skybridge 0.0.0-dev.be4ac5e → 0.0.0-dev.be78894

package/dist/commands/create.d.ts

@@ -0,0 +1,9 @@
+import { Command, type Command as CommandLoadable, Help } from "@oclif/core";
+export default class Create extends Command {
+    static description: string;
+    static strict: boolean;
+    run(): Promise<void>;
+}
+export declare class SkybridgeHelp extends Help {
+    showCommandHelp(command: CommandLoadable.Loadable): Promise<void>;
+}

package/dist/commands/create.js

@@ -0,0 +1,30 @@
+import { Command, Help } from "@oclif/core";
+import spawn from "cross-spawn";
+function passthrough(args) {
+    const { status, error } = spawn.sync("npx", ["--yes", "create-skybridge@latest", ...args], { stdio: "inherit" });
+    if (error) {
+        console.error(error);
+        process.exit(1);
+    }
+    process.exit(status ?? 1);
+}
+export default class Create extends Command {
+    static description = "Scaffold a new Skybridge project";
+    static strict = false;
+    async run() {
+        passthrough(this.argv);
+    }
+}
+// Registered as `oclif.helpClass` so that `skybridge create --help` forwards
+// to `create-skybridge --help` (single source of truth for the help text)
+// instead of rendering oclif's auto-generated help. All other commands fall
+// through to the default `Help` behaviour.
+export class SkybridgeHelp extends Help {
+    async showCommandHelp(command) {
+        if (command.id === "create") {
+            passthrough(["--help"]);
+        }
+        return super.showCommandHelp(command);
+    }
+}
+//# sourceMappingURL=create.js.map

package/dist/commands/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmC,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,MAAM,aAAa,CAAC;AAEhC,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAClC,KAAK,EACL,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,IAAI,CAAC,EAC7C,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAU,WAAW,GAAG,kCAAkC,CAAC;IACjE,MAAM,CAAU,MAAM,GAAG,KAAK,CAAC;IAExB,KAAK,CAAC,GAAG;QACd,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;;AAGH,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,OAAO,aAAc,SAAQ,IAAI;IAC5B,KAAK,CAAC,eAAe,CAC5B,OAAiC;QAEjC,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF","sourcesContent":["import { Command, type Command as CommandLoadable, Help } from \"@oclif/core\";\nimport spawn from \"cross-spawn\";\n\nfunction passthrough(args: string[]): never {\n  const { status, error } = spawn.sync(\n    \"npx\",\n    [\"--yes\", \"create-skybridge@latest\", ...args],\n    { stdio: \"inherit\" },\n  );\n  if (error) {\n    console.error(error);\n    process.exit(1);\n  }\n  process.exit(status ?? 1);\n}\n\nexport default class Create extends Command {\n  static override description = \"Scaffold a new Skybridge project\";\n  static override strict = false;\n\n  public async run(): Promise<void> {\n    passthrough(this.argv);\n  }\n}\n\n// Registered as `oclif.helpClass` so that `skybridge create --help` forwards\n// to `create-skybridge --help` (single source of truth for the help text)\n// instead of rendering oclif's auto-generated help. All other commands fall\n// through to the default `Help` behaviour.\nexport class SkybridgeHelp extends Help {\n  override async showCommandHelp(\n    command: CommandLoadable.Loadable,\n  ): Promise<void> {\n    if (command.id === \"create\") {\n      passthrough([\"--help\"]);\n    }\n    return super.showCommandHelp(command);\n  }\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.d.ts

@@ -1,4 +1,5 @@
 import type { Plugin } from "vite";
+export declare function isCssRequest(id: string): boolean;
 /**
  * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
  * so they work both locally and behind tunnels.

package/dist/server/asset-base-url-transform-plugin.js

@@ -1,3 +1,10 @@
+// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions
+// either at the end of the id or right before the query string. Catches both
+// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).
+const CSS_LANGS_RE = /\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
+export function isCssRequest(id) {
+    return CSS_LANGS_RE.test(id);
+}
 /**
  * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
  * so they work both locally and behind tunnels.
@@ -15,10 +22,18 @@ export function assetBaseUrlTransform(code) {
 export function assetBaseUrlTransformPlugin() {
     return {
         name: "asset-base-url-transform",
-        transform(code) {
+        transform(code, id) {
             if (!code) {
                 return null;
             }
+            // Vite serves CSS modules as JS that embeds the stylesheet as a string
+            // literal. Rewriting `url("/foo.woff2")` inside that string to a JS
+            // concatenation expression produces invalid CSS once it lands in a
+            // <style> tag. CSS asset URLs are already handled at build time by
+            // `experimental.renderBuiltUrl`, so skip CSS requests here.
+            if (isCssRequest(id)) {
+                return null;
+            }
             const transformedCode = assetBaseUrlTransform(code);
             if (transformedCode === code) {
                 return null;

