skybridge 0.0.0-dev.c2b2b14 → 0.0.0-dev.c2c0f98

package/dist/server/app.d.ts

@@ -0,0 +1,143 @@
+import { type Implementation, type McpHttpHandler, type Server as SdkServer, type ServerOptions } from "@modelcontextprotocol/server";
+import type { ErrorRequestHandler, Express, RequestHandler } from "express";
+import type { ExtraClaims } from "./auth.js";
+import { McpServer, type McpServerTypes, type SkybridgeServerOptions, type ToolDef } from "./server.js";
+/**
+ * Everything a Skybridge app needs in one bag: the MCP implementation info
+ * (`name`, `version`, …), the SDK's {@link ServerOptions} (`capabilities`,
+ * `instructions`, …), and the Skybridge-specific options (`oauth`, `json`,
+ * `skills`).
+ */
+export type SkybridgeConfig<TAuthExtra extends ExtraClaims = ExtraClaims> = Implementation & ServerOptions & SkybridgeServerOptions<TAuthExtra>;
+/**
+ * The factory that declares an app's MCP surface. Called with a fresh
+ * {@link McpServer} for every request, it must **return** the chained server so
+ * `typeof app` carries the registered tool types.
+ */
+export type SkybridgeSetup<TTools extends Record<string, ToolDef>, TAuthExtra extends ExtraClaims> = (server: McpServer<Record<never, ToolDef>, TAuthExtra>) => McpServer<TTools, TAuthExtra>;
+/**
+ * A Skybridge app: the HTTP surface (Express, OAuth metadata, the `/mcp`
+ * route) plus a factory that builds the MCP server for each request.
+ *
+ * The factory runs once per request, so tools, resources, prompts and views
+ * are always registered on the instance that serves the request. It also runs
+ * once at construction time, which surfaces registration errors at boot and
+ * gives the OAuth layer the set of per-tool security schemes.
+ *
+ * @typeParam TTools - Accumulated tool registry, inferred from the server the
+ * factory returns. You almost never set this manually.
+ *
+ * @example
+ * ```ts
+ * export const app = new Skybridge(
+ *   { name: "my-app", version: "1.0.0", capabilities: {} },
+ *   (server) =>
+ *     server.registerTool(
+ *       {
+ *         name: "search",
+ *         inputSchema: { query: z.string() },
+ *         view: { component: "search" },
+ *       },
+ *       async ({ query }) => ({ content: `Results for ${query}` }),
+ *     ),
+ * );
+ *
+ * export type AppType = typeof app;
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
+ */
+export declare class Skybridge<TTools extends Record<string, ToolDef> = Record<never, ToolDef>, TAuthExtra extends ExtraClaims = ExtraClaims> {
+    readonly $types: McpServerTypes<TTools>;
+    private readonly serverInfo;
+    private readonly serverOptions;
+    private readonly skybridgeOptions;
+    private readonly setup;
+    private readonly expressApp;
+    private readonly errorMiddleware;
+    private readonly monitoringEntry;
+    private resolveResourceMetadataUrl?;
+    private cachedFetchHandler?;
+    constructor(config: SkybridgeConfig<TAuthExtra>, setup: SkybridgeSetup<TTools, TAuthExtra>);
+    /**
+     * The underlying Express app. Use this to extend the HTTP server with
+     * custom routes, middleware, or settings — e.g.
+     * `app.express.get("/health", ...)`.
+     *
+     * `express.json()` is pre-applied — tune it via the `json` config field,
+     * e.g. `new Skybridge({ name, version, json: { limit: "10mb" } }, setup)`.
+     * Register your handlers before `run()`; after `run()`, dev-mode middleware,
+     * the `/mcp` route, and the default error handler are appended in that order.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
+     * locally and on self-hosted deployments.
+     */
+    get express(): Express;
+    /**
+     * The app's fetch handler for `/mcp`: a `Request` → `Response` function that
+     * builds a fresh MCP server per request. Memoized, so the same handler is
+     * reused across requests.
+     */
+    get fetchHandler(): McpHttpHandler;
+    /**
+     * Build a fresh server for one stateless HTTP request, as
+     * `createMcpHandler`'s factory contract requires: the factory runs again so
+     * the SDK's handler closures belong to the instance whose protocol era it
+     * stamps. Sharing one instance's handler maps instead would bind them to an
+     * instance that is never marked, pinning every request to the 2025 codec and
+     * letting concurrent callers overwrite each other's negotiated version.
+     */
+    createServerInstance(): SdkServer;
+    /**
+     * Connect a Skybridge app to an MCP transport. Use this when you're
+     * embedding Skybridge in a host that already manages its own transport
+     * (e.g. stdio for desktop apps); for HTTP, prefer {@link Skybridge.run}
+     * which sets the transport up for you.
