skybridge 0.0.0-dev.c6f58d9 → 0.0.0-dev.c7510b8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/use-typescript-check.js +1 -1
- package/dist/cli/use-typescript-check.js.map +1 -1
- package/dist/commands/create.d.ts +9 -0
- package/dist/commands/create.js +30 -0
- package/dist/commands/create.js.map +1 -0
- package/dist/server/auth.d.ts +20 -0
- package/dist/server/auth.js +28 -0
- package/dist/server/auth.js.map +1 -0
- package/dist/server/index.d.ts +2 -1
- package/dist/server/index.js +1 -0
- package/dist/server/index.js.map +1 -1
- package/dist/server/server.d.ts +17 -0
- package/dist/server/server.js +98 -58
- package/dist/server/server.js.map +1 -1
- package/dist/test/view.test.js +45 -0
- package/dist/test/view.test.js.map +1 -1
- package/dist/web/bridges/apps-sdk/adaptor.d.ts +2 -1
- package/dist/web/bridges/apps-sdk/adaptor.js +4 -0
- package/dist/web/bridges/apps-sdk/adaptor.js.map +1 -1
- package/dist/web/bridges/mcp-app/adaptor.d.ts +2 -1
- package/dist/web/bridges/mcp-app/adaptor.js +8 -0
- package/dist/web/bridges/mcp-app/adaptor.js.map +1 -1
- package/dist/web/bridges/types.d.ts +8 -1
- package/dist/web/bridges/types.js.map +1 -1
- package/dist/web/hooks/index.d.ts +1 -0
- package/dist/web/hooks/index.js +1 -0
- package/dist/web/hooks/index.js.map +1 -1
- package/dist/web/hooks/test/utils.d.ts +6 -2
- package/dist/web/hooks/test/utils.js +13 -2
- package/dist/web/hooks/test/utils.js.map +1 -1
- package/dist/web/hooks/use-download.d.ts +5 -0
- package/dist/web/hooks/use-download.js +8 -0
- package/dist/web/hooks/use-download.js.map +1 -0
- package/dist/web/hooks/use-download.test.d.ts +1 -0
- package/dist/web/hooks/use-download.test.js +95 -0
- package/dist/web/hooks/use-download.test.js.map +1 -0
- package/package.json +20 -16
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { spawn } from "node:child_process";
|
|
2
1
|
import { isAbsolute, relative } from "node:path";
|
|
2
|
+
import spawn from "cross-spawn";
|
|
3
3
|
import { useEffect, useRef, useState } from "react";
|
|
4
4
|
// TypeScript nests from general to specific — the deepest line is the root cause.
|
|
5
5
|
function extractBestMessage(message, continuationLines) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"use-typescript-check.js","sourceRoot":"","sources":["../../src/cli/use-typescript-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"use-typescript-check.js","sourceRoot":"","sources":["../../src/cli/use-typescript-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAUpD,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,OAAe,EACf,iBAAgC;IAEhC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QACrD,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YACvB,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,YAAY,GAAG,MAAM,CAAkC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAC;IAE7D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,SAAS,GAAG,KAAK,CACrB,KAAK,EACL,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,EACnD;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,KAAK,EAAE,IAAI;SACZ,CACF,CAAC;QAEF,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC;QAEjC,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,aAAa,GAAmB,EAAE,CAAC;QACvC,IAAI,YAAY,GAAmB,IAAI,CAAC;QACxC,IAAI,iBAAiB,GAAkB,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,YAAY,CAAC,OAAO,GAAG,kBAAkB,CACvC,YAAY,CAAC,OAAO,EACpB,iBAAiB,CAClB,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,YAAY,GAAG,IAAI,CAAC;YACpB,iBAAiB,GAAG,EAAE,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE;YACrC,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,YAAY,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAE5B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAC9B,wDAAwD,CACzD,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,YAAY,EAAE,CAAC;oBACf,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC;oBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;wBACzC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC5B,