package/dist/server/asset-base-url-transform-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;IAE/G,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACpE,OAAO,0CAA0C,SAAS,GAAG,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,SAAS,CAAC,IAAI;YACZ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\n\n/**\n * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,\n * so they work both locally and behind tunnels.\n */\nexport function assetBaseUrlTransform(code: string): string {\n  const assetStringPattern =\n    /(?<!\\bfrom\\s)(?<!https?:\\/\\/)([\"'`])(\\/[^\"'`]+\\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\\1/g;\n\n  code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {\n    return `(window.skybridge?.serverUrl ?? \"\") + \"${assetPath}\"`;\n  });\n\n  return code;\n}\n\n/**\n * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.\n */\nexport function assetBaseUrlTransformPlugin(): Plugin {\n  return {\n    name: \"asset-base-url-transform\",\n    transform(code) {\n      if (!code) {\n        return null;\n      }\n\n      const transformedCode = assetBaseUrlTransform(code);\n\n      if (transformedCode === code) {\n        return null;\n      }\n\n      return {\n        code: transformedCode,\n        map: null,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,6EAA6E;AAC7E,uFAAuF;AACvF,MAAM,YAAY,GAChB,6DAA6D,CAAC;AAEhE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;IAE/G,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACpE,OAAO,0CAA0C,SAAS,GAAG,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,SAAS,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\n\n// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions\n// either at the end of the id or right before the query string. Catches both\n// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).\nconst CSS_LANGS_RE =\n  /\\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\\?)/;\n\nexport function isCssRequest(id: string): boolean {\n  return CSS_LANGS_RE.test(id);\n}\n\n/**\n * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,\n * so they work both locally and behind tunnels.\n */\nexport function assetBaseUrlTransform(code: string): string {\n  const assetStringPattern =\n    /(?<!\\bfrom\\s)(?<!https?:\\/\\/)([\"'`])(\\/[^\"'`]+\\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\\1/g;\n\n  code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {\n    return `(window.skybridge?.serverUrl ?? \"\") + \"${assetPath}\"`;\n  });\n\n  return code;\n}\n\n/**\n * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.\n */\nexport function assetBaseUrlTransformPlugin(): Plugin {\n  return {\n    name: \"asset-base-url-transform\",\n    transform(code, id) {\n      if (!code) {\n        return null;\n      }\n\n      // Vite serves CSS modules as JS that embeds the stylesheet as a string\n      // literal. Rewriting `url(\"/foo.woff2\")` inside that string to a JS\n      // concatenation expression produces invalid CSS once it lands in a\n      // <style> tag. CSS asset URLs are already handled at build time by\n      // `experimental.renderBuiltUrl`, so skip CSS requests here.\n      if (isCssRequest(id)) {\n        return null;\n      }\n\n      const transformedCode = assetBaseUrlTransform(code);\n\n      if (transformedCode === code) {\n        return null;\n      }\n\n      return {\n        code: transformedCode,\n        map: null,\n      };\n    },\n  };\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { assetBaseUrlTransform } from "./asset-base-url-transform-plugin.js";
+import { assetBaseUrlTransform, assetBaseUrlTransformPlugin, isCssRequest, } from "./asset-base-url-transform-plugin.js";
 describe("assetBaseUrlTransform", () => {
     it("should transform asset paths to use window.skybridge.serverUrl", () => {
         const cases = [
@@ -81,4 +81,54 @@ describe("assetBaseUrlTransform", () => {
         expect(result).toContain(`const logo = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`);
     });
 });
+describe("isCssRequest", () => {
+    it("returns true for CSS-family extensions", () => {
+        expect(isCssRequest("/src/styles.css")).toBe(true);
+        expect(isCssRequest("/src/styles.module.css")).toBe(true);
+        expect(isCssRequest("/src/styles.scss")).toBe(true);
+        expect(isCssRequest("/src/styles.sass")).toBe(true);
+        expect(isCssRequest("/src/styles.less")).toBe(true);
+        expect(isCssRequest("/src/styles.styl")).toBe(true);
+    });
+    it("returns true for CSS modules with Vite query strings", () => {
+        expect(isCssRequest("/src/styles.css?direct")).toBe(true);
+        expect(isCssRequest("/src/styles.css?inline")).toBe(true);
+        expect(isCssRequest("/src/styles.css?used")).toBe(true);
+        expect(isCssRequest("/src/Foo.vue?vue&type=style&lang.css")).toBe(true);
+    });
+    it("returns false for non-CSS modules", () => {
+        expect(isCssRequest("/src/index.tsx")).toBe(false);
+        expect(isCssRequest("/src/utils.ts")).toBe(false);
+        expect(isCssRequest("/src/Logo.svg")).toBe(false);
+        expect(isCssRequest("/src/notes.cssx")).toBe(false);
+    });
+});
+describe("assetBaseUrlTransformPlugin", () => {
+    function runTransform(id, code) {
+        const plugin = assetBaseUrlTransformPlugin();
+        const hook = plugin.transform;
+        if (!hook) {
+            throw new Error("plugin.transform is not defined");
+        }
+        const handler = typeof hook === "function" ? hook : hook.handler;
+        return handler.call(
+        // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook
+        {}, code, id, { moduleType: "js" });
+    }
+    it("rewrites asset paths in JS modules", () => {
+        const result = runTransform("/src/widget.tsx", `const logo = "/assets/logo.png";`);
+        expect(result?.code).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+    });
+    // Reproducer for #697: CSS imports are served as JS modules with the
+    // stylesheet embedded as a string. Rewriting url("/foo.woff2") inside that
+    // string would produce invalid CSS once the styles are injected.
+    it("does not rewrite asset paths when transforming a CSS module", () => {
+        const cssCode = `__vite__updateStyle("style-id", "@font-face { src: url(\\"/fonts/Brand.woff2\\") format(\\"woff2\\"); }");`;
+        expect(runTransform("/src/fonts.css", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?direct", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?inline", cssCode)).toBeNull();
+        expect(runTransform("/src/styles.scss", cssCode)).toBeNull();
+        expect(runTransform("/src/Foo.vue?vue&type=style&lang.css", cssCode)).toBeNull();
+    });
+});
 //# sourceMappingURL=asset-base-url-transform-plugin.test.js.map

package/dist/server/asset-base-url-transform-plugin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { assetBaseUrlTransform } from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n"]}
+{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,GACb,MAAM,sCAAsC,CAAC;AAE9C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAG3C,SAAS,YAAY,CAAC,EAAU,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,OAAO,CAAC,IAAI;QACjB,6EAA6E;QAC7E,EAAS,EACT,IAAI,EACJ,EAAE,EACF,EAAE,UAAU,EAAE,IAAI,EAAE,CACF,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CACzB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,4GAA4G,CAAC;QAE7H,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,CACJ,YAAY,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  assetBaseUrlTransform,\n  assetBaseUrlTransformPlugin,\n  isCssRequest,\n} from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n\ndescribe(\"isCssRequest\", () => {\n  it(\"returns true for CSS-family extensions\", () => {\n    expect(isCssRequest(\"/src/styles.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.module.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.scss\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.sass\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.less\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.styl\")).toBe(true);\n  });\n\n  it(\"returns true for CSS modules with Vite query strings\", () => {\n    expect(isCssRequest(\"/src/styles.css?direct\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?inline\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?used\")).toBe(true);\n    expect(isCssRequest(\"/src/Foo.vue?vue&type=style&lang.css\")).toBe(true);\n  });\n\n  it(\"returns false for non-CSS modules\", () => {\n    expect(isCssRequest(\"/src/index.tsx\")).toBe(false);\n    expect(isCssRequest(\"/src/utils.ts\")).toBe(false);\n    expect(isCssRequest(\"/src/Logo.svg\")).toBe(false);\n    expect(isCssRequest(\"/src/notes.cssx\")).toBe(false);\n  });\n});\n\ndescribe(\"assetBaseUrlTransformPlugin\", () => {\n  type TransformResult = { code: string; map: null } | null;\n\n  function runTransform(id: string, code: string): TransformResult {\n    const plugin = assetBaseUrlTransformPlugin();\n    const hook = plugin.transform;\n    if (!hook) {\n      throw new Error(\"plugin.transform is not defined\");\n    }\n    const handler = typeof hook === \"function\" ? hook : hook.handler;\n    return handler.call(\n      // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook\n      {} as any,\n      code,\n      id,\n      { moduleType: \"js\" },\n    ) as TransformResult;\n  }\n\n  it(\"rewrites asset paths in JS modules\", () => {\n    const result = runTransform(\n      \"/src/widget.tsx\",\n      `const logo = \"/assets/logo.png\";`,\n    );\n    expect(result?.code).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n  });\n\n  // Reproducer for #697: CSS imports are served as JS modules with the\n  // stylesheet embedded as a string. Rewriting url(\"/foo.woff2\") inside that\n  // string would produce invalid CSS once the styles are injected.\n  it(\"does not rewrite asset paths when transforming a CSS module\", () => {\n    const cssCode = `__vite__updateStyle(\"style-id\", \"@font-face { src: url(\\\\\"/fonts/Brand.woff2\\\\\") format(\\\\\"woff2\\\\\"); }\");`;\n\n    expect(runTransform(\"/src/fonts.css\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?direct\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?inline\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/styles.scss\", cssCode)).toBeNull();\n    expect(\n      runTransform(\"/src/Foo.vue?vue&type=style&lang.css\", cssCode),\n    ).toBeNull();\n  });\n});\n"]}