+     */
+    connect(transport: Parameters<SdkServer["connect"]>[0]): Promise<void>;
+    /**
+     * Register Express middleware on the underlying app. Mirrors `app.use` —
+     * pass handlers directly or a path-prefixed handler list. Register before
+     * {@link Skybridge.run}; ordering matches Express.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work
+     * locally and on self-hosted deployments.
+     */
+    use(...handlers: RequestHandler[]): this;
+    use(path: string, ...handlers: RequestHandler[]): this;
+    /**
+     * Register Express error-handling middleware to run after the built-in
+     * `/mcp` route (or your custom route). Use this to log or transform errors
+     * thrown by tool handlers before the default error handler responds.
+     *
+     * @example
+     * ```ts
+     * app.useOnError((err, _req, _res, next) => {
+     *   logger.error(err);
+     *   next(err);
+     * });
+     * ```
+     */
+    useOnError(...handlers: ErrorRequestHandler[]): this;
+    useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, and applies any custom Express middleware
+     * registered via {@link Skybridge.use} / {@link Skybridge.useOnError}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Vercel (`VERCEL === "1"`), returns the Express app directly so the
+     * serverless function entry can call it as a `(req, res)` handler. On
+     * Node, returns `undefined` once listening. When the process was spawned
+     * with an IPC channel, the bound port is reported to the parent as
+     * `{ type: "skybridge:listening", port }`, the readiness signal test runners
+     * wait on instead of polling.
+     */
+    run(): Promise<{
+        fetch: (...args: unknown[]) => unknown;
+    } | Express | undefined>;
+    private buildServer;
+    private middlewareEntries;
+    private instrumentHandlers;
+}

package/dist/server/app.js

@@ -0,0 +1,229 @@
+import http from "node:http";
+import { createMcpHandler, } from "@modelcontextprotocol/server";
+import { setupOAuth } from "./auth/setup.js";
+import { createApp, createBaseApp } from "./express.js";
+import { createMiddlewareEntry } from "./metric.js";
+import { buildMiddlewareChain, getHandlerMaps } from "./middleware.js";
+import { McpServer, } from "./server.js";
+/**
+ * A Skybridge app: the HTTP surface (Express, OAuth metadata, the `/mcp`
+ * route) plus a factory that builds the MCP server for each request.
+ *
+ * The factory runs once per request, so tools, resources, prompts and views
+ * are always registered on the instance that serves the request. It also runs
+ * once at construction time, which surfaces registration errors at boot and
+ * gives the OAuth layer the set of per-tool security schemes.
+ *
+ * @typeParam TTools - Accumulated tool registry, inferred from the server the
+ * factory returns. You almost never set this manually.
+ *
+ * @example
+ * ```ts
+ * export const app = new Skybridge(
+ *   { name: "my-app", version: "1.0.0", capabilities: {} },
+ *   (server) =>
+ *     server.registerTool(
+ *       {
+ *         name: "search",
+ *         inputSchema: { query: z.string() },
+ *         view: { component: "search" },
+ *       },
+ *       async ({ query }) => ({ content: `Results for ${query}` }),
+ *     ),
+ * );
+ *
+ * export type AppType = typeof app;
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
+ */
+export class Skybridge {
+    serverInfo;
+    serverOptions;
+    skybridgeOptions;
+    setup;
+    expressApp;
+    errorMiddleware = [];
+    monitoringEntry = createMiddlewareEntry();
+    resolveResourceMetadataUrl;
+    cachedFetchHandler;
+    constructor(config, setup) {
+        const { name, title, version, description, icons, websiteUrl, json, oauth, skills, ...serverOptions } = config;
+        this.serverInfo = { name, title, version, description, icons, websiteUrl };
+        this.serverOptions = serverOptions;
+        this.skybridgeOptions = { json, oauth, skills };
+        this.setup = setup;
+        const sample = this.buildServer();
+        this.expressApp = createBaseApp(json);
+        if (oauth) {
+            this.resolveResourceMetadataUrl = setupOAuth(this.expressApp, oauth, sample.securitySchemesByTool);
+        }
+    }
+    /**
+     * The underlying Express app. Use this to extend the HTTP server with
+     * custom routes, middleware, or settings — e.g.
+     * `app.express.get("/health", ...)`.
+     *
+     * `express.json()` is pre-applied — tune it via the `json` config field,
+     * e.g. `new Skybridge({ name, version, json: { limit: "10mb" } }, setup)`.
+     * Register your handlers before `run()`; after `run()`, dev-mode middleware,
+     * the `/mcp` route, and the default error handler are appended in that order.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
+     * locally and on self-hosted deployments.
+     */
+    get express() {
+        return this.expressApp;
+    }
+    /**
+     * The app's fetch handler for `/mcp`: a `Request` → `Response` function that
+     * builds a fresh MCP server per request. Memoized, so the same handler is
+     * reused across requests.