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC1B,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;wBACjD,CAAC;wBACD,YAAY,GAAG;4BACb,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;4BAClC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;4BAChC,IAAI,EAAE,IAAI,IAAI,EAAE;4BAChB,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;yBACxB,CAAC;oBACJ,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7B,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3D,YAAY,EAAE,CAAC;oBACf,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;oBACtE,aAAa,GAAG,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,GAAG,EAAE;YACV,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { isAbsolute, relative } from \"node:path\";\nimport spawn from \"cross-spawn\";\nimport { useEffect, useRef, useState } from \"react\";\n\ntype TsError = {\n file: string;\n line: number;\n col: number;\n code: string;\n message: string;\n};\n\n// TypeScript nests from general to specific — the deepest line is the root cause.\nfunction extractBestMessage(\n message: string,\n continuationLines: Array<string>,\n): string {\n if (!continuationLines.length) {\n return message;\n }\n let maxIndent = 0;\n for (const line of continuationLines) {\n const indent = line.length - line.trimStart().length;\n if (indent > maxIndent) {\n maxIndent = indent;\n }\n }\n const deepest = continuationLines\n .filter((l) => l.length - l.trimStart().length === maxIndent)\n .map((l) => l.trim())\n .filter(Boolean)[0];\n return deepest ?? message;\n}\n\nexport function useTypeScriptCheck(): Array<TsError> {\n const tsProcessRef = useRef<ReturnType<typeof spawn> | null>(null);\n const [tsErrors, setTsErrors] = useState<Array<TsError>>([]);\n\n useEffect(() => {\n const tsProcess = spawn(\n \"npx\",\n [\"tsc\", \"--noEmit\", \"--watch\", \"--pretty\", \"false\"],\n {\n stdio: [\"ignore\", \"pipe\", \"pipe\"],\n shell: true,\n },\n );\n\n tsProcessRef.current = tsProcess;\n\n let outputBuffer = \"\";\n let currentErrors: Array<TsError> = [];\n let pendingError: TsError | null = null;\n let continuationLines: Array<string> = [];\n\n const flushPending = () => {\n if (!pendingError) {\n return;\n }\n pendingError.message = extractBestMessage(\n pendingError.message,\n continuationLines,\n );\n currentErrors.push(pendingError);\n pendingError = null;\n continuationLines = [];\n };\n\n const processOutput = (data: Buffer) => {\n outputBuffer += data.toString();\n const lines = outputBuffer.split(\"\\n\");\n outputBuffer = lines.pop() || \"\";\n\n for (const line of lines) {\n const trimmed = line.trim();\n\n const errorMatch = trimmed.match(\n /^(.+?)\\((\\d+),(\\d+)\\):\\s+error\\s+(TS\\d+)?\\s*:?\\s*(.+)$/,\n );\n if (errorMatch) {\n flushPending();\n const [, file, lineStr, colStr, code, message] = errorMatch;\n if (file && lineStr && colStr && message) {\n let cleanFile = file.trim();\n if (isAbsolute(cleanFile)) {\n cleanFile = relative(process.cwd(), cleanFile);\n }\n pendingError = {\n file: cleanFile,\n line: Number.parseInt(lineStr, 10),\n col: Number.parseInt(colStr, 10),\n code: code ?? \"\",\n message: message.trim(),\n };\n }\n continue;\n }\n\n if (pendingError && line.startsWith(\" \")) {\n continuationLines.push(line);\n continue;\n }\n\n if (trimmed.includes(\"Found\") && trimmed.includes(\"error\")) {\n flushPending();\n setTsErrors(trimmed.match(/Found 0 error/) ? [] : [...currentErrors]);\n currentErrors = [];\n }\n }\n };\n\n if (tsProcess.stdout) {\n tsProcess.stdout.on(\"data\", processOutput);\n }\n if (tsProcess.stderr) {\n tsProcess.stderr.on(\"data\", processOutput);\n }\n\n return () => {\n if (tsProcessRef.current) {\n tsProcessRef.current.kill();\n }\n };\n }, []);\n\n return tsErrors;\n}\n"]}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import { Command, type Command as CommandLoadable, Help } from "@oclif/core";
|
|
2
|
+
export default class Create extends Command {
|
|
3
|
+
static description: string;
|
|
4
|
+
static strict: boolean;
|
|
5
|
+
run(): Promise<void>;
