, ...handlers],\n      });\n    }\n    return this;\n  }\n\n  /** Register MCP protocol-level middleware (catch-all). */\n  mcpMiddleware(handler: McpMiddlewareFn): this;\n  /** Register MCP protocol-level middleware for all requests (`extra` is `McpExtra`). */\n  mcpMiddleware(\n    filter: \"request\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtra,\n      next: () => Promise<ServerResult>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /** Register MCP protocol-level middleware for all notifications (`extra` is `undefined`). */\n  mcpMiddleware(\n    filter: \"notification\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: undefined,\n      next: () => Promise<undefined>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for an exact method.\n   * Narrows `params`, `extra`, and `next()` result based on the method string.\n   */\n  mcpMiddleware<M extends McpMethodString>(\n    filter: M,\n    handler: McpTypedMiddlewareFn<M>,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for a wildcard pattern (e.g. `\"tools/*\"`).\n   * `next()` returns the union of result types for matching methods.\n   */\n  mcpMiddleware<W extends McpWildcard>(\n    filter: W,\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtraFor<W>,\n      next: () => Promise<McpResultFor<W>>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware with a method filter.\n   * Filter can be an exact method (`\"tools/call\"`), wildcard (`\"tools/*\"`),\n   * category (`\"request\"` | `\"notification\"`), or an array of those.\n   */\n  mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn): this;\n  mcpMiddleware(\n    filterOrHandler: McpMiddlewareFilter | McpMiddlewareFn,\n    // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants\n    maybeHandler?: any,\n  ): this {\n    if (this.mcpMiddlewareApplied) {\n      throw new Error(\n        \"Cannot register MCP middleware after run() or connect() has been called\",\n      );\n    }\n\n    const handler = maybeHandler as McpMiddlewareFn | undefined;\n\n    if (typeof filterOrHandler === \"function\") {\n      this.mcpMiddlewareEntries.push({\n        filter: null,\n        handler: filterOrHandler,\n      });\n    } else if (handler) {\n      this.mcpMiddlewareEntries.push({\n        filter: filterOrHandler,\n        handler,\n      });\n    } else {\n      throw new Error(\n        \"mcpMiddleware requires a handler function when a filter is provided\",\n      );\n    }\n\n    return this;\n  }\n\n  private applyMcpMiddleware(): void {\n    if (this.mcpMiddlewareApplied) {\n      return;\n    }\n    this.mcpMiddlewareApplied = true;\n\n    // Surface view-resource _meta on `resources/list` (per ext-apps spec:\n    // hosts/checkers read CSP & domain at list time before fetching content).\n    const viewListMetaEntry: McpMiddlewareEntry = {\n      filter: \"resources/list\",\n      handler: async (_req, extra, next) => {\n        const result = (await next()) as {\n          resources: Array<Record<string, unknown> & { uri: string }>;\n        };\n        for (const resource of result.resources) {\n          const builder = this.viewMetaBuilders.get(resource.uri);\n          if (!builder) {\n            continue;\n          }\n          const meta = builder(extra);\n          resource._meta = {\n            ...((resource._meta as Record<string, unknown>) ?? {}),\n            ...meta,\n          };\n        }\n        return result;\n      },\n    };\n\n    // Resolve a view's `resources/read` by its query-less path so the\n    // underlying asset is served no matter the `?v=` value (stale cache key,\n    // no param, etc.). The version param is a cache-busting hint for external\n    // consumers; it must not gate resolution. We rewrite the lookup URI to the\n    // canonical registered one, then restore the requested URI on the response\n    // so the consumer-facing URI is never rewritten.\n    const viewReadResolveEntry: McpMiddlewareEntry = {\n      filter: \"resources/read\",\n      handler: async (req, _extra, next) => {\n        const requested = req.params.uri;\n        if (typeof requested !== \"string\") {\n          return next();\n        }\n        const path = stripQuery(requested);\n        const canonical = this.viewUriByPath.get(path);\n        if (!canonical) {\n          return next();\n        }\n        req.params.uri = canonical;\n        try {\n          const result = (await next()) as {\n            contents?: Array<{ uri?: string } & Record<string, unknown>>;\n          };\n          for (const content of result.contents ?? []) {\n            if (\n              typeof content.uri === \"string\" &&\n              stripQuery(content.uri) === path\n            ) {\n              content.uri = requested;\n            }\n          }\n          return result;\n        } finally {\n          // Restore the shared request params so middleware outer to us never\n          // observes the rewritten lookup URI after next() unwinds.