skybridge 0.0.0-dev.c14a1d3 → 0.0.0-dev.c17120e

package/dist/server/app.test.js

@@ -0,0 +1,231 @@
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { describe, expect, expectTypeOf, it } from "vitest";
+import { z } from "zod";
+import { Skybridge } from "./app.js";
+const oauthConfig = {
+    oauthMetadata: {
+        issuer: "https://issuer.example.com",
+        authorization_endpoint: "https://issuer.example.com/authorize",
+        token_endpoint: "https://issuer.example.com/token",
+        response_types_supported: ["code"],
+    },
+    verifier: {
+        verifyAccessToken: async () => ({
+            token: "t",
+            clientId: "c",
+            scopes: [],
+            extra: {},
+        }),
+    },
+};
+describe("Skybridge setup and handler", () => {
+    it("derives an app with outer middleware without changing the original", async () => {
+        const events = [];
+        let configured = 0;
+        let loaded = 0;
+        const app = new Skybridge({
+            name: "instance-hook",
+            version: "1",
+            setup: () => {
+                loaded += 1;
+                return "ready";
+            },
+            handler: (server, config) => server
+                .registerTool({
+                name: "echo",
+                inputSchema: { message: z.string() },
+                description: config,
+            }, async ({ message }) => {
+                events.push("handler");
+                return { content: message };
+            })
+                .mcpMiddleware("tools/call", async (_request, _extra, next) => {
+                events.push("app:before");
+                const result = await next();
+                events.push("app:after");
+                return result;
+            }),
+        });
+        const derived = app.withHandler((server, options, originalHandler) => {
+            expectTypeOf(options).toEqualTypeOf();
+            configured += 1;
+            server.mcpMiddleware("tools/list", async (_request, _extra, next) => {
+                const result = await next();
+                return {
+                    ...result,
+                    tools: result.tools.map((tool) => ({
+                        ...tool,
+                        description: "configured",
+                    })),
+                };
+            });
+            server.mcpMiddleware("tools/call", async (request, _extra, next) => {
+                events.push("hook:before");
+                request.params.arguments = { message: "configured" };
+                const result = await next();
+                events.push("hook:after");
+                return result;
+            });
+            return originalHandler(server, options);
+        });
+        expectTypeOf().toEqualTypeOf();
+        expectTypeOf().toEqualTypeOf();
+        const instances = await Promise.all([
+            derived.createServerInstance(),
+            derived.createServerInstance(),
+            app.createServerInstance(),
+        ]);
+        for (const [index, instance] of instances.entries()) {
+            const client = new Client({ name: "client", version: "1" });
+            const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+            await instance.connect(serverTransport);
+            await client.connect(clientTransport);
+            try {
+                const expected = index < 2 ? "configured" : "ready";
+                expect((await client.listTools()).tools[0]?.description).toBe(expected);
+                events.length = 0;
+                expect(await client.callTool({
+                    name: "echo",
+                    arguments: { message: "original" },
+                })).toMatchObject({
+                    content: [
+                        { type: "text", text: index < 2 ? "configured" : "original" },
+                    ],
+                });
+                expect(events).toEqual(index < 2
+                    ? [
+                        "hook:before",
+                        "app:before",
+                        "handler",
+                        "app:after",
+                        "hook:after",
+                    ]
+                    : ["app:before", "handler", "app:after"]);
+            }
+            finally {
+                await client.close();
+            }
+        }
+        expect(configured).toBe(3);
+        expect(loaded).toBe(2);
+    });
+    it("propagates a failed handler wrapper without changing the original app", async () => {
+        const app = new Skybridge({
+            name: "instance-hook",
+            version: "1",
+            handler: (server) => server,
+        });
+        await expect(app
+            .withHandler(() => {
+            throw new Error("configure failed");
+        })
+            .createServerInstance()).rejects.toThrow("configure failed");
+        const instance = await app.createServerInstance();
+        await instance.close();
+    });
+    it("infers additional tools returned by a handler wrapper", async () => {
+        const app = new Skybridge({
+            name: "wrapped-tools",
+            version: "1",
+            setup: async () => ({ greeting: "hello" }),
+            handler: (server, { greeting }) => server.registerTool({ name: "greet", inputSchema: { name: z.string() } }, ({ name }) => ({ content: `${greeting} ${name}` })),
+        });
+        expectTypeOf().toEqualTypeOf();
+        const derived = app.withHandler((server, options, originalHandler) => {
+            expectTypeOf(options).toEqualTypeOf();
+            return originalHandler(server, options).registerTool({ name: "echo", inputSchema: { message: z.string() } }, ({ message }) => ({ content: message }));