|
|
6
|
+
}
|
|
7
|
+
export declare class SkybridgeHelp extends Help {
|
|
8
|
+
showCommandHelp(command: CommandLoadable.Loadable): Promise<void>;
|
|
9
|
+
}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
import { Command, Help } from "@oclif/core";
|
|
2
|
+
import spawn from "cross-spawn";
|
|
3
|
+
function passthrough(args) {
|
|
4
|
+
const { status, error } = spawn.sync("npx", ["--yes", "create-skybridge@latest", ...args], { stdio: "inherit" });
|
|
5
|
+
if (error) {
|
|
6
|
+
console.error(error);
|
|
7
|
+
process.exit(1);
|
|
8
|
+
}
|
|
9
|
+
process.exit(status ?? 1);
|
|
10
|
+
}
|
|
11
|
+
export default class Create extends Command {
|
|
12
|
+
static description = "Scaffold a new Skybridge project";
|
|
13
|
+
static strict = false;
|
|
14
|
+
async run() {
|
|
15
|
+
passthrough(this.argv);
|
|
16
|
+
}
|
|
17
|
+
}
|
|
18
|
+
// Registered as `oclif.helpClass` so that `skybridge create --help` forwards
|
|
19
|
+
// to `create-skybridge --help` (single source of truth for the help text)
|
|
20
|
+
// instead of rendering oclif's auto-generated help. All other commands fall
|
|
21
|
+
// through to the default `Help` behaviour.
|
|
22
|
+
export class SkybridgeHelp extends Help {
|
|
23
|
+
async showCommandHelp(command) {
|
|
24
|
+
if (command.id === "create") {
|
|
25
|
+
passthrough(["--help"]);
|
|
26
|
+
}
|
|
27
|
+
return super.showCommandHelp(command);
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
//# sourceMappingURL=create.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmC,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,MAAM,aAAa,CAAC;AAEhC,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAClC,KAAK,EACL,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,IAAI,CAAC,EAC7C,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAU,WAAW,GAAG,kCAAkC,CAAC;IACjE,MAAM,CAAU,MAAM,GAAG,KAAK,CAAC;IAExB,KAAK,CAAC,GAAG;QACd,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;;AAGH,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,OAAO,aAAc,SAAQ,IAAI;IAC5B,KAAK,CAAC,eAAe,CAC5B,OAAiC;QAEjC,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF","sourcesContent":["import { Command, type Command as CommandLoadable, Help } from \"@oclif/core\";\nimport spawn from \"cross-spawn\";\n\nfunction passthrough(args: string[]): never {\n const { status, error } = spawn.sync(\n \"npx\",\n [\"--yes\", \"create-skybridge@latest\", ...args],\n { stdio: \"inherit\" },\n );\n if (error) {\n console.error(error);\n process.exit(1);\n }\n process.exit(status ?? 1);\n}\n\nexport default class Create extends Command {\n static override description = \"Scaffold a new Skybridge project\";\n static override strict = false;\n\n public async run(): Promise<void> {\n passthrough(this.argv);\n }\n}\n\n// Registered as `oclif.helpClass` so that `skybridge create --help` forwards\n// to `create-skybridge --help` (single source of truth for the help text)\n// instead of rendering oclif's auto-generated help. All other commands fall\n// through to the default `Help` behaviour.\nexport class SkybridgeHelp extends Help {\n override async showCommandHelp(\n command: CommandLoadable.Loadable,\n ): Promise<void> {\n if (command.id === \"create\") {\n passthrough([\"--help\"]);\n }\n return super.showCommandHelp(command);\n }\n}\n"]}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
|
|
2
|
+
import type { RequestHandler } from "express";
|
|
3
|
+
export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
|
|
4
|
+
export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
|
|
5
|
+
export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
|
|
6
|
+
export type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
|
|
7
|
+
/**
|
|
8
|
+
* Like `requireBearerAuth`, but lets requests through when no
|
|
9
|
+
* `Authorization` header is present. Used for mixed-auth servers where some
|
|
10
|
+
* tools are public and others require sign-in: each tool enforces its own
|
|
11
|
+
* `securitySchemes` against `extra.authInfo`.