package/dist/server/auth.d.ts

@@ -0,0 +1,20 @@
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import type { RequestHandler } from "express";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+export type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;

package/dist/server/auth.js

@@ -0,0 +1,28 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export function optionalBearerAuth(options) {
+    const required = requireBearerAuth(options);
+    return (req, res, next) => {
+        if (!req.headers.authorization) {
+            next();
+            return;
+        }
+        return required(req, res, next);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n  type AuthMetadataOptions,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nexport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/content-helpers.d.ts

@@ -1,12 +1,46 @@
 import type { AudioContent, EmbeddedResource, ImageContent, ResourceLink, TextContent } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * MCP content annotations applied to any returned block.
+ *
+ * - `audience` — who is meant to see the content (`"user"`, `"assistant"`, or both).
+ * - `priority` — relative importance hint for the host.
+ * - `lastModified` — ISO timestamp for when the content was produced.
+ */
 type ContentAnnotations = {
     audience?: ("user" | "assistant")[];
     priority?: number;
     lastModified?: string;
 };
+/**
+ * Build an MCP text content block.
+ *
+ * @example
+ * ```ts
+ * return { content: [text("Found 3 results.")] };
+ * ```
+ */
 export declare function text(value: string, annotations?: ContentAnnotations): TextContent;
+/**
+ * Build an MCP image content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**. Passing a raw byte-string will produce invalid
+ * content.
+ */
 export declare function image(data: string | Uint8Array, mimeType: string, annotations?: ContentAnnotations): ImageContent;
+/**
+ * Build an MCP audio content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**.
+ */
 export declare function audio(data: string | Uint8Array, mimeType: string, annotations?: ContentAnnotations): AudioContent;
+/**
+ * Build an MCP embedded resource — the full content travels inline. Use this
+ * when the client needs the bytes themselves rather than a link.
+ *
+ * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).
+ */
 export declare function embeddedResource(resource: {
     uri: string;
     mimeType?: string;
@@ -16,6 +50,12 @@ export declare function embeddedResource(resource: {
     mimeType?: string;
     blob: string;
 }, annotations?: ContentAnnotations): EmbeddedResource;
+/**
+ * Build an MCP resource link — a `type: "resource_link"` block carrying a URI
+ * the client can fetch (or subscribe to) on demand. Use a link when the
+ * client should retrieve the bytes itself; use {@link embeddedResource} when
+ * the content must travel inline with the response.
+ */
 export declare function resourceLink(link: {
     uri: string;
     name: string;

package/dist/server/content-helpers.js

@@ -10,9 +10,24 @@ function toBase64(data) {
     }
     return Buffer.from(data).toString("base64");
 }
+/**
+ * Build an MCP text content block.
+ *
+ * @example
+ * ```ts
+ * return { content: [text("Found 3 results.")] };
+ * ```
+ */
 export function text(value, annotations) {
     return { type: "text", text: value, ...(annotations && { annotations }) };
 }
+/**
+ * Build an MCP image content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**. Passing a raw byte-string will produce invalid
+ * content.
+ */
 export function image(data, mimeType, annotations) {
     return {
         type: "image",
@@ -21,6 +36,12 @@ export function image(data, mimeType, annotations) {
         ...(annotations && { annotations }),
     };
 }
+/**
+ * Build an MCP audio content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**.
+ */
 export function audio(data, mimeType, annotations) {
     return {
         type: "audio",
@@ -29,6 +50,12 @@ export function audio(data, mimeType, annotations) {
         ...(annotations && { annotations }),
     };
 }
+/**
+ * Build an MCP embedded resource — the full content travels inline. Use this
+ * when the client needs the bytes themselves rather than a link.
+ *
+ * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).
+ */
 export function embeddedResource(resource, annotations) {
     return {
         type: "resource",
@@ -36,6 +63,12 @@ export function embeddedResource(resource, annotations) {
         ...(annotations && { annotations }),
     };
 }
+/**
+ * Build an MCP resource link — a `type: "resource_link"` block carrying a URI
+ * the client can fetch (or subscribe to) on demand. Use a link when the
+ * client should retrieve the bytes itself; use {@link embeddedResource} when
+ * the content must travel inline with the response.
+ */
 export function resourceLink(link, annotations) {
     return {
         type: "resource_link",