+     */
+    get fetchHandler() {
+        this.cachedFetchHandler ??= createMcpHandler(() => this.createServerInstance(), {
+            onerror: (error) => {
+                console.error("Error handling MCP request:", error);
+            },
+        });
+        return this.cachedFetchHandler;
+    }
+    /**
+     * Build a fresh server for one stateless HTTP request, as
+     * `createMcpHandler`'s factory contract requires: the factory runs again so
+     * the SDK's handler closures belong to the instance whose protocol era it
+     * stamps. Sharing one instance's handler maps instead would bind them to an
+     * instance that is never marked, pinning every request to the 2025 codec and
+     * letting concurrent callers overwrite each other's negotiated version.
+     */
+    createServerInstance() {
+        const server = this.buildServer();
+        this.instrumentHandlers(server);
+        return server.server;
+    }
+    /**
+     * Connect a Skybridge app to an MCP transport. Use this when you're
+     * embedding Skybridge in a host that already manages its own transport
+     * (e.g. stdio for desktop apps); for HTTP, prefer {@link Skybridge.run}
+     * which sets the transport up for you.
+     */
+    async connect(transport) {
+        await this.createServerInstance().connect(transport);
+    }
+    use(pathOrHandler, ...handlers) {
+        // Branching is load-bearing: Express's `app.use` overloads can't be
+        // resolved against a `string | RequestHandler` union, so we narrow.
+        if (typeof pathOrHandler === "string") {
+            this.expressApp.use(pathOrHandler, ...handlers);
+        }
+        else {
+            this.expressApp.use(pathOrHandler, ...handlers);
+        }
+        return this;
+    }
+    useOnError(pathOrHandler, ...handlers) {
+        if (typeof pathOrHandler === "string") {
+            this.errorMiddleware.push({ path: pathOrHandler, handlers });
+        }
+        else {
+            this.errorMiddleware.push({ handlers: [pathOrHandler, ...handlers] });
+        }
+        return this;
+    }
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, and applies any custom Express middleware
+     * registered via {@link Skybridge.use} / {@link Skybridge.useOnError}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Vercel (`VERCEL === "1"`), returns the Express app directly so the
+     * serverless function entry can call it as a `(req, res)` handler. On
+     * Node, returns `undefined` once listening. When the process was spawned
+     * with an IPC channel, the bound port is reported to the parent as
+     * `{ type: "skybridge:listening", port }`, the readiness signal test runners
+     * wait on instead of polling.
+     */
+    async run() {
+        if (process.env.VERCEL === "1") {
+            // createApp only reads httpServer inside its dev-only branch
+            // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a
+            // bare object passed to satisfy the required parameter.
+            const httpServer = http.createServer();
+            await createApp({
+                app: this,
+                httpServer,
+                errorMiddleware: this.errorMiddleware,
+            });
+            return this.expressApp;
+        }
+        const httpServer = http.createServer();
+        await createApp({
+            app: this,
+            httpServer,
+            errorMiddleware: this.errorMiddleware,
+        });
+        httpServer.on("request", this.expressApp);
+        const intendedPort = parseInt(process.env.__PORT ?? "3000", 10);
+        await new Promise((resolve, reject) => {
+            httpServer.on("error", (error) => {
+                console.error("Failed to start server:", error);
+                reject(error);
+            });
+            httpServer.listen(intendedPort, () => {
+                resolve();
+            });
+        });
+        const { port } = httpServer.address();
+        process.send?.({ type: "skybridge:listening", port });
+        // On workerd, bridge the Node http server to a Workers fetch handler.
+        // The specifier is held in a variable to sidestep tsc's module resolution
+        // (`cloudflare:node` only exists under wrangler/workerd).
+        if (typeof navigator !== "undefined" &&
+            navigator.userAgent === "Cloudflare-Workers") {
+            const cloudflareNode = "cloudflare:node";
+            const { httpServerHandler } = await import(cloudflareNode);
+            return httpServerHandler({ port });
+        }
+        const shutdown = () => {
+            // Drop both handlers so a second signal falls through to Node's default
+            // (force-quit on a second Ctrl+C while drain is hanging).
+            process.off("SIGTERM", shutdown);
+            process.off("SIGINT", shutdown);
+            httpServer.close(() => process.exit(0));
+            // Force exit if connections don't drain in time so the port is still
+            // released promptly (e.g. for nodemon restarts).