|
|
12
|
+
*
|
|
13
|
+
* Behavior:
|
|
14
|
+
* - No `Authorization` header → `next()` without `req.auth`.
|
|
15
|
+
* - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
|
|
16
|
+
* - Invalid / malformed / expired / insufficient-scope → same error response
|
|
17
|
+
* as `requireBearerAuth` (401/403). Sending a bad token is still a client
|
|
18
|
+
* error.
|
|
19
|
+
*/
|
|
20
|
+
export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
|
|
2
|
+
export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
|
|
3
|
+
export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
|
|
4
|
+
export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
|
|
5
|
+
/**
|
|
6
|
+
* Like `requireBearerAuth`, but lets requests through when no
|
|
7
|
+
* `Authorization` header is present. Used for mixed-auth servers where some
|
|
8
|
+
* tools are public and others require sign-in: each tool enforces its own
|
|
9
|
+
* `securitySchemes` against `extra.authInfo`.
|
|
10
|
+
*
|
|
11
|
+
* Behavior:
|
|
12
|
+
* - No `Authorization` header → `next()` without `req.auth`.
|
|
13
|
+
* - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
|
|
14
|
+
* - Invalid / malformed / expired / insufficient-scope → same error response
|
|
15
|
+
* as `requireBearerAuth` (401/403). Sending a bad token is still a client
|
|
16
|
+
* error.
|
|
17
|
+
*/
|
|
18
|
+
export function optionalBearerAuth(options) {
|
|
19
|
+
const required = requireBearerAuth(options);
|
|
20
|
+
return (req, res, next) => {
|
|
21
|
+
if (!req.headers.authorization) {
|
|
22
|
+
next();
|
|
23
|
+
return;
|
|
24
|
+
}
|
|
25
|
+
return required(req, res, next);
|
|
26
|
+
};
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n type BearerAuthMiddlewareOptions,\n requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n type BearerAuthMiddlewareOptions,\n requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n type AuthMetadataOptions,\n mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nexport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n * as `requireBearerAuth` (401/403). Sending a bad token is still a client\n * error.\n */\nexport function optionalBearerAuth(\n options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n const required = requireBearerAuth(options);\n return (req, res, next) => {\n if (!req.headers.authorization) {\n next();\n return;\n }\n return required(req, res, next);\n };\n}\n"]}
|
package/dist/server/index.d.ts
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
|
+
export { type AuthInfo, type AuthMetadataOptions, type BearerAuthMiddlewareOptions, InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
|
|
1
2
|
export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
|
|
2
3
|
export { FileRef } from "./file-ref.js";
|
|
3
4
|
export type { AnyToolRegistry, InferTools, ToolInput, ToolNames, ToolOutput, ToolResponseMetadata, } from "./inferUtilityTypes.js";
|
|
4
5
|
export type { McpExtra, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard, } from "./middleware.js";
|
|
5
|
-
export type { HandlerContent, KnownToolMeta, McpServerTypes, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