\n          req.params.uri = requested;\n        }\n      },\n    };\n\n    const monitoringEntry = createMiddlewareEntry();\n    const entries = [\n      ...(monitoringEntry ? [monitoringEntry] : []),\n      viewListMetaEntry,\n      viewReadResolveEntry,\n      ...this.mcpMiddlewareEntries,\n    ];\n\n    if (entries.length === 0) {\n      return;\n    }\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n\n  /**\n   * Connect to an MCP transport (override of the SDK's `connect`). Use this\n   * when you're embedding Skybridge in a host that already manages its own\n   * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}\n   * which sets the transport up for you. Locks in any middleware registered\n   * via {@link McpServer.mcpMiddleware} — further calls to that method will\n   * throw afterwards.\n   */\n  async connect(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n    return McpServerBase.prototype.connect.call(this, transport);\n  }\n\n  /**\n   * Per-request stateless connect. The SDK's `Protocol` only allows one\n   * transport per instance, so we can't reuse this `McpServer` across\n   * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`\n   * factory, but that would break Skybridge's singleton API — so instead\n   * we build a fresh underlying `Server` per request and share the main\n   * server's handler maps by reference. The cast is unavoidable: there's\n   * no public API to inject handler maps. `getHandlerMaps` validates the\n   * read side and fails fast on SDK field renames.\n   */\n  async connectStatelessTransport(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n    const fresh = new SdkServer(this.serverInfo, this.serverOptions);\n    const target = fresh as unknown as {\n      _requestHandlers: unknown;\n      _notificationHandlers: unknown;\n    };\n    target._requestHandlers = requestHandlers;\n    target._notificationHandlers = notificationHandlers;\n\n    await fresh.connect(transport);\n  }\n\n  /**\n   * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),\n   * mounts the `/mcp` route, applies any custom Express middleware registered\n   * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in\n   * any MCP middleware registered via {@link McpServer.mcpMiddleware}.\n   *\n   * On Cloudflare Workers / workerd, returns an object exposing `fetch` so\n   * the runtime can bridge incoming requests to the Node HTTP server. On\n   * Vercel (`VERCEL === \"1\"`), returns the Express app directly so the\n   * serverless function entry can call it as a `(req, res)` handler. On\n   * Node, returns `undefined` once listening.\n   */\n  async run(): Promise<\n    { fetch: (...args: unknown[]) => unknown } | Express | undefined\n  > {\n    this.applyMcpMiddleware();\n\n    if (process.env.VERCEL === \"1\") {\n      // createApp only reads httpServer inside its dev-only branch\n      // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a\n      // bare object passed to satisfy the required parameter.\n      const httpServer = http.createServer();\n      await createApp({\n        mcpServer: this,\n        httpServer,\n        errorMiddleware: this.customErrorMiddleware,\n      });\n      return this.express;\n    }\n\n    const httpServer = http.createServer();\n\n    await createApp({\n      mcpServer: this,\n      httpServer,\n      errorMiddleware: this.customErrorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.express);\n    const port = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(port, () => {\n        resolve();\n      });\n    });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private enforceOneToolPerView(component: string, toolName: string): void {\n    const existingTool = this.claimedViews.get(component);\n    if (existingTool) {\n      throw new Error(\n        `skybridge: view \"${component}\" is already used by tool \"${existingTool}\". Tool \"${toolName}\" cannot also reference it — each view backs exactly one tool.