+        });
+        expectTypeOf().toEqualTypeOf();
+        expectTypeOf().toEqualTypeOf();
+        const client = new Client({ name: "client", version: "1" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await derived.connect(serverTransport);
+        await client.connect(clientTransport);
+        try {
+            expect(await client.callTool({ name: "greet", arguments: { name: "Ada" } })).toMatchObject({ content: [{ type: "text", text: "hello Ada" }] });
+            expect(await client.callTool({
+                name: "echo",
+                arguments: { message: "goodbye" },
+            })).toMatchObject({ content: [{ type: "text", text: "goodbye" }] });
+        }
+        finally {
+            await client.close();
+        }
+    });
+    it("resolves setup once and passes the context to the per-request handler", async () => {
+        let loads = 0;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: async () => {
+                loads++;
+                return { greeting: await Promise.resolve("hello") };
+            },
+            handler: (server, { greeting }) => server.registerTool({ name: "greet", description: "greet" }, async () => ({ content: [{ type: "text", text: greeting }] })),
+        });
+        expect(loads).toBe(0);
+        const call = async () => {
+            const client = new Client({ name: "client", version: "1.0.0" });
+            const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+            await app.connect(serverTransport);
+            await client.connect(clientTransport);
+            const result = await client.callTool({ name: "greet" });
+            await client.close();
+            return result;
+        };
+        expect(await call()).toMatchObject({
+            content: [{ type: "text", text: "hello" }],
+        });
+        expect(await call()).toMatchObject({
+            content: [{ type: "text", text: "hello" }],
+        });
+        expect(loads).toBe(1);
+    });
+    it("retries setup after a failed first resolution", async () => {
+        let attempts = 0;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: async () => {
+                attempts++;
+                if (attempts === 1) {
+                    throw new Error("transient");
+                }
+            },
+            handler: (server) => server,
+        });
+        const [, first] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(first)).rejects.toThrow("transient");
+        const [, second] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(second)).resolves.toBeUndefined();
+        expect(attempts).toBe(2);
+    });
+    it("rejects a handler that returns a promise", async () => {
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            // @ts-expect-error the handler runs per request and must stay synchronous
+            handler: async (server) => server,
+        });
+        const [, serverTransport] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(serverTransport)).rejects.toThrow(/must be synchronous/);
+    });
+    it("resolves an oauth function with the setup config before wiring the routes", async () => {
+        let seen;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: () => ({ issuer: "https://issuer.example.com" }),
+            oauth: (config) => {
+                seen = config;
+                return oauthConfig;
+            },
+            handler: (server) => server,
+        });
+        expect(seen).toBeUndefined();
+        const [, serverTransport] = InMemoryTransport.createLinkedPair();
+        await app.connect(serverTransport);
+        expect(seen).toEqual({ issuer: "https://issuer.example.com" });
+    });
+});
+//# sourceMappingURL=app.test.js.map

package/dist/server/app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.test.js","sourceRoot":"","sources":["../../src/server/app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,MAAM,WAAW,GAAG;IAClB,aAAa,EAAE;QACb,MAAM,EAAE,4BAA4B;QACpC,sBAAsB,EAAE,sCAAsC;QAC9D,cAAc,EAAE,kCAAkC;QAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC;IACD,QAAQ,EAAE;QACR,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9B,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE;SACV,CAAC;KACH;CACF,CAAC;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,GAAG,EAAE;gBACV,MAAM,IAAI,CAAC,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAC1B,MAAM;iBACH,YAAY,CACX;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpC,WAAW,EAAE,MAAM;aACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC9B,CAAC,CACF;iBACA,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAC5D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;SACP,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;YACnE,YAAY,CAAC,OAAO,CAAC,CAAC,aAAa,EAAU,CAAC;YAC9C,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAClE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,OAAO;oBACL,GAAG,MAAM;oBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACjC,GAAG,IAAI;wBACP,WAAW,EAAE,YAAY;qBAC1B,CAAC,CAAC;iBACJ,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACjE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,YAAY,EAA6B,CAAC,aAAa,EAAU,CAAC;QAClE,YAAY,EAAqC,CAAC,aAAa,EAE3D,CAAC;QACL,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClC,OAAO,CAAC,oBAAoB,EAAE;YAC9B,OAAO,CAAC,oBAAoB,EAAE;YAC9B,GAAG,CAAC,oBAAoB,EAAE;SAC3B,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;YACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;gBACpD,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,MAAM,CACJ,MAAM,MAAM,CAAC,QAAQ,CAAC;oBACpB,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;iBACnC,CAAC,CACH,CAAC,aAAa,CAAC;oBACd,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE;qBAC9D;iBACF,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CACpB,KAAK,GAAG,CAAC;oBACP,CAAC,CAAC;wBACE,aAAa;wBACb,YAAY;wBACZ,SAAS;wBACT,WAAW;wBACX,YAAY;qBACb;oBACH,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,CACV,GAAG;aACA,WAAW,CAAC,GAAG,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC,CAAC;aACD,oBAAoB,EAAE,CAC1B,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACpD,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC,CACnD;SACJ,CAAC,CAAC;QACH,YAAY,EAAyB,CAAC,aAAa,EAAW,CAAC;QAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;YACnE,YAAY,CAAC,OAAO,CAAC,CAAC,aAAa,EAAwB,CAAC;YAC5D,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAY,CAClD,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACtD,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CACxC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,YAAY,EAA6B,CAAC,aAAa,EAAoB,CAAC;QAC5E,YAAY,EAAqC,CAAC,aAAa,EAE3D,CAAC;QACL,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,CACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CACrE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,MAAM,CACJ,MAAM,MAAM,CAAC,QAAQ,CAAC;gBACpB,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;aAClC,CAAC,CACH,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EACvC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAC9D;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;YACvC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,QAAQ,EAAE,CAAC;gBACX,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,0EAA0E;YAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxD,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,IAAI,IAAa,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACvD,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBAChB,IAAI,GAAG,MAAM,CAAC;gBACd,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client, InMemoryTransport } from \"@modelcontextprotocol/client\";\nimport { describe, expect, expectTypeOf, it } from \"vitest\";\nimport { z } from \"zod\";\nimport { Skybridge } from \"./app.js\";\nimport type { ToolInput, ToolNames } from \"./inferUtilityTypes.js\";\n\nconst oauthConfig = {\n  oauthMetadata: {\n    issuer: \"https://issuer.example.com\",\n    authorization_endpoint: \"https://issuer.example.com/authorize\",\n    token_endpoint: \"https://issuer.example.com/token\",\n    response_types_supported: [\"code\"],\n  },\n  verifier: {\n    verifyAccessToken: async () => ({\n      token: \"t\",\n      clientId: \"c\",\n      scopes: [],\n      extra: {},\n    }),\n  },\n};\n\ndescribe(\"Skybridge setup and handler\", () => {\n  it(\"derives an app with outer middleware without changing the original\", async () => {\n    const events: string[] = [];\n    let configured = 0;\n    let loaded = 0;\n    const app = new Skybridge({\n      name: \"instance-hook\",\n      version: \"1\",\n      setup: () => {\n        loaded += 1;\n        return \"ready\";\n      },\n      handler: (server, config) =>\n        server\n          .registerTool(\n            {\n              name: \"echo\",\n              inputSchema: { message: z.string() },\n              description: config,\n            },\n            async ({ message }) => {\n              events.push(\"handler\");\n              return { content: message };\n            },\n          )\n          .mcpMiddleware(\"tools/call\", async (_request, _extra, next) => {\n            events.push(\"app:before\");\n            const result = await next();\n            events.push(\"app:after\");\n            return result;\n          }),\n    });\n    const derived = app.withHandler((server, options, originalHandler) => {\n      expectTypeOf(options).toEqualTypeOf<string>();\n      configured += 1;\n      server.mcpMiddleware(\"tools/list\", async (_request, _extra, next) => {\n        const result = await next();\n        return {\n          ...result,\n          tools: result.tools.map((tool) => ({\n            ...tool,\n            description: \"configured\",\n          })),\n        };\n      });\n      server.mcpMiddleware(\"tools/call\", async (request, _extra, next) => {\n        events.push(\"hook:before\");\n        request.params.arguments = { message: \"configured\" };\n        const result = await next();\n        events.push(\"hook:after\");\n        return result;\n      });\n      return originalHandler(server, options);\n    });\n    expectTypeOf<ToolNames<typeof derived>>().toEqualTypeOf<\"echo\">();\n    expectTypeOf<ToolInput<typeof derived, \"echo\">>().toEqualTypeOf<{\n      message: string;\n    }>();\n    const instances = await Promise.all([\n      derived.createServerInstance(),\n      derived.createServerInstance(),\n      app.createServerInstance(),\n    ]);\n    for (const [index, instance] of instances.entries()) {\n      const client = new Client({ name: \"client\", version: \"1\" });\n      const [clientTransport, serverTransport] =\n        InMemoryTransport.createLinkedPair();\n      await instance.connect(serverTransport);\n      await client.connect(clientTransport);\n      try {\n        const expected = index < 2 ? \"configured\" : \"ready\";\n        expect((await client.listTools()).tools[0]?.description).toBe(expected);\n        events.length = 0;\n        expect(\n          await client.callTool({\n            name: \"echo\",\n            arguments: { message: \"original\" },\n          }),\n        ).toMatchObject({\n          content: [\n            { type: \"text\", text: index < 2 ? \"configured\" : \"original\" },\n          ],\n        });\n        expect(events).toEqual(\n          index < 2\n            ? [\n                \"hook:before\",\n                \"app:before\",\n                \"handler\",\n                \"app:after\",\n                \"hook:after\",\n              ]\n            : [\"app:before\", \"handler\", \"app:after\"],\n        );\n      } finally {\n        await client.close();\n      }\n    }\n    expect(configured).toBe(3);\n    expect(loaded).toBe(2);\n  });\n\n  it(\"propagates a failed handler wrapper without changing the original app\", async () => {\n    const app = new Skybridge({\n      name: \"instance-hook\",\n      version: \"1\",\n      handler: (server) => server,\n    });\n    await expect(\n      app\n        .withHandler(() => {\n          throw new Error(\"configure failed\");\n        })\n        .createServerInstance(),\n    ).rejects.toThrow(\"configure failed\");\n    const instance = await app.createServerInstance();\n    await instance.close();\n  });\n\n  it(\"infers additional tools returned by a handler wrapper\", async () => {\n    const app = new Skybridge({\n      name: \"wrapped-tools\",\n      version: \"1\",\n      setup: async () => ({ greeting: \"hello\" }),\n      handler: (server, { greeting }) =>\n        server.registerTool(\n          { name: \"greet\", inputSchema: { name: z.string() } },\n          ({ name }) => ({ content: `${greeting} ${name}` }),\n        ),\n    });\n    expectTypeOf<ToolNames<typeof app>>().toEqualTypeOf<\"greet\">();\n    const derived = app.withHandler((server, options, originalHandler) => {\n      expectTypeOf(options).toEqualTypeOf<{ greeting: string }>();\n      return originalHandler(server, options).registerTool(\n        { name: \"echo\", inputSchema: { message: z.string() } },\n        ({ message }) => ({ content: message }),\n      );\n    });\n    expectTypeOf<ToolNames<typeof derived>>().toEqualTypeOf<\"greet\" | \"echo\">();\n    expectTypeOf<ToolInput<typeof derived, \"echo\">>().toEqualTypeOf<{\n      message: string;\n    }>();\n    const client = new Client({ name: \"client\", version: \"1\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    await derived.connect(serverTransport);\n    await client.connect(clientTransport);\n    try {\n      expect(\n        await client.callTool({ name: \"greet\", arguments: { name: \"Ada\" } }),\n      ).toMatchObject({ content: [{ type: \"text\", text: \"hello Ada\" }] });\n      expect(\n        await client.callTool({\n          name: \"echo\",\n          arguments: { message: \"goodbye\" },\n        }),\n      ).toMatchObject({ content: [{ type: \"text\", text: \"goodbye\" }] });\n    } finally {\n      await client.close();\n    }\n  });\n\n  it(\"resolves setup once and passes the context to the per-request handler\", async () => {\n    let loads = 0;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: async () => {\n        loads++;\n        return { greeting: await Promise.resolve(\"hello\") };\n      },\n      handler: (server, { greeting }) =>\n        server.registerTool(\n          { name: \"greet\", description: \"greet\" },\n          async () => ({ content: [{ type: \"text\", text: greeting }] }),\n        ),\n    });\n\n    expect(loads).toBe(0);\n\n    const call = async () => {\n      const client = new Client({ name: \"client\", version: \"1.0.0\" });\n      const [clientTransport, serverTransport] =\n        InMemoryTransport.createLinkedPair();\n      await app.connect(serverTransport);\n      await client.connect(clientTransport);\n      const result = await client.callTool({ name: \"greet\" });\n      await client.close();\n      return result;\n    };\n\n    expect(await call()).toMatchObject({\n      content: [{ type: \"text\", text: \"hello\" }],\n    });\n    expect(await call()).toMatchObject({\n      content: [{ type: \"text\", text: \"hello\" }],\n    });\n    expect(loads).toBe(1);\n  });\n\n  it(\"retries setup after a failed first resolution\", async () => {\n    let attempts = 0;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: async () => {\n        attempts++;\n        if (attempts === 1) {\n          throw new Error(\"transient\");\n        }\n      },\n      handler: (server) => server,\n    });\n\n    const [, first] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(first)).rejects.toThrow(\"transient\");\n\n    const [, second] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(second)).resolves.toBeUndefined();\n    expect(attempts).toBe(2);\n  });\n\n  it(\"rejects a handler that returns a promise\", async () => {\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      // @ts-expect-error the handler runs per request and must stay synchronous\n      handler: async (server) => server,\n    });\n    const [, serverTransport] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(serverTransport)).rejects.toThrow(\n      /must be synchronous/,\n    );\n  });\n\n  it(\"resolves an oauth function with the setup config before wiring the routes\", async () => {\n    let seen: unknown;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: () => ({ issuer: \"https://issuer.example.com\" }),\n      oauth: (config) => {\n        seen = config;\n        return oauthConfig;\n      },\n      handler: (server) => server,\n    });\n\n    expect(seen).toBeUndefined();\n    const [, serverTransport] = InMemoryTransport.createLinkedPair();\n    await app.connect(serverTransport);\n    expect(seen).toEqual({ issuer: \"https://issuer.example.com\" });\n  });\n});\n"]}

package/dist/server/auth/discovery.d.ts

@@ -1,11 +1,33 @@
-import { type OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod/v4";
 /**
- * Discovered AS metadata + `jwks_uri` — the SDK's `OAuthMetadata` omits it (its
- * OAuth client never verifies tokens), but we need it to verify token signatures
- * via JWKS, so we re-type the field for typed access.