package/dist/server/content-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-helpers.js","sourceRoot":"","sources":["../../src/server/content-helpers.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAyB;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,WAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAEoD,EACpD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAOC,EACD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AudioContent,\n  EmbeddedResource,\n  ImageContent,\n  ResourceLink,\n  TextContent,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\ntype ContentAnnotations = {\n  audience?: (\"user\" | \"assistant\")[];\n  priority?: number;\n  lastModified?: string;\n};\n\n/**\n * Returns a base64-encoded string.\n * - `Uint8Array` input is encoded via `Buffer.toString(\"base64\")`.\n * - `string` input is assumed to be **already base64-encoded** and is returned\n *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.\n */\nfunction toBase64(data: string | Uint8Array): string {\n  if (typeof data === \"string\") {\n    return data;\n  }\n  return Buffer.from(data).toString(\"base64\");\n}\n\nexport function text(\n  value: string,\n  annotations?: ContentAnnotations,\n): TextContent {\n  return { type: \"text\", text: value, ...(annotations && { annotations }) };\n}\n\nexport function image(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): ImageContent {\n  return {\n    type: \"image\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\nexport function audio(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): AudioContent {\n  return {\n    type: \"audio\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\nexport function embeddedResource(\n  resource:\n    | { uri: string; mimeType?: string; text: string }\n    | { uri: string; mimeType?: string; blob: string },\n  annotations?: ContentAnnotations,\n): EmbeddedResource {\n  return {\n    type: \"resource\",\n    resource,\n    ...(annotations && { annotations }),\n  };\n}\n\nexport function resourceLink(\n  link: {\n    uri: string;\n    name: string;\n    title?: string;\n    description?: string;\n    mimeType?: string;\n    size?: number;\n  },\n  annotations?: ContentAnnotations,\n): ResourceLink {\n  return {\n    type: \"resource_link\",\n    ...link,\n    ...(annotations && { annotations }),\n  };\n}\n"]}
+{"version":3,"file":"content-helpers.js","sourceRoot":"","sources":["../../src/server/content-helpers.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAyB;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,WAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAEoD,EACpD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAOC,EACD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AudioContent,\n  EmbeddedResource,\n  ImageContent,\n  ResourceLink,\n  TextContent,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\n/**\n * MCP content annotations applied to any returned block.\n *\n * - `audience` — who is meant to see the content (`\"user\"`, `\"assistant\"`, or both).\n * - `priority` — relative importance hint for the host.\n * - `lastModified` — ISO timestamp for when the content was produced.\n */\ntype ContentAnnotations = {\n  audience?: (\"user\" | \"assistant\")[];\n  priority?: number;\n  lastModified?: string;\n};\n\n/**\n * Returns a base64-encoded string.\n * - `Uint8Array` input is encoded via `Buffer.toString(\"base64\")`.\n * - `string` input is assumed to be **already base64-encoded** and is returned\n *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.\n */\nfunction toBase64(data: string | Uint8Array): string {\n  if (typeof data === \"string\") {\n    return data;\n  }\n  return Buffer.from(data).toString(\"base64\");\n}\n\n/**\n * Build an MCP text content block.\n *\n * @example\n * ```ts\n * return { content: [text(\"Found 3 results.\")] };\n * ```\n */\nexport function text(\n  value: string,\n  annotations?: ContentAnnotations,\n): TextContent {\n  return { type: \"text\", text: value, ...(annotations && { annotations }) };\n}\n\n/**\n * Build an MCP image content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**. Passing a raw byte-string will produce invalid\n * content.\n */\nexport function image(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): ImageContent {\n  return {\n    type: \"image\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP audio content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**.\n */\nexport function audio(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): AudioContent {\n  return {\n    type: \"audio\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP embedded resource — the full content travels inline. Use this\n * when the client needs the bytes themselves rather than a link.\n *\n * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).\n */\nexport function embeddedResource(\n  resource:\n    | { uri: string; mimeType?: string; text: string }\n    | { uri: string; mimeType?: string; blob: string },\n  annotations?: ContentAnnotations,\n): EmbeddedResource {\n  return {\n    type: \"resource\",\n    resource,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP resource link — a `type: \"resource_link\"` block carrying a URI\n * the client can fetch (or subscribe to) on demand. Use a link when the\n * client should retrieve the bytes itself; use {@link embeddedResource} when\n * the content must travel inline with the response.\n */\nexport function resourceLink(\n  link: {\n    uri: string;\n    name: string;\n    title?: string;\n    description?: string;\n    mimeType?: string;\n    size?: number;\n  },\n  annotations?: ContentAnnotations,\n): ResourceLink {\n  return {\n    type: \"resource_link\",\n    ...link,\n    ...(annotations && { annotations }),\n  };\n}\n"]}

package/dist/server/file-ref.d.ts

@@ -1,8 +1,28 @@
 import { z } from "zod";
+/**
+ * Zod schema for a host-managed file reference passed between tools and views.
+ *
+ * Use it inside a tool's `inputSchema` or `outputSchema` so the host can
+ * recognize the field as a file and surface attach / preview affordances.
+ *
+ * @example
+ * ```ts
+ * server.registerTool({
+ *   name: "summarize-document",
+ *   inputSchema: { document: FileRef },
+ * }, async ({ document }) => {
+ *   const res = await fetch(document.download_url);
+ *   // …
+ * });
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/file-ref
+ */
 export declare const FileRef: z.ZodObject<{
     file_id: z.ZodString;
     download_url: z.ZodString;
     mime_type: z.ZodOptional<z.ZodString>;
     file_name: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** Inferred TypeScript type for {@link FileRef}. */
 export type FileRef = z.infer<typeof FileRef>;

package/dist/server/file-ref.js

@@ -1,4 +1,23 @@
 import { z } from "zod";
+/**
+ * Zod schema for a host-managed file reference passed between tools and views.
+ *
+ * Use it inside a tool's `inputSchema` or `outputSchema` so the host can
+ * recognize the field as a file and surface attach / preview affordances.
+ *
+ * @example
+ * ```ts
+ * server.registerTool({
+ *   name: "summarize-document",
+ *   inputSchema: { document: FileRef },
+ * }, async ({ document }) => {
+ *   const res = await fetch(document.download_url);
+ *   // …
+ * });
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/file-ref
+ */
 export const FileRef = z.object({
     file_id: z.string(),
     download_url: z.string(),

package/dist/server/file-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-ref.js","sourceRoot":"","sources":["../../src/server/file-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nexport const FileRef = z.object({\n  file_id: z.string(),\n  download_url: z.string(),\n  mime_type: z.string().optional(),\n  file_name: z.string().optional(),\n});\n\nexport type FileRef = z.infer<typeof FileRef>;\n"]}
+{"version":3,"file":"file-ref.js","sourceRoot":"","sources":["../../src/server/file-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * Zod schema for a host-managed file reference passed between tools and views.\n *\n * Use it inside a tool's `inputSchema` or `outputSchema` so the host can\n * recognize the field as a file and surface attach / preview affordances.\n *\n * @example\n * ```ts\n * server.registerTool({\n *   name: \"summarize-document\",\n *   inputSchema: { document: FileRef },\n * }, async ({ document }) => {\n *   const res = await fetch(document.download_url);\n *   // …\n * });\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/file-ref\n */\nexport const FileRef = z.object({\n  file_id: z.string(),\n  download_url: z.string(),\n  mime_type: z.string().optional(),\n  file_name: z.string().optional(),\n});\n\n/** Inferred TypeScript type for {@link FileRef}. */\nexport type FileRef = z.infer<typeof FileRef>;\n"]}