|
|
6
|
+
export type { HandlerContent, KnownToolMeta, McpServerTypes, SecurityScheme, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
|
|
6
7
|
export { McpServer, normalizeContent, } from "./server.js";
|
|
7
8
|
export { viewsDevServer } from "./viewsDevServer.js";
|
package/dist/server/index.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
export { InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
|
|
1
2
|
export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
|
|
2
3
|
export { FileRef } from "./file-ref.js";
|
|
3
4
|
export { McpServer, normalizeContent, } from "./server.js";
|
package/dist/server/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA+BxC,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n type AuthInfo,\n type AuthMetadataOptions,\n type BearerAuthMiddlewareOptions,\n InvalidTokenError,\n mcpAuthMetadataRouter,\n optionalBearerAuth,\n requireBearerAuth,\n} from \"./auth.js\";\nexport {\n audio,\n embeddedResource,\n image,\n resourceLink,\n text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n AnyToolRegistry,\n InferTools,\n ToolInput,\n ToolNames,\n ToolOutput,\n ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n McpExtra,\n McpMethodString,\n McpMiddlewareFilter,\n McpMiddlewareFn,\n McpResultFor,\n McpTypedMiddlewareFn,\n McpWildcard,\n} from \"./middleware.js\";\nexport type {\n HandlerContent,\n KnownToolMeta,\n McpServerTypes,\n SecurityScheme,\n ToolDef,\n ToolMeta,\n ViewConfig,\n ViewCsp,\n ViewHostType,\n ViewName,\n ViewNameRegistry,\n} from \"./server.js\";\nexport {\n McpServer,\n normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}
|
package/dist/server/server.d.ts
CHANGED
|
@@ -36,12 +36,19 @@ export interface ViewConfig {
|
|
|
36
36
|
csp?: ViewCsp;
|
|
37
37
|
_meta?: Record<string, unknown>;
|
|
38
38
|
}
|
|
39
|
+
export type SecurityScheme = {
|
|
40
|
+
type: "noauth";
|
|
41
|
+
} | {
|
|
42
|
+
type: "oauth2";
|
|
43
|
+
scopes?: string[];
|
|
44
|
+
};
|
|
39
45
|
export interface KnownToolMeta {
|
|
40
46
|
"openai/widgetAccessible"?: boolean;
|
|
41
47
|
"openai/toolInvocation/invoking"?: string;
|
|
42
48
|
"openai/toolInvocation/invoked"?: string;
|
|
43
49
|
"openai/fileParams"?: string[];
|
|
44
50
|
ui?: Pick<McpUiToolMeta, "visibility">;
|
|
51
|
+
securitySchemes?: SecurityScheme[];
|
|
45
52
|
}
|
|
46
53
|
export type ToolMeta = KnownToolMeta & Record<string, unknown>;
|
|
47
54
|
export type HandlerContent = string | ContentBlock | ContentBlock[];
|
|
@@ -87,6 +94,14 @@ interface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {
|
|
|
87
94
|
outputSchema?: ZodRawShapeCompat | AnySchema;
|
|
88
95
|
annotations?: ToolAnnotations;
|
|
89
96
|
view?: ViewConfig;
|
|
97
|
+
/**
|
|
98
|
+
* Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).
|
|
99
|
+
* Lets clients label tools that require sign-in before calling, and pass
|
|
100
|
+
* the right scopes through the OAuth flow. Listing both `noauth` and
|
|
101
|
+
* `oauth2` signals that the tool works for anonymous callers and gives
|
|
102
|
+
* enhanced behavior to authenticated ones.