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
  */
-export type DiscoveredMetadata = OAuthMetadata & {
-    jwks_uri?: string;
-};
+declare const DiscoverySchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint: z.ZodOptional<z.ZodString>;
+    introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;
 /** Fetches and validates an authorization server's discovery document. */
 export declare function discoverAuthorizationServer(issuer: string): Promise<DiscoveredMetadata>;
+export {};

package/dist/server/auth/discovery.js

@@ -1,4 +1,13 @@
-import { OAuthMetadataSchema, } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { OAuthMetadataSchema } from "@modelcontextprotocol/core";
+import { z } from "zod/v4";
+/**
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
+ */
+const DiscoverySchema = OAuthMetadataSchema.extend({
+    jwks_uri: z.string().optional(),
+});
 const WELL_KNOWN = [
     "/.well-known/openid-configuration",
     "/.well-known/oauth-authorization-server",
@@ -22,22 +31,18 @@ export async function discoverAuthorizationServer(issuer) {
             if (!res.ok) {
                 throw new Error(`HTTP ${res.status}`);
             }
-            const parsed = OAuthMetadataSchema.safeParse(await res.json());
-            if (!parsed.success) {
-                throw new Error(`invalid metadata (${parsed.error.message})`);
-            }
+            const meta = DiscoverySchema.parse(await res.json());
             // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).
-            if (parsed.data.issuer.replace(/\/$/, "") !== base) {
-                throw new Error(`issuer mismatch: ${parsed.data.issuer}`);
+            if (meta.issuer.replace(/\/$/, "") !== base) {
+                throw new Error(`issuer mismatch: ${meta.issuer}`);
             }
-            const metadata = parsed.data;
             // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a
             // valid openid-configuration without `registration_endpoint` yet expose
             // it at oauth-authorization-server. Keep looking past a doc that omits it.
-            if (metadata.registration_endpoint) {
-                return metadata;
+            if (meta.registration_endpoint) {
+                return meta;
             }
-            fallback ??= metadata;
+            fallback ??= meta;
         }
         catch (err) {
             errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);

package/dist/server/auth/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AASlD,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,yEAAyE;YACzE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAA0B,CAAC;YACnD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;gBACnC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,QAAQ,KAAK,QAAQ,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  type OAuthMetadata,\n  OAuthMetadataSchema,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\n\n/**\n * Discovered AS metadata + `jwks_uri` — the SDK's `OAuthMetadata` omits it (its\n * OAuth client never verifies tokens), but we need it to verify token signatures\n * via JWKS, so we re-type the field for typed access.\n */\nexport type DiscoveredMetadata = OAuthMetadata & { jwks_uri?: string };\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const parsed = OAuthMetadataSchema.safeParse(await res.json());\n      if (!parsed.success) {\n        throw new Error(`invalid metadata (${parsed.error.message})`);\n      }\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (parsed.data.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${parsed.data.issuer}`);\n      }\n      const metadata = parsed.data as DiscoveredMetadata;\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (metadata.registration_endpoint) {\n        return metadata;\n      }\n      fallback ??= metadata;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B;;;;GAIG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { OAuthMetadataSchema } from \"@modelcontextprotocol/core\";\nimport { z } from \"zod/v4\";\n\n/**\n * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's\n * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but\n * we need it for JWKS token verification, so we extend the schema to keep it.\n */\nconst DiscoverySchema = OAuthMetadataSchema.extend({\n  jwks_uri: z.string().optional(),\n});\nexport type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const meta = DiscoverySchema.parse(await res.json());\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (meta.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${meta.issuer}`);\n      }\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (meta.registration_endpoint) {\n        return meta;\n      }\n      fallback ??= meta;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,15 @@
-import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
-import type { JwksVerifyConfig } from "./verify.js";
-/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
-export type OAuthConfig = {
+import type { OAuthMetadata } from "@modelcontextprotocol/server";
+import type { ExtraClaims, TokenVerifier } from "../auth.js";
+/**
+ * Resource-server OAuth config for the `oauth` field of `SkybridgeConfig`.