`,\n      );\n    }\n    this.claimedViews.set(component, toolName);\n  }\n\n  private resolveViewRequestContext(extra: McpExtra | undefined): {\n    serverUrl: string;\n    connectDomains: string[];\n    contentMetaOverrides: { domain?: string };\n  } {\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const headers = extra?.requestInfo?.headers || {};\n    const header = (key: string) => {\n      const val = headers[key];\n      return Array.isArray(val) ? val[0] : val;\n    };\n    const isClaude = header(\"user-agent\") === \"Claude-User\";\n\n    let serverUrl: string;\n    const forwardedHost = header(\"x-forwarded-host\");\n    const origin = header(\"origin\");\n    const host = header(\"host\");\n\n    if (forwardedHost) {\n      const proto = header(\"x-forwarded-proto\") || \"https\";\n      serverUrl = `${proto}://${forwardedHost}`;\n    } else if (origin) {\n      serverUrl = origin;\n    } else if (host) {\n      const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) => host.startsWith(p))\n        ? \"http\"\n        : \"https\";\n      serverUrl = `${proto}://${host}`;\n    } else {\n      const devPort = process.env.__PORT || \"3000\";\n      serverUrl = `http://localhost:${devPort}`;\n    }\n\n    const connectDomains = [serverUrl];\n    if (!isProduction) {\n      const wsUrl = new URL(serverUrl);\n      wsUrl.protocol = wsUrl.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n      connectDomains.push(wsUrl.origin);\n    }\n\n    let contentMetaOverrides: { domain?: string } = {};\n    if (isClaude) {\n      const pathname = extra?.requestInfo?.url?.pathname ?? \"\";\n      const rawUrl =\n        header(\"x-alpic-forwarded-url\") ?? `${serverUrl}${pathname}`;\n      // Strip a lone trailing slash so the hash matches the connector URL\n      // as registered with Claude (which has no trailing slash on bare origins).\n      const url = rawUrl.endsWith(\"/\") ? rawUrl.slice(0, -1) : rawUrl;\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(url)\n        .digest(\"hex\")\n        .slice(0, 32);\n      contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };\n    }\n\n    return { serverUrl, connectDomains, contentMetaOverrides };\n  }\n\n  private registerViewResources(\n    toolName: string,\n    view: ViewConfig,\n    toolMeta: InternalToolMeta,\n  ): void {\n    const hosts = view.hosts ?? ([\"apps-sdk\", \"mcp-app\"] as const);\n\n    // Append a content-derived version param so hosts (e.g. ChatGPT) bust\n    // their cache when the bundle changes, but keep the URI stable across\n    // `tools/list` calls when the bundle hasn't changed.\n    const versionParam = this.computeViewVersionParam(view.component);\n\n    if (hosts.includes(\"apps-sdk\")) {\n      const viewResource: ViewResourceConfig<OpenaiResourceMeta> = {\n        hostType: \"apps-sdk\",\n        uri: `ui://views/apps-sdk/${view.component}.html${versionParam}`,\n        mimeType: \"text/html+skybridge\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain },\n          overrides,\n        ) => {\n          const defaults: OpenaiResourceMeta = {\n            \"openai/widgetCSP\": {\n              resource_domains: resourceDomains,\n              connect_domains: connectDomains,\n            },\n            \"openai/widgetDomain\": domain,\n            \"openai/widgetDescription\": view.description,\n          };\n\n          const fromView: Partial<\n            Omit<\n              OpenaiResourceMeta,\n              \"openai/widgetCSP\" | \"openai/widgetDescription\"\n            > & {\n              \"openai/widgetCSP\": Partial<OpenaiViewCSP>;\n            }\n          > = {\n            \"openai/widgetCSP\": {\n              resource_domains: view.csp?.resourceDomains,\n              connect_domains: view.csp?.connectDomains,\n              frame_domains: view.csp?.frameDomains,\n              redirect_domains: view.csp?.redirectDomains,\n            },\n            \"openai/widgetDomain\": view.domain,\n            \"openai/widgetPrefersBorder\": view.prefersBorder,\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            \"openai/widgetDomain\": overrides.domain,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as OpenaiResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      toolMeta[\"openai/outputTemplate\"] = viewResource.uri;\n    }\n\n    if (hosts.includes(\"mcp-app\")) {\n      const viewResource: ViewResourceConfig<McpAppsResourceMeta> = {\n        hostType: \"mcp-app\",\n        uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,\n        mimeType: \"text/html;profile=mcp-app\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain, baseUriDomains },\n          overrides,\n        ) => {\n          const defaults: McpAppsResourceMeta = {\n            ui: {\n              csp: {\n                resourceDomains,\n                connectDomains,\n                baseUriDomains,\n              },\n              domain,\n            },\n          };\n\n          const fromView: McpAppsResourceMeta = {\n            ui: {\n              ...