package/dist/server/index.d.ts

@@ -1,7 +1,8 @@
+export { type AuthInfo, type AuthMetadataOptions, type BearerAuthMiddlewareOptions, InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
 export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
 export { FileRef } from "./file-ref.js";
 export type { AnyToolRegistry, InferTools, ToolInput, ToolNames, ToolOutput, ToolResponseMetadata, } from "./inferUtilityTypes.js";
 export type { McpExtra, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard, } from "./middleware.js";
-export type { HandlerContent, KnownToolMeta, McpServerTypes, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
+export type { HandlerContent, KnownToolMeta, McpServerTypes, SecurityScheme, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
 export { McpServer, normalizeContent, } from "./server.js";
 export { viewsDevServer } from "./viewsDevServer.js";

package/dist/server/index.js

@@ -1,3 +1,4 @@
+export { InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
 export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
 export { FileRef } from "./file-ref.js";
 export { McpServer, normalizeContent, } from "./server.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA8BxC,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  KnownToolMeta,\n  McpServerTypes,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA+BxC,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  type AuthInfo,\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  InvalidTokenError,\n  mcpAuthMetadataRouter,\n  optionalBearerAuth,\n  requireBearerAuth,\n} from \"./auth.js\";\nexport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  KnownToolMeta,\n  McpServerTypes,\n  SecurityScheme,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}

package/dist/server/middleware.d.ts

@@ -19,7 +19,12 @@ export type McpMiddlewareFn = (request: {
  * MCP methods the server handles (incoming from client).
  */
 export type McpMethodString = ClientRequest["method"] | ClientNotification["method"];
-/** Extract params type for a specific MCP method from SDK unions. */
+/**
+ * Resolve the `params` type for a specific MCP method (request or notification)
+ * from the SDK's typed unions. Falls back to `Record<string, unknown>` for
+ * unknown methods. Used by {@link McpTypedMiddlewareFn} to narrow the request
+ * shape in typed middleware.
+ */
 export type McpRequestParams<M extends string> = Extract<ClientRequest, {
     method: M;
 }> extends {
@@ -29,7 +34,11 @@ export type McpRequestParams<M extends string> = Extract<ClientRequest, {
 }> extends {
     params: infer P;
 } ? P : Record<string, unknown>;
-/** Resolve extra type: McpExtra for requests, undefined for notifications. */
+/**
+ * Resolve the `extra` arg type for a specific MCP method: {@link McpExtra} for
+ * request methods, `undefined` for notification methods (the SDK does not
+ * pass extra context for notifications).
+ */
 export type McpExtraFor<M extends string> = M extends ClientRequest["method"] ? McpExtra : M extends ClientNotification["method"] ? undefined : McpExtra | undefined;
 /** Maps each MCP request method to its SDK result type. */
 interface McpResultMap {
@@ -59,7 +68,11 @@ interface McpResultMap {
  * For unknown/unmatched methods, falls back to `ServerResult`.
  */
 export type McpResultFor<M extends string> = M extends keyof McpResultMap ? McpResultMap[M] : M extends `${infer Prefix}/*` ? [McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]] extends [never] ? M extends ToWildcard<ClientNotification["method"]> ? undefined : ServerResult : McpResultMap[keyof McpResultMap & `${Prefix}/${string}`] : M extends ClientNotification["method"] ? undefined : ServerResult;
-/** Typed middleware fn for a specific method — narrows params, extra, and next() result. */
+/**
+ * Typed middleware function for a specific method. Narrows `request.params`
+ * via {@link McpRequestParams}, `extra` via {@link McpExtraFor}, and the
+ * resolved value of `next()` via {@link McpResultFor}.
+ */
 export type McpTypedMiddlewareFn<M extends string> = (request: {
     method: M;
     params: McpRequestParams<M>;