+ *
+ * `TExtra` comes from the `verifier` and flows on to tool handlers and
+ * `mcpMiddleware`, so the claim shape is declared once by whoever checks the
+ * token. The branded providers set it from the claims their IdP documents.
+ *
+ * @typeParam TExtra - Claims the verifier populates in `AuthInfo["extra"]`.
+ */
+export type OAuthConfig<TExtra extends ExtraClaims = ExtraClaims> = {
     /**
      * Public URL of this server; sets `resourceServerUrl` and the
      * `resource_metadata` URL. When omitted, it is inferred per request from
@@ -10,9 +18,31 @@ export type OAuthConfig = {
     baseUrl?: string;
     /** AS metadata served at `/.well-known/oauth-authorization-server`. */
     oauthMetadata: OAuthMetadata;
-    verify: JwksVerifyConfig;
     /** Scopes advertised in protected-resource metadata. */
     scopesSupported?: string[];
     /** Server-wide required-scope floor. */
     requiredScopes?: string[];
+    /**
+     * Checks each bearer token. Build one with `createJwksVerifier` for a
+     * JWT-issuing IdP, or supply your own for opaque tokens.
+     */
+    verifier: TokenVerifier<TExtra>;
+};
+/**
+ * What the branded providers return: a deferred {@link OAuthConfig}. Discovery
+ * runs in `resolve`, so `oauth: auth0Provider(...)` at module scope performs
+ * no network access until `Skybridge.run`. Call `resolve` yourself
+ * (`await customProvider(...).resolve()`) when wiring the middleware by hand.
+ *
+ * This is an object rather than a bare `() => Promise<OAuthConfig>` on
+ * purpose. TypeScript defers, during the first inference pass, any argument
+ * that is a call to a generic function returning a function type. The
+ * providers are generic (`workosProvider<TCustom>`), so a function-shaped
+ * return written inline in `new Skybridge({ oauth: workosProvider(...) })`
+ * would be skipped and `TAuthExtra` would fall back to `ExtraClaims`, losing
+ * the claims typing in tool handlers. A non-function shape is inferred
+ * eagerly.
+ */
+export type OAuthProvider<TExtra extends ExtraClaims = ExtraClaims> = {
+    resolve: () => Promise<OAuthConfig<TExtra>>;
 };

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/server\";\nimport type { ExtraClaims, TokenVerifier } from \"../auth.js\";\n\n/**\n * Resource-server OAuth config for the `oauth` field of `SkybridgeConfig`.\n *\n * `TExtra` comes from the `verifier` and flows on to tool handlers and\n * `mcpMiddleware`, so the claim shape is declared once by whoever checks the\n * token. The branded providers set it from the claims their IdP documents.\n *\n * @typeParam TExtra - Claims the verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type OAuthConfig<TExtra extends ExtraClaims = ExtraClaims> = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /**\n   * Checks each bearer token. Build one with `createJwksVerifier` for a\n   * JWT-issuing IdP, or supply your own for opaque tokens.\n   */\n  verifier: TokenVerifier<TExtra>;\n};\n\n/**\n * What the branded providers return: a deferred {@link OAuthConfig}. Discovery\n * runs in `resolve`, so `oauth: auth0Provider(...)` at module scope performs\n * no network access until `Skybridge.run`. Call `resolve` yourself\n * (`await customProvider(...).resolve()`) when wiring the middleware by hand.\n *\n * This is an object rather than a bare `() => Promise<OAuthConfig>` on\n * purpose. TypeScript defers, during the first inference pass, any argument\n * that is a call to a generic function returning a function type. The\n * providers are generic (`workosProvider<TCustom>`), so a function-shaped\n * return written inline in `new Skybridge({ oauth: workosProvider(...) })`\n * would be skipped and `TAuthExtra` would fall back to `ExtraClaims`, losing\n * the claims typing in tool handlers. A non-function shape is inferred\n * eagerly.\n */\nexport type OAuthProvider<TExtra extends ExtraClaims = ExtraClaims> = {\n  resolve: () => Promise<OAuthConfig<TExtra>>;\n};\n"]}

package/dist/server/auth/providers/auth0.d.ts

@@ -1,12 +1,40 @@
-import type { OAuthConfig } from "../index.js";
+import type { ExtraClaims } from "../../auth.js";
+import type { OAuthProvider } from "../index.js";
+import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
+/**
+ * Claims an Auth0 access token carries for a custom API audience. Auth0 puts no
+ * user attributes beyond the id in the token, so there is no `email`: call
+ * `/userinfo` for the profile. Custom claims must be namespaced (a bare `email`
+ * key is silently dropped), so add them through the type parameter under their
+ * full URI.