(view.description && { description: view.description }),\n              ...(view.prefersBorder !== undefined && {\n                prefersBorder: view.prefersBorder,\n              }),\n              ...(view.domain && { domain: view.domain }),\n              csp: {\n                ...(view.csp?.resourceDomains && {\n                  resourceDomains: view.csp.resourceDomains,\n                }),\n                ...(view.csp?.connectDomains && {\n                  connectDomains: view.csp.connectDomains,\n                }),\n                ...(view.csp?.frameDomains && {\n                  frameDomains: view.csp.frameDomains,\n                }),\n                ...(view.csp?.baseUriDomains && {\n                  baseUriDomains: view.csp.baseUriDomains,\n                }),\n                ...(view.csp?.redirectDomains && {\n                  redirectDomains: view.csp.redirectDomains,\n                }),\n              },\n            },\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            ui: overrides,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as McpAppsResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      // @ts-expect-error - For backwards compatibility with Claude current implementation of the specs\n      toolMeta[\"ui/resourceUri\"] = viewResource.uri;\n\n      toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };\n    }\n  }\n\n  private registerViewResource({\n    name,\n    viewResource,\n    view,\n  }: {\n    name: string;\n    viewResource: ViewResourceConfig;\n    view: ViewConfig;\n  }): void {\n    const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;\n\n    const buildMeta = (extra: McpExtra | undefined): ResourceMeta => {\n      const { serverUrl, connectDomains, contentMetaOverrides } =\n        this.resolveViewRequestContext(extra);\n      return buildContentMeta(\n        {\n          resourceDomains: [serverUrl],\n          connectDomains,\n          domain: serverUrl,\n          baseUriDomains: [serverUrl],\n        },\n        contentMetaOverrides,\n      );\n    };\n    this.viewMetaBuilders.set(viewUri, buildMeta);\n    this.viewUriByPath.set(stripQuery(viewUri), viewUri);\n\n    this.registerResource(\n      name,\n      viewUri,\n      { description: view.description },\n      async (uri, extra) => {\n        const isProduction = process.env.NODE_ENV === \"production\";\n        const { serverUrl } = this.resolveViewRequestContext(extra);\n\n        const html = isProduction\n          ? templateHelper.renderProduction({\n              hostType,\n              serverUrl,\n              viewFile: this.lookupViewFile(view.component),\n              styleFile: this.lookupDistFile(\"style.css\") ?? \"\",\n            })\n          : templateHelper.renderDevelopment({\n              hostType,\n              serverUrl,\n              viewName: view.component,\n            });\n\n        return {\n          contents: [\n            { uri: uri.href, mimeType, text: html, _meta: buildMeta(extra) },\n          ],\n        };\n      },\n    );\n  }\n\n  private wrapHandler<InputArgs extends ZodRawShapeCompat>(\n    cb: ToolHandler<InputArgs>,\n    { attachViewUUID }: { attachViewUUID: boolean },\n  ): ToolHandler<InputArgs> {\n    return async (args, extra) => {\n      const result = await cb(args, extra);\n      return {\n        ...result,\n        content: normalizeContent(result.content),\n        ...(attachViewUUID && {\n          _meta: {\n            ...(result as { _meta?: Record<string, unknown> })._meta,\n            viewUUID: crypto.randomUUID(),\n          },\n        }),\n      };\n    };\n  }\n\n  private computeViewVersionParam(viewName: string): string {\n    if (process.env.NODE_ENV !== \"production\") {\n      return \"\";\n    }\n    try {\n      const viewFile = this.lookupViewFile(viewName);\n      const styleFile = this.lookupDistFile(\"style.css\") ?? \"\";\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(viewFile)\n        .update(\"\\0\")\n        .update(styleFile)\n        .digest(\"hex\")\n        .slice(0, 8);\n      return `?v=${hash}`;\n    } catch {\n      return \"\";\n    }\n  }\n\n  private lookupViewFile(viewName: string) {\n    const manifest = this.readManifest();\n    for (const entry of Object.values(manifest)) {\n      if (entry?.isEntry && entry.name === viewName && entry.file) {\n        return entry.file;\n      }\n    }\n    throw new Error(\n      `View \"${viewName}\" not found in Vite manifest. Did the build complete successfully? Look for an entry with name \"${viewName}\" in dist/assets/.vite/manifest.json.