package/dist/server/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAyJA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAW,MAAM,CAAC;IAE3B,IACE,CAAC,CAAC,kBAAkB,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,YAAY,GAAG,CAAC;QACnE,CAAC,CACC,uBAAuB,IAAI,GAAG,IAAI,GAAG,CAAC,qBAAqB,YAAY,GAAG,CAC3E,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,GAAG,CAAC,gBAA8B;QACnD,oBAAoB,EAAE,GAAG,CAAC,qBAAmC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,MAAc,EACd,cAAuB;IAEvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,cAAc,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,KAAK,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,MAAkC,EAClC,cAAuB;IAEvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7B,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,cAAuB,EACvB,eAAyD,EACzD,OAA6B;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CACvD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;QAClE,4DAA4D;QAC5D,iEAAiE;QACjE,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAc,CAAC;QACjE,MAAM,UAAU,GAAG;YACjB,MAAM;YACN,MAAM,EAAG,UAAU,EAAE,MAAkC,IAAI,EAAE;SAC9D,CAAC;QAEF,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,YAAY,GAAG,GAAqB,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBACxC,CAAC;gBACD,OAAO,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,MAAM,IAAI,GAAG,GAAqB,EAAE;gBAClC,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,GAAG,CAC7D,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC,CAAC;YAEF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  CallToolResult,\n  CancelTaskResult,\n  ClientNotification,\n  ClientRequest,\n  CompleteResult,\n  EmptyResult,\n  GetPromptResult,\n  GetTaskPayloadResult,\n  GetTaskResult,\n  InitializeResult,\n  ListPromptsResult,\n  ListResourcesResult,\n  ListResourceTemplatesResult,\n  ListTasksResult,\n  ListToolsResult,\n  ReadResourceResult,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\n/**\n * The `extra` context object provided by the MCP SDK to request handlers.\n */\nexport type McpExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;\n\n/**\n * A single MCP middleware function following the onion model.\n * Call `next()` to invoke the next middleware or the final handler.\n * For notifications, `extra` is `undefined` (SDK does not provide extra context)\n * and `next()` resolves to `undefined`.\n */\nexport type McpMiddlewareFn = (\n  request: { method: string; params: Record<string, unknown> },\n  extra: McpExtra | undefined,\n  next: () => Promise<unknown>,\n) => Promise<unknown> | unknown;\n\n/**\n * MCP methods the server handles (incoming from client).\n */\nexport type McpMethodString =\n  | ClientRequest[\"method\"]\n  | ClientNotification[\"method\"];\n\n/** Extract params type for a specific MCP method from SDK unions. */\nexport type McpRequestParams<M extends string> =\n  Extract<ClientRequest, { method: M }> extends { params: infer P }\n    ? P\n    : Extract<ClientNotification, { method: M }> extends { params: infer P }\n      ? P\n      : Record<string, unknown>;\n\n/** Resolve extra type: McpExtra for requests, undefined for notifications. */\nexport type McpExtraFor<M extends string> = M extends ClientRequest[\"method\"]\n  ? McpExtra\n  : M extends ClientNotification[\"method\"]\n    ? undefined\n    : McpExtra | undefined;\n\n/** Maps each MCP request method to its SDK result type. */\ninterface McpResultMap {\n  ping: EmptyResult;\n  initialize: InitializeResult;\n  \"tools/list\": ListToolsResult;\n  \"tools/call\": CallToolResult;\n  \"resources/list\": ListResourcesResult;\n  \"resources/templates/list\": ListResourceTemplatesResult;\n  \"resources/read\": ReadResourceResult;\n  \"resources/subscribe\": EmptyResult;\n  \"resources/unsubscribe\": EmptyResult;\n  \"prompts/list\": ListPromptsResult;\n  \"prompts/get\": GetPromptResult;\n  \"completion/complete\": CompleteResult;\n  \"logging/setLevel\": EmptyResult;\n  \"tasks/get\": GetTaskResult;\n  \"tasks/result\": GetTaskPayloadResult;\n  \"tasks/list\": ListTasksResult;\n  \"tasks/cancel\": CancelTaskResult;\n}\n\n/**\n * Map an MCP method string to its corresponding result type.\n * For request methods, resolves to the specific SDK result type.\n * For wildcard patterns (e.g. `\"tools/*\"`), resolves to the union of matching result types.\n * For notification methods, resolves to `undefined`.\n * For unknown/unmatched methods, falls back to `ServerResult`.\n */\nexport type McpResultFor<M extends string> = M extends keyof McpResultMap\n  ? McpResultMap[M]\n  : M extends `${infer Prefix}/*`\n    ? [McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]] extends [never]\n      ? M extends ToWildcard<ClientNotification[\"method\"]>\n        ? undefined\n        : ServerResult\n      : McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]\n    : M extends ClientNotification[\"method\"]\n      ? undefined\n      : ServerResult;\n\n/** Typed middleware fn for a specific method — narrows params, extra, and next() result. */\nexport type McpTypedMiddlewareFn<M extends string> = (\n  request: { method: M; params: McpRequestParams<M> },\n  extra: McpExtraFor<M>,\n  next: () => Promise<McpResultFor<M>>,\n) => Promise<unknown> | unknown;\n\n/** Extracts `\"prefix/*\"` from `\"prefix/anything\"` — distributive over unions. */\ntype ToWildcard<T extends string> = T extends `${infer Prefix}/${string}`\n  ? `${Prefix}/*`\n  : never;\n\n/** Wildcard prefixes derived from method strings (e.g. `\"tools/*\"` from `\"tools/call\"`). */\nexport type McpWildcard = ToWildcard<McpMethodString>;\n\n/** Category keywords matching all requests or all notifications. */\ntype McpCategory = \"request\" | \"notification\";\n\n/**\n * A single filter pattern for MCP middleware:\n * - Exact method: `\"tools/call\"`\n * - Wildcard: `\"tools/*\"`\n * - Category: `\"request\"` | `\"notification\"`\n * - Escape hatch: arbitrary string via `string & {}`\n */\ntype McpMiddlewareFilterPattern =\n  | McpMethodString\n  | McpWildcard\n  | McpCategory\n  | (string & {});\n\n/**\n * Filter determining which MCP methods a middleware applies to.\n * A single pattern or an array of patterns (OR logic).\n */\nexport type McpMiddlewareFilter =\n  | McpMiddlewareFilterPattern\n  | McpMiddlewareFilterPattern[];\n\n/**\n * Internal entry stored for each registered middleware.\n * `filter: null` means catch-all (matches everything).\n */\nexport type McpMiddlewareEntry = {\n  filter: McpMiddlewareFilter | null;\n  handler: McpMiddlewareFn;\n};\n\ntype HandlerMap = Map<string, (...args: unknown[]) => Promise<unknown>>;\n\n/**\n * Extract the TS-private `_requestHandlers` and `_notificationHandlers` maps\n * from the SDK's `Server` (extends `Protocol`). These are runtime-accessible\n * but declared `private` in TypeScript.\n *\n * Validates with `instanceof Map` so an incompatible SDK version fails fast\n * instead of silently breaking.\n */\nexport function getHandlerMaps(server: Server) {\n  const obj: object = server;\n\n  if (\n    !(\"_requestHandlers\" in obj && obj._requestHandlers instanceof Map) ||\n    !