|
|
103
|
+
*/
|
|
104
|
+
securitySchemes?: SecurityScheme[];
|
|
90
105
|
_meta?: ToolMeta;
|
|
91
106
|
}
|
|
92
107
|
/**
|
|
@@ -149,6 +164,7 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
|
|
|
149
164
|
private mcpMiddlewareEntries;
|
|
150
165
|
private mcpMiddlewareApplied;
|
|
151
166
|
private claimedViews;
|
|
167
|
+
private viewMetaBuilders;
|
|
152
168
|
private viteManifest;
|
|
153
169
|
private readonly serverInfo;
|
|
154
170
|
private readonly serverOptions?;
|
|
@@ -205,6 +221,7 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
|
|
|
205
221
|
fetch: (...args: unknown[]) => unknown;
|
|
206
222
|
} | undefined>;
|
|
207
223
|
private enforceOneToolPerView;
|
|
224
|
+
private resolveViewRequestContext;
|
|
208
225
|
private registerViewResources;
|
|
209
226
|
private registerViewResource;
|
|
210
227
|
private wrapHandler;
|
package/dist/server/server.js
CHANGED
|
@@ -48,6 +48,7 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
48
48
|
mcpMiddlewareEntries = [];
|
|
49
49
|
mcpMiddlewareApplied = false;
|
|
50
50
|
claimedViews = new Map();
|
|
51
|
+
viewMetaBuilders = new Map();
|
|
51
52
|
viteManifest = null;
|
|
52
53
|
serverInfo;
|
|
53
54
|
serverOptions;
|
|
@@ -109,10 +110,32 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
109
110
|
return;
|
|
110
111
|
}
|
|
111
112
|
this.mcpMiddlewareApplied = true;
|
|
113
|
+
// Surface view-resource _meta on `resources/list` (per ext-apps spec:
|
|
114
|
+
// hosts/checkers read CSP & domain at list time before fetching content).
|
|
115
|
+
const viewListMetaEntry = {
|
|
116
|
+
filter: "resources/list",
|
|
117
|
+
handler: async (_req, extra, next) => {
|
|
118
|
+
const result = (await next());
|
|
119
|
+
for (const resource of result.resources) {
|
|
120
|
+
const builder = this.viewMetaBuilders.get(resource.uri);
|
|
121
|
+
if (!builder) {
|
|
122
|
+
continue;
|
|
123
|
+
}
|
|
124
|
+
const meta = builder(extra);
|
|
125
|
+
resource._meta = {
|
|
126
|
+
...(resource._meta ?? {}),
|
|
127
|
+
...meta,
|
|
128
|
+
};
|
|
129
|
+
}
|
|
130
|
+
return result;
|
|
131
|
+
},
|
|
132
|
+
};
|
|
112
133
|
const monitoringEntry = createMiddlewareEntry();
|
|
113
|
-
const entries =
|
|
114
|
-
? [monitoringEntry
|
|
115
|
-
|
|
134
|
+
const entries = [
|
|
135
|
+
...(monitoringEntry ? [monitoringEntry] : []),
|
|
136
|
+
viewListMetaEntry,
|
|
137
|
+
...this.mcpMiddlewareEntries,
|
|
138
|
+
];
|
|
116
139
|
if (entries.length === 0) {
|
|
117
140
|
return;
|
|
118
141
|
}
|
|
@@ -199,6 +222,57 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
199
222
|
}
|
|
200
223
|
this.claimedViews.set(component, toolName);
|
|
201
224
|
}
|
|
225
|
+
resolveViewRequestContext(extra) {
|
|
226
|
+
const isProduction = process.env.NODE_ENV === "production";
|
|
227
|
+
const headers = extra?.requestInfo?.headers || {};
|
|
228
|
+
const header = (key) => {
|
|
229
|
+
const val = headers[key];
|
|
230
|
+
return Array.isArray(val) ? val[0] : val;
|
|
231
|
+
};
|
|
232
|
+
const isClaude = header("user-agent") === "Claude-User";
|
|
233
|
+
let serverUrl;
|
|
234
|
+
const forwardedHost = header("x-forwarded-host");
|
|
235
|
+
const origin = header("origin");
|
|
236
|
+
const host = header("host");
|
|
237
|
+
if (forwardedHost) {
|
|
238
|
+
const proto = header("x-forwarded-proto") || "https";
|
|
239
|
+
serverUrl = `${proto}://${forwardedHost}`;
|
|
240
|
+
}
|
|
241
|
+
else if (origin) {
|
|
242
|
+
serverUrl = origin;
|
|
243
|
+
}
|
|
244
|
+
else if (host) {
|
|
245
|
+
const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
|
|
246
|
+
? "http"
|
|
247
|
+
: "https";
|
|
248
|
+
serverUrl = `${proto}://${host}`;
|
|
249
|
+
}
|
|
250
|
+
else {
|
|
251
|
+
const devPort = process.env.__PORT || "3000";
|
|
252
|
+
serverUrl = `http://localhost:${devPort}`;
|
|
253
|
+
}
|
|
254
|
+
const connectDomains = [serverUrl];
|
|
255
|
+
if (!isProduction) {
|
|
256
|
+
const wsUrl = new URL(serverUrl);
|
|
257
|
+
wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
|
|
258
|
+
connectDomains.push(wsUrl.origin);
|
|
259
|
+
}
|
|
260
|
+
let contentMetaOverrides = {};
|
|
261
|
+
if (isClaude) {
|
|
262
|
+
const pathname = extra?.requestInfo?.url?.pathname ?? "";
|
|
263
|
+
const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
|
|
264
|
+
// Strip a lone trailing slash so the hash matches the connector URL
|
|
265
|
+
// as registered with Claude (which has no trailing slash on bare origins).