`,\n    );\n  }\n\n  private lookupDistFile(key: string) {\n    const manifest = this.readManifest();\n    return manifest[key]?.file;\n  }\n\n  /**\n   * Inject the Vite manifest as a value rather than letting `readManifest()`\n   * load it from disk. Required for runtimes without a usable filesystem\n   * (Cloudflare Workers, etc.) — the user's `skybridge build` emits the\n   * manifest as a JS module which the entry imports and passes here.\n   */\n  setViteManifest(manifest: Record<string, { file: string }>): this {\n    this.viteManifest = manifest as Record<string, ViteManifestEntry>;\n    return this;\n  }\n\n  private readManifest(): Record<string, ViteManifestEntry> {\n    if (this.viteManifest) {\n      return this.viteManifest;\n    }\n    return JSON.parse(\n      readFileSync(\n        path.join(process.cwd(), \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        \"utf-8\",\n      ),\n    );\n  }\n\n  /**\n   * Register a tool. Pass a `config` describing the tool (name, schemas,\n   * optional {@link ViewConfig}, optional {@link ToolMeta}) and a handler that\n   * returns the tool's result.\n   *\n   * Chain calls to build up a server: each call returns a new `McpServer`\n   * type that captures the tool's input/output/`_meta` shape so the\n   * resulting `typeof server` can drive {@link generateHelpers}.\n   *\n   * The handler's return shape determines the output types: the\n   * `structuredContent` field becomes the tool's typed output, and `_meta`\n   * becomes its `responseMetadata`. The `content` field is normalized through\n   * {@link normalizeContent}.\n   *\n   * @example\n   * ```ts\n   * server.registerTool({\n   *   name: \"search\",\n   *   inputSchema: { query: z.string() },\n   *   outputSchema: { results: z.array(z.string()) },\n   *   view: { component: \"search\" },\n   * }, async ({ query }) => ({\n   *   content: `Found results for ${query}`,\n   *   structuredContent: { results: [...] },\n   * }));\n   * ```\n   *\n   * @see https://docs.skybridge.tech/api-reference/register-tool\n   */\n  registerTool<\n    TName extends string,\n    InputArgs extends ZodRawShapeCompat,\n    TReturn extends { content?: HandlerContent },\n  >(\n    config: ToolConfig<InputArgs> & { name: TName },\n    cb: ToolHandler<InputArgs, TReturn>,\n  ): AddTool<\n    TTools,\n    TName,\n    InputArgs,\n    ExtractStructuredContent<TReturn>,\n    ExtractMeta<TReturn>\n  >;\n  registerTool<InputArgs extends ZodRawShapeCompat>(\n    config: ToolConfig<InputArgs>,\n    cb: ToolHandler<InputArgs>,\n  ): this;\n  registerTool(...args: unknown[]): unknown {\n    const baseFn = McpServerBase.prototype.registerTool as (\n      ...args: unknown[]\n    ) => unknown;\n\n    if (typeof args[0] === \"string\") {\n      baseFn.call(this, args[0], args[1], args[2]);\n      return this;\n    }\n\n    const config = args[0] as ToolConfig<ZodRawShapeCompat>;\n    const cb = args[1] as ToolHandler<ZodRawShapeCompat>;\n\n    const {\n      name,\n      view,\n      securitySchemes,\n      _meta: userToolMeta,\n      ...toolFields\n    } = config;\n\n    const toolMeta: InternalToolMeta = { ...userToolMeta };\n\n    if (securitySchemes) {\n      // SEP-1488 puts `securitySchemes` at the top level of the tool\n      // descriptor, but the SDK's `registerTool` drops unknown top-level\n      // fields, so the canonical spot isn't reachable without intercepting\n      // `tools/list`. Use the `_meta` back-compat mirror documented in the\n      // Apps SDK reference until SEP-1488 lands in the spec.\n      toolMeta.securitySchemes = securitySchemes;\n    }\n\n    if (view) {\n      this.enforceOneToolPerView(view.component, name);\n      this.registerViewResources(name, view, toolMeta);\n    }\n\n    const wrappedCb = this.wrapHandler(cb, { attachViewUUID: Boolean(view) });\n\n    baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);\n\n    return this;\n  }\n}\n"]}

package/dist/server/view-resource-resolution.test.d.ts

@@ -0,0 +1,6 @@
+declare module "./server.js" {
+    interface ViewNameRegistry {
+        widget: true;
+    }
+}
+export {};

package/dist/server/view-resource-resolution.test.js

@@ -0,0 +1,88 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { afterEach, describe, expect, it } from "vitest";
+import { __setBuildManifest, McpServer } from "./index.js";
+// SKY-435: a view resource must resolve no matter the `?v=` query param value.