+            setTimeout(() => process.exit(0), 3000).unref();
+        };
+        process.on("SIGTERM", shutdown);
+        process.on("SIGINT", shutdown);
+        return undefined;
+    }
+    buildServer() {
+        const server = new McpServer(this.serverInfo, this.serverOptions, this.skybridgeOptions);
+        if (this.resolveResourceMetadataUrl) {
+            server.setResourceMetadataUrlResolver(this.resolveResourceMetadataUrl);
+        }
+        return this.setup(server);
+    }
+    middlewareEntries(server) {
+        return [
+            ...(this.monitoringEntry ? [this.monitoringEntry] : []),
+            ...server.protocolMiddlewareEntries(),
+        ];
+    }
+    instrumentHandlers(server) {
+        const entries = this.middlewareEntries(server);
+        const { requestHandlers, notificationHandlers } = getHandlerMaps(server.server);
+        const instrumentMap = (map, isNotification) => {
+            for (const [method, handler] of map) {
+                map.set(method, buildMiddlewareChain(method, isNotification, handler, entries));
+            }
+            const originalSet = map.set.bind(map);
+            map.set = (method, handler) => originalSet(method, buildMiddlewareChain(method, isNotification, handler, entries));
+        };
+        instrumentMap(requestHandlers, false);
+        instrumentMap(notificationHandlers, true);
+    }
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,gBAAgB,GAKjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAoC,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EACL,SAAS,GAIV,MAAM,aAAa,CAAC;AA4BrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,SAAS;IAKH,UAAU,CAAiB;IAC3B,aAAa,CAAgB;IAC7B,gBAAgB,CAAqC;IACrD,KAAK,CAAqC;IAC1C,UAAU,CAAU;IACpB,eAAe,GAA4B,EAAE,CAAC;IAC9C,eAAe,GAC9B,qBAAqB,EAAE,CAAC;IAClB,0BAA0B,CAA+B;IACzD,kBAAkB,CAAkB;IAE5C,YACE,MAAmC,EACnC,KAAyC;QAEzC,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,OAAO,EACP,WAAW,EACX,KAAK,EACL,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,GAAG,aAAa,EACjB,GAAG,MAAM,CAAC;QAEX,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,0BAA0B,GAAG,UAAU,CAC1C,IAAI,CAAC,UAAU,EACf,KAAK,EACL,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,IAAI,YAAY;QACd,IAAI,CAAC,kBAAkB,KAAK,gBAAgB,CAC1C,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,EACjC;YACE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;SACF,CACF,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAA8C;QAC1D,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAYD,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,GAAG;QAGP,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,6DAA6D;YAC7D,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC;gBACd,GAAG,EAAE,IAAI;gBACT,UAAU;gBACV,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEvC,MAAM,SAAS,CAAC;YACd,GAAG,EAAE,IAAI;YACT,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAC;QACrD,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,MAAM,CAAC,8BAA8B,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,iBAAiB,CACvB,MAAqD;QAErD,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,MAAM,CAAC,yBAAyB,EAAE;SACtC,CAAC;IACJ,CAAC;IAEO,kBAAkB,CACxB,MAAqD;QAErD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import http from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport {\n  createMcpHandler,\n  type Implementation,\n  type McpHttpHandler,\n  type Server as SdkServer,\n  type ServerOptions,\n} from \"@modelcontextprotocol/server\";\nimport type { ErrorRequestHandler, Express, RequestHandler } from \"express\";\nimport { type ResourceMetadataUrlResolver, setupOAuth } from \"./auth/setup.js\";\nimport type { ExtraClaims } from \"./auth.js\";\nimport { createApp, createBaseApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type { McpMiddlewareEntry } from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport {\n  McpServer,\n  type McpServerTypes,\n  type SkybridgeServerOptions,\n  type ToolDef,\n} from \"./server.js\";\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\n/**\n * Everything a Skybridge app needs in one bag: the MCP implementation info\n * (`name`, `version`, …), the SDK's {@link ServerOptions} (`capabilities`,\n * `instructions`, …), and the Skybridge-specific options (`oauth`, `json`,\n * `skills`).\n */\nexport type SkybridgeConfig<TAuthExtra extends ExtraClaims = ExtraClaims> =\n  Implementation & ServerOptions & SkybridgeServerOptions<TAuthExtra>;\n\n/**\n * The factory that declares an app's MCP surface. Called with a fresh\n * {@link McpServer} for every request, it must **return** the chained server so\n * `typeof app` carries the registered tool types.\n */\nexport type SkybridgeSetup<\n  TTools extends Record<string, ToolDef>,\n  TAuthExtra extends ExtraClaims,\n> = (\n  server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n) => McpServer<TTools, TAuthExtra>;\n\n/**\n * A Skybridge app: the HTTP surface (Express, OAuth metadata, the `/mcp`\n * route) plus a factory that builds the MCP server for each request.\n *\n * The factory runs once per request, so tools, resources, prompts and views\n * are always registered on the instance that serves the request. It also runs\n * once at construction time, which surfaces registration errors at boot and\n * gives the OAuth layer the set of per-tool security schemes.