(\n      \"_notificationHandlers\" in obj && obj._notificationHandlers instanceof Map\n    )\n  ) {\n    throw new Error(\n      \"Incompatible MCP SDK version: expected _requestHandlers and _notificationHandlers on Server\",\n    );\n  }\n\n  return {\n    requestHandlers: obj._requestHandlers as HandlerMap,\n    notificationHandlers: obj._notificationHandlers as HandlerMap,\n  };\n}\n\n/**\n * Check if a single filter pattern matches a given method.\n *\n * - Exact: `\"tools/call\"` matches only `\"tools/call\"`\n * - Wildcard: `\"tools/*\"` matches any method starting with `\"tools/\"`\n * - Category `\"request\"`: matches when `isNotification` is false\n * - Category `\"notification\"`: matches when `isNotification` is true\n */\nexport function matchesFilter(\n  method: string,\n  filter: string,\n  isNotification: boolean,\n): boolean {\n  if (filter === \"request\") {\n    return !isNotification;\n  }\n  if (filter === \"notification\") {\n    return isNotification;\n  }\n  if (filter.endsWith(\"/*\")) {\n    const prefix = filter.slice(0, -1); // \"tools/*\" → \"tools/\"\n    return method.startsWith(prefix);\n  }\n  return method === filter;\n}\n\nfunction matchesAnyFilter(\n  method: string,\n  filter: McpMiddlewareFilter | null,\n  isNotification: boolean,\n): boolean {\n  if (filter === null) {\n    return true;\n  }\n  if (typeof filter === \"string\") {\n    return matchesFilter(method, filter, isNotification);\n  }\n  return filter.some((pattern) =>\n    matchesFilter(method, pattern, isNotification),\n  );\n}\n\n/**\n * Build an onion-model middleware chain for a specific method.\n *\n * Filters `entries` to those matching `method`, then composes them\n * so the first registered middleware is the outermost layer.\n * `next()` is guarded against multiple calls within a single middleware.\n */\nexport function buildMiddlewareChain(\n  method: string,\n  isNotification: boolean,\n  originalHandler: (...args: unknown[]) => Promise<unknown>,\n  entries: McpMiddlewareEntry[],\n) {\n  const applicable = entries.filter((entry) =>\n    matchesAnyFilter(method, entry.filter, isNotification),\n  );\n\n  if (applicable.length === 0) {\n    return originalHandler;\n  }\n\n  return (...args: unknown[]) => {\n    const rawRequest = args[0] as Record<string, unknown> | undefined;\n    // SDK calls request handlers as handler(request, extra) but\n    // notification handlers as handler(notification) — no extra arg.\n    const extra = isNotification ? undefined : (args[1] as McpExtra);\n    const mcpRequest = {\n      method,\n      params: (rawRequest?.params as Record<string, unknown>) ?? {},\n    };\n\n    let index = 0;\n\n    const executeLayer = (): Promise<unknown> => {\n      const entry = applicable[index++];\n      if (!entry) {\n        if (rawRequest) {\n          rawRequest.params = mcpRequest.params;\n        }\n        return originalHandler(...args);\n      }\n\n      let nextCalled = false;\n\n      const next = (): Promise<unknown> => {\n        if (nextCalled) {\n          throw new Error(\n            `next() called multiple times in middleware for \"${method}\"`,\n          );\n        }\n        nextCalled = true;\n        return executeLayer();\n      };\n\n      return Promise.resolve(entry.handler(mcpRequest, extra, next));\n    };\n\n    return executeLayer();\n  };\n}\n"]}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAsKA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAW,MAAM,CAAC;IAE3B,IACE,CAAC,CAAC,kBAAkB,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,YAAY,GAAG,CAAC;QACnE,CAAC,CACC,uBAAuB,IAAI,GAAG,IAAI,GAAG,CAAC,qBAAqB,YAAY,GAAG,CAC3E,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,GAAG,CAAC,gBAA8B;QACnD,oBAAoB,EAAE,GAAG,CAAC,qBAAmC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,MAAc,EACd,cAAuB;IAEvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,cAAc,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,KAAK,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,MAAkC,EAClC,cAAuB;IAEvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7B,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,cAAuB,EACvB,eAAyD,EACzD,OAA6B;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CACvD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;QAClE,4DAA4D;QAC5D,iEAAiE;QACjE,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAc,CAAC;QACjE,MAAM,UAAU,GAAG;YACjB,MAAM;YACN,MAAM,EAAG,UAAU,EAAE,MAAkC,IAAI,EAAE;SAC9D,CAAC;QAEF,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,YAAY,GAAG,GAAqB,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBACxC,CAAC;gBACD,OAAO,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,MAAM,IAAI,GAAG,GAAqB,EAAE;gBAClC,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,GAAG,CAC7D,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC,CAAC;YAEF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  CallToolResult,\n  CancelTaskResult,\n  ClientNotification,\n  ClientRequest,\n  CompleteResult,\n  EmptyResult,\n  GetPromptResult,\n  GetTaskPayloadResult,\n  GetTaskResult,\n  InitializeResult,\n  ListPromptsResult,\n  ListResourcesResult,\n  ListResourceTemplatesResult,\n  ListTasksResult,\n  ListToolsResult,\n  ReadResourceResult,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\n/**\n * The `extra` context object provided by the MCP SDK to request handlers.\n */\nexport type McpExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;\n\n/**\n * A single MCP middleware function following the onion model.\n * Call `next()` to invoke the next middleware or the final handler.\n * For notifications, `extra` is `undefined` (SDK does not provide extra context)\n * and `next()` resolves to `undefined`.\n */\nexport type McpMiddlewareFn = (\n  request: { method: string; params: Record<string, unknown> },\n  extra: McpExtra | undefined,\n  next: () => Promise<unknown>,\n) => Promise<unknown> | unknown;\n\n/**\n * MCP methods the server handles (incoming from client).\n */\nexport type McpMethodString =\n  | ClientRequest[\"method\"]\n  | ClientNotification[\"method\"];\n\n/**\n * Resolve the `params` type for a specific MCP method (request or notification)\n * from the SDK's typed unions. Falls back to `Record<string, unknown>` for\n * unknown methods. Used by {@link McpTypedMiddlewareFn} to narrow the request\n * shape in typed middleware.\n */\nexport type McpRequestParams<M extends string> =\n  Extract<ClientRequest, { method: M }> extends { params: infer P }\n    ? P\n    : Extract<ClientNotification, { method: M }> extends { params: infer P }\n      ? P\n      : Record<string, unknown>;\n\n/**\n * Resolve the `extra` arg type for a specific MCP method: {@link McpExtra} for\n * request methods, `undefined` for notification methods (the SDK does not\n * pass extra context for notifications).