skybridge 0.0.0-dev.d60c856 → 0.0.0-dev.d613883

package/dist/server/requestOrigin.js

@@ -0,0 +1,25 @@
+/**
+ * Resolves this server's public origin from request headers, in precedence
+ * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
+ * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:
+ * it carries the *caller's* site, not this server's.
+ */
+export function resolveServerOrigin(header) {
+    // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing
+    // hop is the first entry.
+    const firstHop = (value) => value?.split(",")[0]?.trim();
+    const forwardedHost = firstHop(header("x-forwarded-host"));
+    if (forwardedHost) {
+        const proto = firstHop(header("x-forwarded-proto")) || "https";
+        return `${proto}://${forwardedHost}`;
+    }
+    const host = header("host");
+    if (host) {
+        const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
+            ? "http"
+            : "https";
+        return `${proto}://${host}`;
+    }
+    return `http://localhost:${process.env.__PORT || "3000"}`;
+}
+//# sourceMappingURL=requestOrigin.js.map

package/dist/server/requestOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestOrigin.js","sourceRoot":"","sources":["../../src/server/requestOrigin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2C;IAE3C,+EAA+E;IAC/E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/D,OAAO,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * Resolves this server's public origin from request headers, in precedence\n * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving\n * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:\n * it carries the *caller's* site, not this server's.\n */\nexport function resolveServerOrigin(\n  header: (key: string) => string | undefined,\n): string {\n  // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing\n  // hop is the first entry.\n  const firstHop = (value: string | undefined) => value?.split(\",\")[0]?.trim();\n  const forwardedHost = firstHop(header(\"x-forwarded-host\"));\n  if (forwardedHost) {\n    const proto = firstHop(header(\"x-forwarded-proto\")) || \"https\";\n    return `${proto}://${forwardedHost}`;\n  }\n  const host = header(\"host\");\n  if (host) {\n    const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) => host.startsWith(p))\n      ? \"http\"\n      : \"https\";\n    return `${proto}://${host}`;\n  }\n  return `http://localhost:${process.env.__PORT || \"3000\"}`;\n}\n"]}