\n *\n * @typeParam TTools - Accumulated tool registry, inferred from the server the\n * factory returns. You almost never set this manually.\n *\n * @example\n * ```ts\n * export const app = new Skybridge(\n *   { name: \"my-app\", version: \"1.0.0\", capabilities: {} },\n *   (server) =>\n *     server.registerTool(\n *       {\n *         name: \"search\",\n *         inputSchema: { query: z.string() },\n *         view: { component: \"search\" },\n *       },\n *       async ({ query }) => ({ content: `Results for ${query}` }),\n *     ),\n * );\n *\n * export type AppType = typeof app;\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/mcp-server\n */\nexport class Skybridge<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n  TAuthExtra extends ExtraClaims = ExtraClaims,\n> {\n  declare readonly $types: McpServerTypes<TTools>;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions: ServerOptions;\n  private readonly skybridgeOptions: SkybridgeServerOptions<TAuthExtra>;\n  private readonly setup: SkybridgeSetup<TTools, TAuthExtra>;\n  private readonly expressApp: Express;\n  private readonly errorMiddleware: ErrorMiddlewareConfig[] = [];\n  private readonly monitoringEntry: McpMiddlewareEntry | null =\n    createMiddlewareEntry();\n  private resolveResourceMetadataUrl?: ResourceMetadataUrlResolver;\n  private cachedFetchHandler?: McpHttpHandler;\n\n  constructor(\n    config: SkybridgeConfig<TAuthExtra>,\n    setup: SkybridgeSetup<TTools, TAuthExtra>,\n  ) {\n    const {\n      name,\n      title,\n      version,\n      description,\n      icons,\n      websiteUrl,\n      json,\n      oauth,\n      skills,\n      ...serverOptions\n    } = config;\n\n    this.serverInfo = { name, title, version, description, icons, websiteUrl };\n    this.serverOptions = serverOptions;\n    this.skybridgeOptions = { json, oauth, skills };\n    this.setup = setup;\n\n    const sample = this.buildServer();\n\n    this.expressApp = createBaseApp(json);\n    if (oauth) {\n      this.resolveResourceMetadataUrl = setupOAuth(\n        this.expressApp,\n        oauth,\n        sample.securitySchemesByTool,\n      );\n    }\n  }\n\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `app.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied — tune it via the `json` config field,\n   * e.g. `new Skybridge({ name, version, json: { limit: \"10mb\" } }, setup)`.\n   * Register your handlers before `run()`; after `run()`, dev-mode middleware,\n   * the `/mcp` route, and the default error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  get express(): Express {\n    return this.expressApp;\n  }\n\n  /**\n   * The app's fetch handler for `/mcp`: a `Request` → `Response` function that\n   * builds a fresh MCP server per request. Memoized, so the same handler is\n   * reused across requests.\n   */\n  get fetchHandler(): McpHttpHandler {\n    this.cachedFetchHandler ??= createMcpHandler(\n      () => this.createServerInstance(),\n      {\n        onerror: (error) => {\n          console.error(\"Error handling MCP request:\", error);\n        },\n      },\n    );\n    return this.cachedFetchHandler;\n  }\n\n  /**\n   * Build a fresh server for one stateless HTTP request, as\n   * `createMcpHandler`'s factory contract requires: the factory runs again so\n   * the SDK's handler closures belong to the instance whose protocol era it\n   * stamps. Sharing one instance's handler maps instead would bind them to an\n   * instance that is never marked, pinning every request to the 2025 codec and\n   * letting concurrent callers overwrite each other's negotiated version.\n   */\n  createServerInstance(): SdkServer {\n    const server = this.buildServer();\n    this.instrumentHandlers(server);\n    return server.server;\n  }\n\n  /**\n   * Connect a Skybridge app to an MCP transport. Use this when you're\n   * embedding Skybridge in a host that already manages its own transport\n   * (e.g. stdio for desktop apps); for HTTP, prefer {@link Skybridge.run}\n   * which sets the transport up for you.\n   */\n  async connect(transport: Parameters<SdkServer[\"connect\"]>[0]): Promise<void> {\n    await this.createServerInstance().connect(transport);\n  }\n\n  /**\n   * Register Express middleware on the underlying app. Mirrors `app.use` —\n   * pass handlers directly or a path-prefixed handler list. Register before\n   * {@link Skybridge.run}; ordering matches Express.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work\n   * locally and on self-hosted deployments.\n   */\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.expressApp.use(pathOrHandler, ...handlers);\n    } else {\n      this.expressApp.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  /**\n   * Register Express error-handling middleware to run after the built-in\n   * `/mcp` route (or your custom route). Use this to log or transform errors\n   * thrown by tool handlers before the default error handler responds.