|
|
266
|
+
const url = rawUrl.endsWith("/") ? rawUrl.slice(0, -1) : rawUrl;
|
|
267
|
+
const hash = crypto
|
|
268
|
+
.createHash("sha256")
|
|
269
|
+
.update(url)
|
|
270
|
+
.digest("hex")
|
|
271
|
+
.slice(0, 32);
|
|
272
|
+
contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };
|
|
273
|
+
}
|
|
274
|
+
return { serverUrl, connectDomains, contentMetaOverrides };
|
|
275
|
+
}
|
|
202
276
|
registerViewResources(toolName, view, toolMeta) {
|
|
203
277
|
const hosts = view.hosts ?? ["apps-sdk", "mcp-app"];
|
|
204
278
|
// Append a content-derived version param so hosts (e.g. ChatGPT) bust
|
|
@@ -308,35 +382,19 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
308
382
|
}
|
|
309
383
|
registerViewResource({ name, viewResource, view, }) {
|
|
310
384
|
const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;
|
|
385
|
+
const buildMeta = (extra) => {
|
|
386
|
+
const { serverUrl, connectDomains, contentMetaOverrides } = this.resolveViewRequestContext(extra);
|
|
387
|
+
return buildContentMeta({
|
|
388
|
+
resourceDomains: [serverUrl],
|
|
389
|
+
connectDomains,
|
|
390
|
+
domain: serverUrl,
|
|
391
|
+
baseUriDomains: [serverUrl],
|
|
392
|
+
}, contentMetaOverrides);
|
|
393
|
+
};
|
|
394
|
+
this.viewMetaBuilders.set(viewUri, buildMeta);
|
|
311
395
|
this.registerResource(name, viewUri, { description: view.description }, async (uri, extra) => {
|
|
312
396
|
const isProduction = process.env.NODE_ENV === "production";
|
|
313
|
-
const
|
|
314
|
-
const headers = extra?.requestInfo?.headers || {};
|
|
315
|
-
const header = (key) => {
|
|
316
|
-
const val = headers[key];
|
|
317
|
-
return Array.isArray(val) ? val[0] : val;
|
|
318
|
-
};
|
|
319
|
-
let serverUrl;
|
|
320
|
-
const forwardedHost = header("x-forwarded-host");
|
|
321
|
-
const origin = header("origin");
|
|
322
|
-
const host = header("host");
|
|
323
|
-
if (forwardedHost) {
|
|
324
|
-
const proto = header("x-forwarded-proto") || "https";
|
|
325
|
-
serverUrl = `${proto}://${forwardedHost}`;
|
|
326
|
-
}
|
|
327
|
-
else if (origin) {
|
|
328
|
-
serverUrl = origin;
|
|
329
|
-
}
|
|
330
|
-
else if (host) {
|
|
331
|
-
const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
|
|
332
|
-
? "http"
|
|
333
|
-
: "https";
|
|
334
|
-
serverUrl = `${proto}://${host}`;
|
|
335
|
-
}
|
|
336
|
-
else {
|
|
337
|
-
const devPort = process.env.__PORT || "3000";
|
|
338
|
-
serverUrl = `http://localhost:${devPort}`;
|
|
339
|
-
}
|
|
397
|
+
const { serverUrl } = this.resolveViewRequestContext(extra);
|
|
340
398
|
const html = isProduction
|
|
341
399
|
? templateHelper.renderProduction({
|