package/dist/server/server.d.ts

@@ -4,14 +4,32 @@ import { McpServer as McpServerBase } from "@modelcontextprotocol/sdk/server/mcp
 import type { AnySchema, SchemaOutput, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
 import type { ContentBlock, Implementation, RequestMeta, ServerNotification, ServerRequest, ServerResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
-import { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import express, { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import type { OAuthConfig } from "./auth/index.js";
 import type { McpExtra, McpExtraFor, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard } from "./middleware.js";
+/**
+ * Type marker for a registered tool — carries its input, output, and response
+ * metadata shapes so views can infer types from `typeof server`.
+ *
+ * You normally never construct this by hand; it is produced by `registerTool`
+ * and consumed by helpers like {@link InferTools} and {@link generateHelpers}.
+ */
 export type ToolDef<TInput = unknown, TOutput = unknown, TResponseMetadata = unknown> = {
     input: TInput;
     output: TOutput;
     responseMetadata: TResponseMetadata;
 };
+/**
+ * @deprecated Views now always emit a single ext-apps resource; host targeting
+ * no longer applies. Retained for backwards compatibility; will be removed in a
+ * future major.
+ */
 export type ViewHostType = "apps-sdk" | "mcp-app";
+/**
+ * Content Security Policy origins attached to a view's resource. Each list is
+ * passed through to the host's CSP for the view iframe; omit a field to inherit
+ * the host's default for that directive.
+ */
 export interface ViewCsp {
     /** Origins for static assets (images, fonts, scripts, styles). */
     resourceDomains?: string[];
@@ -24,26 +42,90 @@ export interface ViewCsp {
     /** Origins allowed in `<base href>` tags (mcp-apps only). */
     baseUriDomains?: string[];
 }
+/**
+ * Registry of view component names. The Skybridge Vite plugin augments this
+ * interface in the generated `.skybridge/views.d.ts` with one key per view
+ * file, which narrows {@link ViewName} from `string` to the concrete union.
+ */
 export interface ViewNameRegistry {
 }
-export type ViewName = keyof ViewNameRegistry & string;
+/**
+ * Resolve view component names from a registry: the union of its keys, or
+ * `string` when the registry is empty. The empty case happens before
+ * `.skybridge/views.d.ts` is generated; falling back to `string` keeps valid
+ * view names from erroring on a fresh checkout, and narrowing kicks in once
+ * the generated file augments the registry.
+ */
+export type ViewNameFor<Registry> = [keyof Registry & string] extends [never] ? string : keyof Registry & string;
+/** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */
+export type ViewName = ViewNameFor<ViewNameRegistry>;
+/**
+ * Pass under `view` in a tool's `registerTool` config to render the tool's
+ * result through a Skybridge view instead of a plain text response.
+ */
 export interface ViewConfig {
+    /** Filename of the view module (without extension) — matches a file in your `viewsDir`. */
     component: ViewName;
+    /** Human-readable label the host may show alongside the view. */
     description?: string;
+    /**
+     * @deprecated No-op. Every view emits a single ext-apps resource regardless
+     * of this value. Will be removed in a future major.
+     */
     hosts?: ViewHostType[];
+    /** Request a visible border around the view (forwarded as `ui.prefersBorder`). */
     prefersBorder?: boolean;
+    /** Override the iframe's served domain (advanced; forwarded as `ui.domain`). */
     domain?: string;
+    /** Per-view CSP overrides — see {@link ViewCsp}. */
     csp?: ViewCsp;
+    /** Free-form metadata forwarded on the view resource's `_meta`. */
     _meta?: Record<string, unknown>;
 }
+export type SecurityScheme = {
+    type: "noauth";
+} | {
+    type: "oauth2";
+    scopes?: string[];
+};
+/**
+ * Options forwarded to the built-in `express.json()` body parser. Derived
+ * from Express's own types so the public API doesn't depend on `body-parser`.
+ */
+export type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;
+/** Skybridge-specific server options, passed as the third `McpServer` constructor argument. */
+export interface SkybridgeServerOptions {
+    /** Options for the built-in `express.json()` middleware, e.g. `{ limit: "10mb" }`. */
+    json?: JsonOptions;
+    /** Resource-server OAuth config. When set, mounts well-known metadata and bearer auth on `/mcp`. */
+    oauth?: OAuthConfig;
+}
+/**
+ * Well-known keys recognized by host runtimes when set on a tool's `_meta`.
+ * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.
+ *
+ * @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters
+ */
 export interface KnownToolMeta {
+    /** Apps SDK: allow the rendered view to call this tool from inside its iframe. */
     "openai/widgetAccessible"?: boolean;
+    /** Apps SDK: status text shown while the tool is running (e.g. `"Searching trips"`). */
     "openai/toolInvocation/invoking"?: string;
+    /** Apps SDK: status text shown once the tool returns (e.g. `"Found 3 trips"`). */
     "openai/toolInvocation/invoked"?: string;
+    /** Apps SDK: input parameters that hold file references — the host attaches uploaded files to them. */
     "openai/fileParams"?: string[];
+    /** MCP Apps: control whether the tool is exposed to the model, the app, or both. */
     ui?: Pick<McpUiToolMeta, "visibility">;
+    securitySchemes?: SecurityScheme[];
 }
+/** {@link KnownToolMeta} merged with arbitrary string-keyed metadata for custom flags. */
 export type ToolMeta = KnownToolMeta & Record<string, unknown>;
+/**
+ * Convenient return type for tool handlers — a plain string, a single
+ * {@link ContentBlock}, or an array. Skybridge normalizes it to the MCP
+ * `content: ContentBlock[]` shape before responding.
+ */
 export type HandlerContent = string | ContentBlock | ContentBlock[];
 /**
  * Type-level marker interface for cross-package type inference.
@@ -87,6 +169,14 @@ interface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {
     outputSchema?: ZodRawShapeCompat | AnySchema;
     annotations?: ToolAnnotations;
     view?: ViewConfig;
+    /**
+     * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).
+     * Lets clients label tools that require sign-in before calling, and pass
+     * the right scopes through the OAuth flow. Listing both `noauth` and
+     * `oauth2` signals that the tool works for anonymous callers and gives
+     * enhanced behavior to authenticated ones.
+     */
+    securitySchemes?: SecurityScheme[];
     _meta?: ToolMeta;
 }
 /**
@@ -126,10 +216,26 @@ type ToolHandler<TInput extends ZodRawShapeCompat, TReturn extends {
 } = {
     content?: HandlerContent;
 }> = (args: ShapeOutput<TInput>, extra: ToolHandlerExtra) => TReturn | Promise<TReturn>;
+/**