\n   *\n   * @example\n   * ```ts\n   * app.useOnError((err, _req, _res, next) => {\n   *   logger.error(err);\n   *   next(err);\n   * });\n   * ```\n   */\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.errorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.errorMiddleware.push({ handlers: [pathOrHandler, ...handlers] });\n    }\n    return this;\n  }\n\n  /**\n   * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),\n   * mounts the `/mcp` route, and applies any custom Express middleware\n   * registered via {@link Skybridge.use} / {@link Skybridge.useOnError}.\n   *\n   * On Cloudflare Workers / workerd, returns an object exposing `fetch` so\n   * the runtime can bridge incoming requests to the Node HTTP server. On\n   * Vercel (`VERCEL === \"1\"`), returns the Express app directly so the\n   * serverless function entry can call it as a `(req, res)` handler. On\n   * Node, returns `undefined` once listening. When the process was spawned\n   * with an IPC channel, the bound port is reported to the parent as\n   * `{ type: \"skybridge:listening\", port }`, the readiness signal test runners\n   * wait on instead of polling.\n   */\n  async run(): Promise<\n    { fetch: (...args: unknown[]) => unknown } | Express | undefined\n  > {\n    if (process.env.VERCEL === \"1\") {\n      // createApp only reads httpServer inside its dev-only branch\n      // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a\n      // bare object passed to satisfy the required parameter.\n      const httpServer = http.createServer();\n      await createApp({\n        app: this,\n        httpServer,\n        errorMiddleware: this.errorMiddleware,\n      });\n      return this.expressApp;\n    }\n\n    const httpServer = http.createServer();\n\n    await createApp({\n      app: this,\n      httpServer,\n      errorMiddleware: this.errorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.expressApp);\n    const intendedPort = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(intendedPort, () => {\n        resolve();\n      });\n    });\n\n    const { port } = httpServer.address() as AddressInfo;\n    process.send?.({ type: \"skybridge:listening\", port });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private buildServer(): McpServer<TTools, TAuthExtra> {\n    const server = new McpServer<Record<never, ToolDef>, TAuthExtra>(\n      this.serverInfo,\n      this.serverOptions,\n      this.skybridgeOptions,\n    );\n    if (this.resolveResourceMetadataUrl) {\n      server.setResourceMetadataUrlResolver(this.resolveResourceMetadataUrl);\n    }\n    return this.setup(server);\n  }\n\n  private middlewareEntries(\n    server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n  ): McpMiddlewareEntry[] {\n    return [\n      ...(this.monitoringEntry ? [this.monitoringEntry] : []),\n      ...server.protocolMiddlewareEntries(),\n    ];\n  }\n\n  private instrumentHandlers(\n    server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n  ): void {\n    const entries = this.middlewareEntries(server);\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      server.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.d.ts

@@ -1,11 +1,11 @@
 import type { Plugin } from "vite";
+export declare function isCssRequest(id: string): boolean;
 /**
- * Transforms asset import paths to use the development server base URL.
+ * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
+ * so they work both locally and behind tunnels.
  */
-export declare function assetBaseUrlTransform(code: string, devServerOrigin: string): string;
+export declare function assetBaseUrlTransform(code: string): string;
 /**
- * Vite plugin that transforms asset import paths to use the development server base URL.
+ * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.
  */
-export declare function assetBaseUrlTransformPlugin(options: {
-    devServerOrigin: string;
-}): Plugin;
+export declare function assetBaseUrlTransformPlugin(): Plugin;

package/dist/server/asset-base-url-transform-plugin.js

@@ -1,26 +1,40 @@
+// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions
+// either at the end of the id or right before the query string. Catches both
+// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).
+const CSS_LANGS_RE = /\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
+export function isCssRequest(id) {
+    return CSS_LANGS_RE.test(id);
+}
 /**
- * Transforms asset import paths to use the development server base URL.
+ * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
+ * so they work both locally and behind tunnels.
  */
-export function assetBaseUrlTransform(code, devServerOrigin) {
-    const assetStringPattern = /(?<!https?:\/\/)(["'`])(\/[^"'`]+\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\1/g;
-    code = code.replace(assetStringPattern, (_match, quote, assetPath) => {
-        return `${quote}${devServerOrigin}${assetPath}${quote}`;
+export function assetBaseUrlTransform(code) {
+    const assetStringPattern = /(?<!\bfrom\s)(?<!https?:\/\/)(["'`])(\/[^"'`]+\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\1/g;
+    code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {
+        return `(window.skybridge?.serverUrl ?? "") + "${assetPath}"`;
     });
     return code;
 }
 /**
- * Vite plugin that transforms asset import paths to use the development server base URL.
+ * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.