|
342
400
|
hostType,
|
|
@@ -349,35 +407,9 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
349
407
|
serverUrl,
|
|
350
408
|
viewName: view.component,
|
|
351
409
|
});
|
|
352
|
-
const connectDomains = [serverUrl];
|
|
353
|
-
if (!isProduction) {
|
|
354
|
-
const wsUrl = new URL(serverUrl);
|
|
355
|
-
wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
|
|
356
|
-
connectDomains.push(wsUrl.origin);
|
|
357
|
-
}
|
|
358
|
-
let contentMetaOverrides = {};
|
|
359
|
-
if (isClaude) {
|
|
360
|
-
const pathname = extra?.requestInfo?.url?.pathname ?? "";
|
|
361
|
-
const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
|
|
362
|
-
// Strip a lone trailing slash so the hash matches the connector URL
|
|
363
|
-
// as registered with Claude (which has no trailing slash on bare origins).
|
|
364
|
-
const url = rawUrl.endsWith("/") ? rawUrl.slice(0, -1) : rawUrl;
|
|
365
|
-
const hash = crypto
|
|
366
|
-
.createHash("sha256")
|
|
367
|
-
.update(url)
|
|
368
|
-
.digest("hex")
|
|
369
|
-
.slice(0, 32);
|
|
370
|
-
contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };
|
|
371
|
-
}
|
|
372
|
-
const contentMeta = buildContentMeta({
|
|
373
|
-
resourceDomains: [serverUrl],
|
|
374
|
-
connectDomains,
|
|
375
|
-
domain: serverUrl,
|
|
376
|
-
baseUriDomains: [serverUrl],
|
|
377
|
-
}, contentMetaOverrides);
|
|
378
410
|
return {
|
|
379
411
|
contents: [
|
|
380
|
-
{ uri: uri.href, mimeType, text: html, _meta:
|
|
412
|
+
{ uri: uri.href, mimeType, text: html, _meta: buildMeta(extra) },
|
|
381
413
|
],
|
|
382
414
|
};
|
|
383
415
|
});
|
|
@@ -454,8 +486,16 @@ export class McpServer extends McpServerBaseOmitted {
|
|
|
454
486
|
}
|
|
455
487
|
const config = args[0];
|
|
456
488
|
const cb = args[1];
|
|
457
|
-
const { name, view, _meta: userToolMeta, ...toolFields } = config;
|
|
489
|
+
const { name, view, securitySchemes, _meta: userToolMeta, ...toolFields } = config;
|
|
458
490
|
const toolMeta = { ...userToolMeta };
|
|
491
|
+
if (securitySchemes) {
|
|
492
|
+
// SEP-1488 puts `securitySchemes` at the top level of the tool
|
|
493
|
+
// descriptor, but the SDK's `registerTool` drops unknown top-level
|
|
494
|
+
// fields, so the canonical spot isn't reachable without intercepting
|
|
495
|
+
// `tools/list`. Use the `_meta` back-compat mirror documented in the
|
|
496
|
+
// Apps SDK reference until SEP-1488 lands in the spec.
|
|
497
|
+
toolMeta.securitySchemes = securitySchemes;
|
|
498
|
+
}
|
|
459
499
|
if (view) {
|
|
460
500
|
this.enforceOneToolPerView(view.component, name);
|
|
461
501
|
this.registerViewResources(name, view, toolMeta);
|