+// The version param is a content-derived cache key for external consumers
+// (it busts host/CDN caches when the bundle changes); it is not part of the
+// resource's identity, so a stale, absent, or arbitrary param must still serve
+// the underlying asset.
+async function connect(register) {
+    const server = new McpServer({ name: "test", version: "1.0.0" });
+    register(server);
+    const client = new Client({ name: "test-client", version: "1.0.0" });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    await server.connect(serverTransport);
+    await client.connect(clientTransport);
+    return {
+        client,
+        teardown: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
+function registerWidget(server) {
+    server.registerTool({ name: "show", description: "show", view: { component: "widget" } }, () => ({ content: [{ type: "text", text: "ok" }] }));
+}
+/** Narrow a read-resource content entry to its text variant. */
+function textContent(contents) {
+    return contents[0];
+}
+describe("view resource resolution (cache key)", () => {
+    afterEach(() => {
+        delete process.env.NODE_ENV;
+    });
+    it("resolves regardless of the ?v= param and echoes the requested URI", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        const { resources } = await client.listResources();
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        // Dev build advertises no cache key.
+        expect(listed?.uri).toBe("ui://views/apps-sdk/widget.html");
+        // A stale/arbitrary/absent param all resolve the same underlying asset,
+        // and the response echoes the URI the consumer asked for (never rewritten).
+        for (const uri of [
+            "ui://views/apps-sdk/widget.html?v=stale123",
+            "ui://views/apps-sdk/widget.html?v=whatever-else",
+            "ui://views/apps-sdk/widget.html",
+        ]) {
+            const { contents } = await client.readResource({ uri });
+            expect(contents).toHaveLength(1);
+            const content = textContent(contents);
+            expect(typeof content.text).toBe("string");
+            expect(content.text.length).toBeGreaterThan(0);
+            expect(content.uri).toBe(uri);
+        }
+        await teardown();
+    });
+    it("resolves a stale cache key when the canonical URI carries ?v= (prod)", async () => {
+        process.env.NODE_ENV = "production";
+        __setBuildManifest({
+            "src/views/widget.tsx": {
+                isEntry: true,
+                name: "widget",
+                file: "assets/widget-ABC123.js",
+            },
+            "style.css": { file: "assets/style-XYZ.css" },
+        });
+        const { client, teardown } = await connect(registerWidget);
+        const { resources } = await client.listResources();
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        // Production advertises a content-derived cache key.
+        expect(listed?.uri).toMatch(/^ui:\/\/views\/apps-sdk\/widget\.html\?v=[0-9a-f]{8}$/);
+        // A consumer holding a stale key still resolves the current asset.