+ * Coerce a tool handler's return value into an MCP `content` array. Strings
+ * become a single `TextContent`; a single block is wrapped in an array;
+ * `undefined` produces `[]`. Mostly used internally — exported so consumers
+ * who build content lazily can apply the same normalization.
+ */
 export declare function normalizeContent(content: HandlerContent | undefined): ContentBlock[];
 interface McpServerBaseOmitted extends Omit<McpServerBase, "registerTool" | "connect"> {
 }
 declare const McpServerBaseOmitted: new (...args: ConstructorParameters<typeof McpServerBase>) => McpServerBaseOmitted;
+/**
+ * Prime the build-time Vite manifest before user code constructs its
+ * `McpServer`. Called from the generated `dist/__entry.js`; not part of the
+ * user-facing API.
+ *
+ * @internal
+ */
+export declare function __setBuildManifest(manifest: Record<string, {
+    file: string;
+}>): void;
 export declare class McpServer<TTools extends Record<string, ToolDef> = Record<never, ToolDef>> extends McpServerBaseOmitted {
     readonly $types: McpServerTypes<TTools>;
     /**
@@ -137,7 +243,9 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
      * custom routes, middleware, or settings — e.g.
      * `server.express.get("/health", ...)`.
      *
-     * `express.json()` is pre-applied. Register your handlers before `run()`;
+     * `express.json()` is pre-applied — tune it via the constructor's third
+     * argument, e.g. `new McpServer(info, {}, { json: { limit: "10mb" } })`.
+     * Register your handlers before `run()`;
      * after `run()`, dev-mode middleware, the `/mcp` route, and the default
      * error handler are appended in that order.
      *
@@ -149,12 +257,41 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
     private mcpMiddlewareEntries;
     private mcpMiddlewareApplied;
     private claimedViews;
+    private viewMetaBuilders;
+    /**
+     * Maps a view resource's query-less path to its canonical registered URI
+     * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the
+     * underlying view no matter which version param the consumer sends, since
+     * the param is only a cache key, not part of the resource's identity.
+     */
+    private viewUriByPath;
     private viteManifest;
     private readonly serverInfo;
     private readonly serverOptions?;
-    constructor(serverInfo: Implementation, options?: ServerOptions);
+    constructor(serverInfo: Implementation, options?: ServerOptions, skybridgeOptions?: SkybridgeServerOptions);
+    /**
+     * Register Express middleware on the underlying app. Mirrors `app.use` —
+     * pass handlers directly or a path-prefixed handler list. Register before
+     * {@link McpServer.run}; ordering matches Express.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work
+     * locally and on self-hosted deployments.
+     */
     use(...handlers: RequestHandler[]): this;
     use(path: string, ...handlers: RequestHandler[]): this;
+    /**
+     * Register Express error-handling middleware to run after the built-in
+     * `/mcp` route (or your custom route). Use this to log or transform errors
+     * thrown by tool handlers before the default error handler responds.
+     *
+     * @example
+     * ```ts
+     * server.useOnError((err, _req, _res, next) => {
+     *   logger.error(err);
+     *   next(err);
+     * });
+     * ```
+     */
     useOnError(...handlers: ErrorRequestHandler[]): this;
     useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;
     /** Register MCP protocol-level middleware (catch-all). */
@@ -189,6 +326,14 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
      */
     mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn): this;
     private applyMcpMiddleware;
+    /**
+     * Connect to an MCP transport (override of the SDK's `connect`). Use this
+     * when you're embedding Skybridge in a host that already manages its own
+     * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}
+     * which sets the transport up for you. Locks in any middleware registered
+     * via {@link McpServer.mcpMiddleware} — further calls to that method will
+     * throw afterwards.
+     */
     connect(transport: Parameters<typeof McpServerBase.prototype.connect>[0]): Promise<void>;
     /**
      * Per-request stateless connect. The SDK's `Protocol` only allows one
@@ -201,12 +346,26 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
      * read side and fails fast on SDK field renames.
      */
     connectStatelessTransport(transport: Parameters<typeof McpServerBase.prototype.connect>[0]): Promise<void>;
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, applies any custom Express middleware registered
+     * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in
+     * any MCP middleware registered via {@link McpServer.mcpMiddleware}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Vercel (`VERCEL === "1"`), returns the Express app directly so the
+     * serverless function entry can call it as a `(req, res)` handler. On
+     * Node, returns `undefined` once listening.
+     */
     run(): Promise<{
         fetch: (...args: unknown[]) => unknown;
-    } | undefined>;
+    } | Express | undefined>;
     private enforceOneToolPerView;
+    private resolveViewRequestContext;
     private registerViewResources;
     private registerViewResource;
+    private serveLegacyAppsSdkUrl;
     private wrapHandler;
     private computeViewVersionParam;
     private lookupViewFile;
@@ -221,6 +380,35 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
         file: string;
     }>): this;
     private readManifest;
+    /**
+     * Register a tool. Pass a `config` describing the tool (name, schemas,
+     * optional {@link ViewConfig}, optional {@link ToolMeta}) and a handler that
+     * returns the tool's result.
+     *
+     * Chain calls to build up a server: each call returns a new `McpServer`
+     * type that captures the tool's input/output/`_meta` shape so the
+     * resulting `typeof server` can drive {@link generateHelpers}.
+     *
+     * The handler's return shape determines the output types: the
+     * `structuredContent` field becomes the tool's typed output, and `_meta`
+     * becomes its `responseMetadata`. The `content` field is normalized through
+     * {@link normalizeContent}.
+     *
+     * @example
+     * ```ts
+     * server.registerTool({
+     *   name: "search",
+     *   inputSchema: { query: z.string() },
+     *   outputSchema: { results: z.array(z.string()) },
+     *   view: { component: "search" },
+     * }, async ({ query }) => ({
+     *   content: `Found results for ${query}`,
+     *   structuredContent: { results: [...] },
+     * }));
+     * ```
+     *
+     * @see https://docs.skybridge.tech/api-reference/register-tool
+     */
     registerTool<TName extends string, InputArgs extends ZodRawShapeCompat, TReturn extends {
         content?: HandlerContent;
     }>(config: ToolConfig<InputArgs> & {