  */
-export function assetBaseUrlTransformPlugin(options) {
-    const { devServerOrigin } = options;
+export function assetBaseUrlTransformPlugin() {
     return {
         name: "asset-base-url-transform",
-        enforce: "pre",
-        transform(code) {
+        transform(code, id) {
             if (!code) {
                 return null;
             }
-            const transformedCode = assetBaseUrlTransform(code, devServerOrigin);
+            // Vite serves CSS modules as JS that embeds the stylesheet as a string
+            // literal. Rewriting `url("/foo.woff2")` inside that string to a JS
+            // concatenation expression produces invalid CSS once it lands in a
+            // <style> tag. CSS asset URLs are already handled at build time by
+            // `experimental.renderBuiltUrl`, so skip CSS requests here.
+            if (isCssRequest(id)) {
+                return null;
+            }
+            const transformedCode = assetBaseUrlTransform(code);
             if (transformedCode === code) {
                 return null;
             }

package/dist/server/asset-base-url-transform-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,eAAuB;IAEvB,MAAM,kBAAkB,GACtB,+FAA+F,CAAC;IAElG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QACnE,OAAO,GAAG,KAAK,GAAG,eAAe,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAE3C;IACC,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAEpC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,KAAK;QACd,SAAS,CAAC,IAAI;YACZ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAErE,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,6EAA6E;AAC7E,uFAAuF;AACvF,MAAM,YAAY,GAChB,6DAA6D,CAAC;AAEhE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;IAE/G,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACpE,OAAO,0CAA0C,SAAS,GAAG,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,SAAS,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\n\n// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions\n// either at the end of the id or right before the query string. Catches both\n// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).\nconst CSS_LANGS_RE =\n  /\\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\\?)/;\n\nexport function isCssRequest(id: string): boolean {\n  return CSS_LANGS_RE.test(id);\n}\n\n/**\n * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,\n * so they work both locally and behind tunnels.\n */\nexport function assetBaseUrlTransform(code: string): string {\n  const assetStringPattern =\n    /(?<!\\bfrom\\s)(?<!https?:\\/\\/)([\"'`])(\\/[^\"'`]+\\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\\1/g;\n\n  code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {\n    return `(window.skybridge?.serverUrl ?? \"\") + \"${assetPath}\"`;\n  });\n\n  return code;\n}\n\n/**\n * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.\n */\nexport function assetBaseUrlTransformPlugin(): Plugin {\n  return {\n    name: \"asset-base-url-transform\",\n    transform(code, id) {\n      if (!code) {\n        return null;\n      }\n\n      // Vite serves CSS modules as JS that embeds the stylesheet as a string\n      // literal. Rewriting `url(\"/foo.woff2\")` inside that string to a JS\n      // concatenation expression produces invalid CSS once it lands in a\n      // <style> tag. CSS asset URLs are already handled at build time by\n      // `experimental.renderBuiltUrl`, so skip CSS requests here.\n      if (isCssRequest(id)) {\n        return null;\n      }\n\n      const transformedCode = assetBaseUrlTransform(code);\n\n      if (transformedCode === code) {\n        return null;\n      }\n\n      return {\n        code: transformedCode,\n        map: null,\n      };\n    },\n  };\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.test.js

@@ -1,27 +1,26 @@
 import { describe, expect, it } from "vitest";
-import { assetBaseUrlTransform } from "./asset-base-url-transform-plugin.js";
+import { assetBaseUrlTransform, assetBaseUrlTransformPlugin, isCssRequest, } from "./asset-base-url-transform-plugin.js";
 describe("assetBaseUrlTransform", () => {
-    const devServerOrigin = "http://localhost:3000";
-    it("should transform asset paths in single, double, and backtick quotes", () => {
+    it("should transform asset paths to use window.skybridge.serverUrl", () => {
         const cases = [
             {
                 desc: "single-quoted",
                 code: `const image = '/assets/logo.png';`,
-                expected: `const image = '${devServerOrigin}/assets/logo.png';`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
             {
                 desc: "double-quoted",
                 code: `const image = "/assets/logo.png";`,
-                expected: `const image = "${devServerOrigin}/assets/logo.png";`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
             {
                 desc: "backtick-quoted",
                 code: "const image = `/assets/logo.png`;",
-                expected: `const image = \`${devServerOrigin}/assets/logo.png\`;`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
         ];
         for (const { code, expected } of cases) {
-            const result = assetBaseUrlTransform(code, devServerOrigin);
+            const result = assetBaseUrlTransform(code);
             expect(result).toBe(expected);
         }
     });
@@ -31,10 +30,10 @@ describe("assetBaseUrlTransform", () => {
       const icon = '/assets/icon.svg';
       const font = '/assets/font.woff2';
     `;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
-        expect(result).toContain(`${devServerOrigin}/assets/logo.png`);
-        expect(result).toContain(`${devServerOrigin}/assets/icon.svg`);
-        expect(result).toContain(`${devServerOrigin}/assets/font.woff2`);
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/icon.svg"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/font.woff2"`);
     });
     it("should not transform already absolute URLs", () => {
         const code = `
@@ -42,15 +41,94 @@ describe("assetBaseUrlTransform", () => {
       const http = 'http://example.com/image.png';
       const https = 'https://example.com/image.png';
     `;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
-        expect(result).toContain(`${devServerOrigin}/assets/logo.png`);
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
         expect(result).toContain("http://example.com/image.png");
         expect(result).toContain("https://example.com/image.png");
     });
     it("should not transform code without asset paths", () => {
         const code = `const text = "Hello World";`;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
+        const result = assetBaseUrlTransform(code);
         expect(result).toBe(code);
     });
+    it("should not transform asset paths inside static `import ... from` clauses", () => {
+        // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,
+        // Vite resolves the relative path to absolute, then this transform used
+        // to rewrite the resolved string — producing invalid JS like
+        // `import * as sprite from (expr) + "..."` that crashes vite:import-analysis.