\n */\nexport type McpExtraFor<M extends string> = M extends ClientRequest[\"method\"]\n  ? McpExtra\n  : M extends ClientNotification[\"method\"]\n    ? undefined\n    : McpExtra | undefined;\n\n/** Maps each MCP request method to its SDK result type. */\ninterface McpResultMap {\n  ping: EmptyResult;\n  initialize: InitializeResult;\n  \"tools/list\": ListToolsResult;\n  \"tools/call\": CallToolResult;\n  \"resources/list\": ListResourcesResult;\n  \"resources/templates/list\": ListResourceTemplatesResult;\n  \"resources/read\": ReadResourceResult;\n  \"resources/subscribe\": EmptyResult;\n  \"resources/unsubscribe\": EmptyResult;\n  \"prompts/list\": ListPromptsResult;\n  \"prompts/get\": GetPromptResult;\n  \"completion/complete\": CompleteResult;\n  \"logging/setLevel\": EmptyResult;\n  \"tasks/get\": GetTaskResult;\n  \"tasks/result\": GetTaskPayloadResult;\n  \"tasks/list\": ListTasksResult;\n  \"tasks/cancel\": CancelTaskResult;\n}\n\n/**\n * Map an MCP method string to its corresponding result type.\n * For request methods, resolves to the specific SDK result type.\n * For wildcard patterns (e.g. `\"tools/*\"`), resolves to the union of matching result types.\n * For notification methods, resolves to `undefined`.\n * For unknown/unmatched methods, falls back to `ServerResult`.\n */\nexport type McpResultFor<M extends string> = M extends keyof McpResultMap\n  ? McpResultMap[M]\n  : M extends `${infer Prefix}/*`\n    ? [McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]] extends [never]\n      ? M extends ToWildcard<ClientNotification[\"method\"]>\n        ? undefined\n        : ServerResult\n      : McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]\n    : M extends ClientNotification[\"method\"]\n      ? undefined\n      : ServerResult;\n\n/**\n * Typed middleware function for a specific method. Narrows `request.params`\n * via {@link McpRequestParams}, `extra` via {@link McpExtraFor}, and the\n * resolved value of `next()` via {@link McpResultFor}.\n */\nexport type McpTypedMiddlewareFn<M extends string> = (\n  request: { method: M; params: McpRequestParams<M> },\n  extra: McpExtraFor<M>,\n  next: () => Promise<McpResultFor<M>>,\n) => Promise<unknown> | unknown;\n\n/** Extracts `\"prefix/*\"` from `\"prefix/anything\"` — distributive over unions. */\ntype ToWildcard<T extends string> = T extends `${infer Prefix}/${string}`\n  ? `${Prefix}/*`\n  : never;\n\n/** Wildcard prefixes derived from method strings (e.g. `\"tools/*\"` from `\"tools/call\"`). */\nexport type McpWildcard = ToWildcard<McpMethodString>;\n\n/** Category keywords matching all requests or all notifications. */\ntype McpCategory = \"request\" | \"notification\";\n\n/**\n * A single filter pattern for MCP middleware:\n * - Exact method: `\"tools/call\"`\n * - Wildcard: `\"tools/*\"`\n * - Category: `\"request\"` | `\"notification\"`\n * - Escape hatch: arbitrary string via `string & {}`\n */\ntype McpMiddlewareFilterPattern =\n  | McpMethodString\n  | McpWildcard\n  | McpCategory\n  | (string & {});\n\n/**\n * Filter determining which MCP methods a middleware applies to.\n * A single pattern or an array of patterns (OR logic).\n */\nexport type McpMiddlewareFilter =\n  | McpMiddlewareFilterPattern\n  | McpMiddlewareFilterPattern[];\n\n/**\n * Internal entry stored for each registered middleware.\n * `filter: null` means catch-all (matches everything).\n */\nexport type McpMiddlewareEntry = {\n  filter: McpMiddlewareFilter | null;\n  handler: McpMiddlewareFn;\n};\n\ntype HandlerMap = Map<string, (...args: unknown[]) => Promise<unknown>>;\n\n/**\n * Extract the TS-private `_requestHandlers` and `_notificationHandlers` maps\n * from the SDK's `Server` (extends `Protocol`). These are runtime-accessible\n * but declared `private` in TypeScript.\n *\n * Validates with `instanceof Map` so an incompatible SDK version fails fast\n * instead of silently breaking.\n */\nexport function getHandlerMaps(server: Server) {\n  const obj: object = server;\n\n  if (\n    !(\"_requestHandlers\" in obj && obj._requestHandlers instanceof Map) ||\n    !(\n      \"_notificationHandlers\" in obj && obj._notificationHandlers instanceof Map\n    )\n  ) {\n    throw new Error(\n      \"Incompatible MCP SDK version: expected _requestHandlers and _notificationHandlers on Server\",\n    );\n  }\n\n  return {\n    requestHandlers: obj._requestHandlers as HandlerMap,\n    notificationHandlers: obj._notificationHandlers as HandlerMap,\n  };\n}\n\n/**\n * Check if a single filter pattern matches a given method.\n *\n * - Exact: `\"tools/call\"` matches only `\"tools/call\"`\n * - Wildcard: `\"tools/*\"` matches any method starting with `\"tools/\"`\n * - Category `\"request\"`: matches when `isNotification` is false\n * - Category `\"notification\"`: matches when `isNotification` is true\n */\nexport function matchesFilter(\n  method: string,\n  filter: string,\n  isNotification: boolean,\n): boolean {\n  if (filter === \"request\") {\n    return !isNotification;\n  }\n  if (filter === \"notification\") {\n    return isNotification;\n  }\n  if (filter.endsWith(\"/*\")) {\n    const prefix = filter.slice(0, -1); // \"tools/*\" → \"tools/\"\n    return method.startsWith(prefix);\n  }\n  return method === filter;\n}\n\nfunction matchesAnyFilter(\n  method: string,\n  filter: McpMiddlewareFilter | null,\n  isNotification: boolean,\n): boolean {\n  if (filter === null) {\n    return true;\n  }\n  if (typeof filter === \"string\") {\n    return matchesFilter(method, filter, isNotification);\n  }\n  return filter.some((pattern) =>\n    matchesFilter(method, pattern, isNotification),\n  );\n}\n\n/**\n * Build an onion-model middleware chain for a specific method.\n *\n * Filters `entries` to those matching `method`, then composes them\n * so the first registered middleware is the outermost layer.\n * `next()` is guarded against multiple calls within a single middleware.\n */\nexport function buildMiddlewareChain(\n  method: string,\n  isNotification: boolean,\n  originalHandler: (...args: unknown[]) => Promise<unknown>,\n  entries: McpMiddlewareEntry[],\n) {\n  const applicable = entries.filter((entry) =>\n    matchesAnyFilter(method, entry.filter, isNotification),\n  );\n\n  if (applicable.length === 0) {\n    return originalHandler;\n  }\n\n  return (...args: unknown[]) => {\n    const rawRequest = args[0] as Record<string, unknown> | undefined;\n    // SDK calls request handlers as handler(request, extra) but\n    // notification handlers as handler(notification) — no extra arg.\n    const extra = isNotification ? undefined : (args[1] as McpExtra);\n    const mcpRequest = {\n      method,\n      params: (rawRequest?.params as Record<string, unknown>) ?? {},\n    };\n\n    let index = 0;\n\n    const executeLayer = (): Promise<unknown> => {\n      const entry = applicable[index++];\n      if (!entry) {\n        if (rawRequest) {\n          rawRequest.params = mcpRequest.params;\n        }\n        return originalHandler(...args);\n      }\n\n      let nextCalled = false;\n\n      const next = (): Promise<unknown> => {\n        if (nextCalled) {\n          throw new Error(\n            `next() called multiple times in middleware for \"${method}\"`,\n          );\n        }\n        nextCalled = true;\n        return executeLayer();\n      };\n\n      return Promise.resolve(entry.handler(mcpRequest, extra, next));\n    };\n\n    return executeLayer();\n  };\n}\n"]}