+ *
+ * @see https://auth0.com/docs/secure/tokens/access-tokens
+ * @see https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims
+ */
+export type Auth0Claims = {
+    /** Authorized party: the client id the token was issued to. */
+    azp?: string;
+    /** Only when the API has RBAC and "Add Permissions in the Access Token" on. */
+    permissions?: string[];
+    /** Organization id, when the tenant uses Organizations. */
+    org_id?: string;
+    /** Organization name, when the tenant uses Organizations. */
+    org_name?: string;
+};
 /**
  * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
- * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client
- * Registration enabled on the tenant (`enable_dynamic_client_registration`).
- * `audience` is the registered API Identifier — Auth0 only issues a verifiable
- * JWT (rather than an opaque token) when the request targets that audience.
+ * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this
+ * server's public URL. Requires DCR enabled on the tenant.
+ *
+ * Auth0 can't use the client's resource indicator — `audience` must be *in* the
+ * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see
+ * {@link customProvider}) and bakes `?audience=<id>` into the advertised
+ * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
+ * Auth0 (the token's real `iss`).
  */
-export declare function auth0Provider(opts: {
+export declare function auth0Provider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     domain: string;
-} & Omit<CustomProviderOptions, "issuer">): Promise<OAuthConfig>;
+    audience: string;
+    serverUrl: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience" | "baseUrl" | "serverUrl">): OAuthProvider<Auth0Claims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/auth0.js

@@ -1,18 +1,36 @@
 import { customProvider } from "./custom.js";
-/** Normalises a bare host to an https issuer URL and strips a trailing slash. */
-function toIssuerUrl(domain) {
-    const withScheme = /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
-    return withScheme.replace(/\/$/, "");
-}
+import { toIssuerUrl } from "./shared.js";
 /**
  * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
- * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client
- * Registration enabled on the tenant (`enable_dynamic_client_registration`).
- * `audience` is the registered API Identifier — Auth0 only issues a verifiable
- * JWT (rather than an opaque token) when the request targets that audience.
+ * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this
+ * server's public URL. Requires DCR enabled on the tenant.
+ *
+ * Auth0 can't use the client's resource indicator — `audience` must be *in* the
+ * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see
+ * {@link customProvider}) and bakes `?audience=<id>` into the advertised
+ * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
+ * Auth0 (the token's real `iss`).
  */
 export function auth0Provider(opts) {
-    const { domain, ...rest } = opts;
-    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+    const { domain, audience, ...rest } = opts;
+    const provider = customProvider({
+        issuer: toIssuerUrl(domain),
+        audience,
+        ...rest,
+    });
+    return {
+        resolve: async () => {
+            const config = await provider.resolve();
+            const authUrl = new URL(config.oauthMetadata.authorization_endpoint);
+            authUrl.searchParams.set("audience", audience);
+            return {
+                ...config,
+                oauthMetadata: {
+                    ...config.oauthMetadata,
+                    authorization_endpoint: authUrl.href,
+                },
+            };
+        },
+    };
 }
 //# sourceMappingURL=auth0.js.map

package/dist/server/auth/providers/auth0.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE,iFAAiF;AACjF,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAgE;IAEhE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/** Normalises a bare host to an https issuer URL and strips a trailing slash. */\nfunction toIssuerUrl(domain: string): string {\n  const withScheme = /^https?:\\/\\//.test(domain) ? domain : `https://${domain}`;\n  return withScheme.replace(/\\/$/, \"\");\n}\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client\n * Registration enabled on the tenant (`enable_dynamic_client_registration`).\n * `audience` is the registered API Identifier — Auth0 only issues a verifiable\n * JWT (rather than an opaque token) when the request targets that audience.\n */\nexport function auth0Provider(\n  opts: { domain: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}