+        const staleUri = "ui://views/apps-sdk/widget.html?v=00000000";
+        const { contents } = await client.readResource({ uri: staleUri });
+        expect(contents).toHaveLength(1);
+        const content = textContent(contents);
+        expect(typeof content.text).toBe("string");
+        expect(content.uri).toBe(staleUri);
+        await teardown();
+    });
+    it("still throws for an unknown view path", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        await expect(client.readResource({ uri: "ui://views/apps-sdk/nope.html?v=1" })).rejects.toThrow();
+        await teardown();
+    });
+});
+//# sourceMappingURL=view-resource-resolution.test.js.map

package/dist/server/view-resource-resolution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-resource-resolution.test.js","sourceRoot":"","sources":["../../src/server/view-resource-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU3D,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,wBAAwB;AAExB,KAAK,UAAU,OAAO,CAAC,QAAqC;IAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EACpE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,QAAgC;IAInD,OAAO,QAAQ,CAAC,CAAC,CAAkC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qCAAqC;QACrC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE5D,wEAAwE;QACxE,4EAA4E;QAC5E,KAAK,MAAM,GAAG,IAAI;YAChB,4CAA4C;YAC5C,iDAAiD;YACjD,iCAAiC;SAClC,EAAE,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qDAAqD;QACrD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CACzB,uDAAuD,CACxD,CAAC;QAEF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,MAAM,CACV,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAClE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\n// Mirror what the Skybridge Vite plugin generates in `.skybridge/views.d.ts`:\n// narrow `ViewName` so `component: \"widget\"` typechecks against the registry.\ndeclare module \"./server.js\" {\n  interface ViewNameRegistry {\n    widget: true;\n  }\n}\n\n// SKY-435: a view resource must resolve no matter the `?v=` query param value.\n// The version param is a content-derived cache key for external consumers\n// (it busts host/CDN caches when the bundle changes); it is not part of the\n// resource's identity, so a stale, absent, or arbitrary param must still serve\n// the underlying asset.\n\nasync function connect(register: (server: McpServer) => void) {\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const [clientTransport, serverTransport] =\n    InMemoryTransport.createLinkedPair();\n  await server.connect(serverTransport);\n  await client.connect(clientTransport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nfunction registerWidget(server: McpServer) {\n  server.registerTool(\n    { name: \"show\", description: \"show\", view: { component: \"widget\" } },\n    () => ({ content: [{ type: \"text\" as const, text: \"ok\" }] }),\n  );\n}\n\n/** Narrow a read-resource content entry to its text variant. */\nfunction textContent(contents: Array<{ uri: string }>): {\n  uri: string;\n  text: string;\n} {\n  return contents[0] as { uri: string; text: string };\n}\n\ndescribe(\"view resource resolution (cache key)\", () => {\n  afterEach(() => {\n    delete process.env.NODE_ENV;\n  });\n\n  it(\"resolves regardless of the ?v= param and echoes the requested URI\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/apps-sdk/widget.html\"),\n    );\n    // Dev build advertises no cache key.\n    expect(listed?.uri).toBe(\"ui://views/apps-sdk/widget.html\");\n\n    // A stale/arbitrary/absent param all resolve the same underlying asset,\n    // and the response echoes the URI the consumer asked for (never rewritten).\n    for (const uri of [\n      \"ui://views/apps-sdk/widget.html?v=stale123\",\n      \"ui://views/apps-sdk/widget.html?v=whatever-else\",\n      \"ui://views/apps-sdk/widget.html\",\n    ]) {\n      const { contents } = await client.readResource({ uri });\n      expect(contents).toHaveLength(1);\n      const content = textContent(contents);\n      expect(typeof content.text).toBe(\"string\");\n      expect(content.text.length).toBeGreaterThan(0);\n      expect(content.uri).toBe(uri);\n    }\n\n    await teardown();\n  });\n\n  it(\"resolves a stale cache key when the canonical URI carries ?v= (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/apps-sdk/widget.html\"),\n    );\n    // Production advertises a content-derived cache key.\n    expect(listed?.uri).toMatch(\n      /^ui:\\/\\/views\\/apps-sdk\\/widget\\.html\\?v=[0-9a-f]{8}$/,\n    );\n\n    // A consumer holding a stale key still resolves the current asset.\n    const staleUri = \"ui://views/apps-sdk/widget.html?v=00000000\";\n    const { contents } = await client.readResource({ uri: staleUri });\n    expect(contents).toHaveLength(1);\n    const content = textContent(contents);\n    expect(typeof content.text).toBe(\"string\");\n    expect(content.uri).toBe(staleUri);\n\n    await teardown();\n  });\n\n  it(\"still throws for an unknown view path\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    await expect(\n      client.readResource({ uri: \"ui://views/apps-sdk/nope.html?v=1\" }),\n    ).rejects.toThrow();\n\n    await teardown();\n  });\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skybridge",
-  "version": "0.0.0-dev.b0d461b",
+  "version": "0.0.0-dev.b0f7f92",
   "description": "Skybridge is a framework for building ChatGPT and MCP Apps",
   "repository": {
     "type": "git",
@@ -61,6 +61,7 @@
     "express": "^5.2.1",
     "handlebars": "^4.7.9",
     "ink": "^7.0.0",
+    "jose": "^6.1.3",
     "open": "^11.0.0",
     "posthog-node": "^5.28.9",
     "superjson": "^2.2.6",