+        const cases = [
+            `import * as sprite from "/Users/me/proj/node_modules/pkg/icons.svg";`,
+            `import sprite from '/assets/icons.svg';`,
+            `import sprite from "/assets/icons.svg";`,
+            `export { default } from "/assets/icons.svg";`,
+            `export * from '/assets/sprites.svg';`,
+        ];
+        for (const code of cases) {
+            expect(assetBaseUrlTransform(code)).toBe(code);
+        }
+    });
+    it("should still transform value-position asset paths in files that also have unrelated imports", () => {
+        const code = [
+            `import { foo } from "./foo.js";`,
+            `import * as sprite from "/assets/sprite.svg";`,
+            `const logo = "/assets/logo.png";`,
+        ].join("\n");
+        const result = assetBaseUrlTransform(code);
+        // Imports untouched
+        expect(result).toContain(`from "./foo.js"`);
+        expect(result).toContain(`from "/assets/sprite.svg"`);
+        // Value-position rewritten
+        expect(result).toContain(`const logo = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`);
+    });
+});
+describe("isCssRequest", () => {
+    it("returns true for CSS-family extensions", () => {
+        expect(isCssRequest("/src/styles.css")).toBe(true);
+        expect(isCssRequest("/src/styles.module.css")).toBe(true);
+        expect(isCssRequest("/src/styles.scss")).toBe(true);
+        expect(isCssRequest("/src/styles.sass")).toBe(true);
+        expect(isCssRequest("/src/styles.less")).toBe(true);
+        expect(isCssRequest("/src/styles.styl")).toBe(true);
+    });
+    it("returns true for CSS modules with Vite query strings", () => {
+        expect(isCssRequest("/src/styles.css?direct")).toBe(true);
+        expect(isCssRequest("/src/styles.css?inline")).toBe(true);
+        expect(isCssRequest("/src/styles.css?used")).toBe(true);
+        expect(isCssRequest("/src/Foo.vue?vue&type=style&lang.css")).toBe(true);
+    });
+    it("returns false for non-CSS modules", () => {
+        expect(isCssRequest("/src/index.tsx")).toBe(false);
+        expect(isCssRequest("/src/utils.ts")).toBe(false);
+        expect(isCssRequest("/src/Logo.svg")).toBe(false);
+        expect(isCssRequest("/src/notes.cssx")).toBe(false);
+    });
+});
+describe("assetBaseUrlTransformPlugin", () => {
+    function runTransform(id, code) {
+        const plugin = assetBaseUrlTransformPlugin();
+        const hook = plugin.transform;
+        if (!hook) {
+            throw new Error("plugin.transform is not defined");
+        }
+        const handler = typeof hook === "function" ? hook : hook.handler;
+        return handler.call(
+        // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook
+        {}, code, id, { moduleType: "js" });
+    }
+    it("rewrites asset paths in JS modules", () => {
+        const result = runTransform("/src/widget.tsx", `const logo = "/assets/logo.png";`);
+        expect(result?.code).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+    });
+    // Reproducer for #697: CSS imports are served as JS modules with the
+    // stylesheet embedded as a string. Rewriting url("/foo.woff2") inside that
+    // string would produce invalid CSS once the styles are injected.
+    it("does not rewrite asset paths when transforming a CSS module", () => {
+        const cssCode = `__vite__updateStyle("style-id", "@font-face { src: url(\\"/fonts/Brand.woff2\\") format(\\"woff2\\"); }");`;
+        expect(runTransform("/src/fonts.css", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?direct", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?inline", cssCode)).toBeNull();
+        expect(runTransform("/src/styles.scss", cssCode)).toBeNull();
+        expect(runTransform("/src/Foo.vue?vue&type=style&lang.css", cssCode)).toBeNull();
+    });
 });
 //# sourceMappingURL=asset-base-url-transform-plugin.test.js.map