+{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAG3B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAwB;QACrD,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,QAAQ;QACR,GAAG,IAAI;KACR,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YACrE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO;gBACL,GAAG,MAAM;gBACT,aAAa,EAAE;oBACb,GAAG,MAAM,CAAC,aAAa;oBACvB,sBAAsB,EAAE,OAAO,CAAC,IAAI;iBACrC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims an Auth0 access token carries for a custom API audience. Auth0 puts no\n * user attributes beyond the id in the token, so there is no `email`: call\n * `/userinfo` for the profile. Custom claims must be namespaced (a bare `email`\n * key is silently dropped), so add them through the type parameter under their\n * full URI.\n *\n * @see https://auth0.com/docs/secure/tokens/access-tokens\n * @see https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims\n */\nexport type Auth0Claims = {\n  /** Authorized party: the client id the token was issued to. */\n  azp?: string;\n  /** Only when the API has RBAC and \"Add Permissions in the Access Token\" on. */\n  permissions?: string[];\n  /** Organization id, when the tenant uses Organizations. */\n  org_id?: string;\n  /** Organization name, when the tenant uses Organizations. */\n  org_name?: string;\n};\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this\n * server's public URL. Requires DCR enabled on the tenant.\n *\n * Auth0 can't use the client's resource indicator — `audience` must be *in* the\n * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see\n * {@link customProvider}) and bakes `?audience=<id>` into the advertised\n * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays\n * Auth0 (the token's real `iss`).\n */\nexport function auth0Provider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string; serverUrl: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\" | \"baseUrl\" | \"serverUrl\"\n  >,\n): OAuthProvider<Auth0Claims & TCustom & RegisteredClaims> {\n  const { domain, audience, ...rest } = opts;\n  const provider = customProvider<Auth0Claims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    audience,\n    ...rest,\n  });\n  return {\n    resolve: async () => {\n      const config = await provider.resolve();\n      const authUrl = new URL(config.oauthMetadata.authorization_endpoint);\n      authUrl.searchParams.set(\"audience\", audience);\n      return {\n        ...config,\n        oauthMetadata: {\n          ...config.oauthMetadata,\n          authorization_endpoint: authUrl.href,\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/server/auth/providers/auth0.test.js

@@ -1,33 +1,50 @@
 // @vitest-environment node
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { auth0Provider } from "./auth0.js";
+import { lastJwksConfig as jwks } from "./verify-spy.js";
+vi.mock("../verify.js", () => import("./verify-spy.js"));
 afterEach(() => vi.restoreAllMocks());
-function discoveryDoc(issuer) {
+function doc(issuer) {
     return {
         issuer,
         authorization_endpoint: `${issuer}/authorize`,
         token_endpoint: `${issuer}/oauth/token`,
         registration_endpoint: `${issuer}/oidc/register`,
         response_types_supported: ["code"],
-        scopes_supported: ["openid"],
+        scopes_supported: ["openid", "profile", "email"],
         jwks_uri: `${issuer}/.well-known/jwks.json`,
     };
 }
-function mockDiscovery(issuer) {
-    return vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(discoveryDoc(issuer)), {
-        headers: { "content-type": "application/json" },
-    }));
-}
 describe("auth0Provider", () => {
-    it("builds the issuer from the tenant domain", async () => {
-        const fetchSpy = mockDiscovery("https://acme.us.auth0.com");
+    it("advertises skybridge as the AS (static issuer) and bakes audience; verifies against Auth0", async () => {
+        const issuer = "https://acme.us.auth0.com";
+        vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
+            headers: { "content-type": "application/json" },
+        }));
         const config = await auth0Provider({
             domain: "acme.us.auth0.com",
-            audience: "https://my-mcp-api",
-        });
-        expect(fetchSpy).toHaveBeenCalledWith("https://acme.us.auth0.com/.well-known/openid-configuration", expect.anything());
-        expect(config.verify.issuer).toBe("https://acme.us.auth0.com");
-        expect(config.verify.audience).toBe("https://my-mcp-api");
+            audience: "https://api.example.com/",
+            serverUrl: "https://app.example.com/",
+            scopes: ["openid", "profile", "email"],
+        }).resolve();
+        // skybridge is the advertised AS: static issuer = serverUrl (trailing slash stripped).
+        expect(config.oauthMetadata.issuer).toBe("https://app.example.com");
+        // AS metadata scopes match the advertised set (clients read scopes from here).
+        expect(config.oauthMetadata.scopes_supported).toEqual([
+            "openid",
+            "profile",
+            "email",
+        ]);
+        expect(config.scopesSupported).toEqual(["openid", "profile", "email"]);
+        // audience baked into the advertised authorize endpoint (still pointing at Auth0).
+        const url = new URL(config.oauthMetadata.authorization_endpoint);
+        expect(url.origin + url.pathname).toBe(`${issuer}/authorize`);
+        expect(url.searchParams.get("audience")).toBe("https://api.example.com/");
+        // baseUrl left unset so the PRM resource resolves per request (Alpic-safe).
+        expect(config.baseUrl).toBeUndefined();
+        // token verification still uses Auth0 as issuer + the API audience.
+        expect(jwks().issuer).toBe(issuer);
+        expect(jwks().audience).toBe("https://api.example.com/");
     });
 });
 //# sourceMappingURL=auth0.test.js.map