skybridge 0.0.0-dev.d6eb159 → 0.0.0-dev.d71cf9e

package/dist/server/register-tool.test.js

@@ -0,0 +1,25 @@
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { describe, expect, it } from "vitest";
+import { McpServer } from "./server.js";
+describe("registerTool handler invocation", () => {
+    it("passes empty args and a usable extra to a schema-less tool handler", async () => {
+        let received;
+        const server = new McpServer({
+            name: "test",
+            version: "1.0.0",
+        }).registerTool({ name: "no-input", description: "no-input" }, async (args, extra) => {
+            received = { args, extra };
+            return { content: [{ type: "text", text: "ok" }] };
+        });
+        const client = new Client({ name: "client", version: "1.0.0" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        await client.callTool({ name: "no-input" });
+        expect(received?.args).toEqual({});
+        expect(received?.extra).toHaveProperty("mcpReq.send");
+        await client.close();
+        await server.close();
+    });
+});
+//# sourceMappingURL=register-tool.test.js.map

package/dist/server/register-tool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-tool.test.js","sourceRoot":"","sources":["../../src/server/register-tool.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,IAAI,QAAuD,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC,YAAY,CACb,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,EAC7C,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5C,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAEtD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client, InMemoryTransport } from \"@modelcontextprotocol/client\";\nimport { describe, expect, it } from \"vitest\";\nimport { McpServer } from \"./server.js\";\n\ndescribe(\"registerTool handler invocation\", () => {\n  it(\"passes empty args and a usable extra to a schema-less tool handler\", async () => {\n    let received: { args: unknown; extra: unknown } | undefined;\n    const server = new McpServer({\n      name: \"test\",\n      version: \"1.0.0\",\n    }).registerTool(\n      { name: \"no-input\", description: \"no-input\" },\n      async (args, extra) => {\n        received = { args, extra };\n        return { content: [{ type: \"text\", text: \"ok\" }] };\n      },\n    );\n\n    const client = new Client({ name: \"client\", version: \"1.0.0\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    await server.connect(serverTransport);\n    await client.connect(clientTransport);\n\n    await client.callTool({ name: \"no-input\" });\n\n    expect(received?.args).toEqual({});\n    expect(received?.extra).toHaveProperty(\"mcpReq.send\");\n\n    await client.close();\n    await server.close();\n  });\n});\n"]}

package/dist/server/requestOrigin.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolves this server's public origin from request headers, in precedence
+ * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
+ * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:
+ * it carries the *caller's* site, not this server's.
+ */
+export declare function resolveServerOrigin(header: (key: string) => string | undefined): string;

package/dist/server/requestOrigin.js

@@ -0,0 +1,25 @@
+/**
+ * Resolves this server's public origin from request headers, in precedence
+ * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving
+ * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:
+ * it carries the *caller's* site, not this server's.
+ */
+export function resolveServerOrigin(header) {
+    // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing
+    // hop is the first entry.
+    const firstHop = (value) => value?.split(",")[0]?.trim();
+    const forwardedHost = firstHop(header("x-forwarded-host"));
+    if (forwardedHost) {
+        const proto = firstHop(header("x-forwarded-proto")) || "https";
+        return `${proto}://${forwardedHost}`;
+    }
+    const host = header("host");
+    if (host) {
+        const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
+            ? "http"
+            : "https";
+        return `${proto}://${host}`;
+    }
+    return `http://localhost:${process.env.__PORT || "3000"}`;
+}
+//# sourceMappingURL=requestOrigin.js.map

package/dist/server/requestOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestOrigin.js","sourceRoot":"","sources":["../../src/server/requestOrigin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2C;IAE3C,+EAA+E;IAC/E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/D,OAAO,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * Resolves this server's public origin from request headers, in precedence\n * `x-forwarded-host` → `host` → localhost dev fallback. Shared by view serving\n * and OAuth metadata so the two can't drift. `Origin` is deliberately ignored:\n * it carries the *caller's* site, not this server's.\n */\nexport function resolveServerOrigin(\n  header: (key: string) => string | undefined,\n): string {\n  // Proxies may send X-Forwarded-* as a comma-separated chain; the client-facing\n  // hop is the first entry.\n  const firstHop = (value: string | undefined) => value?.split(\",\")[0]?.trim();\n  const forwardedHost = firstHop(header(\"x-forwarded-host\"));\n  if (forwardedHost) {\n    const proto = firstHop(header(\"x-forwarded-proto\")) || \"https\";\n    return `${proto}://${forwardedHost}`;\n  }\n  const host = header(\"host\");\n  if (host) {\n    const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) => host.startsWith(p))\n      ? \"http\"\n      : \"https\";\n    return `${proto}://${host}`;\n  }\n  return `http://localhost:${process.env.__PORT || \"3000\"}`;\n}\n"]}

package/dist/server/server.d.ts

@@ -1,44 +1,171 @@
-import type { McpUiResourceMeta } from "@modelcontextprotocol/ext-apps";
-import { McpServer as McpServerBase, type RegisteredTool } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { AnySchema, SchemaOutput, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/server/zod-compat.js";
-import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
-import type { CallToolResult, Resource, ServerNotification, ServerRequest, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
-import type { RequestHandler } from "express";
+import type { McpUiToolMeta } from "@modelcontextprotocol/ext-apps";
+import { type CacheHint, type ContentBlock, type Icon, type Implementation, McpServer as McpServerBase, type PromptCallback, type ReadResourceCallback, type ReadResourceTemplateCallback, type RegisteredPrompt, type RegisteredResource, type RegisteredResourceTemplate, type RequestMeta, type ResourceMetadata, type ResourceTemplate, type Server as SdkServer, type ServerOptions, type ServerResult, type StandardSchemaV1, type StandardSchemaWithJSON, type ToolAnnotations } from "@modelcontextprotocol/server";
+import express, { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import type { InferSchemaOutput, RawInputShape } from "../standard-schema.js";
+import type { OAuthConfig } from "./auth/index.js";
+import type { ExtraClaims } from "./auth.js";
+import type { McpExtra, McpExtraFor, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard } from "./middleware.js";
+import { type SkillsManifest } from "./skills.js";
+/**
+ * Type marker for a registered tool — carries its input, output, and response
+ * metadata shapes so views can infer types from `typeof server`.
+ *
+ * You normally never construct this by hand; it is produced by `registerTool`
+ * and consumed by helpers like {@link InferTools} and {@link generateHelpers}.
+ */
 export type ToolDef<TInput = unknown, TOutput = unknown, TResponseMetadata = unknown> = {
     input: TInput;
     output: TOutput;
     responseMetadata: TResponseMetadata;
 };
 /**
- * Extended MCP Apps CSP with upcoming fields from ext-apps PR #158
- * and Skybridge-specific fields for OpenAI compatibility
- * @see https://github.com/modelcontextprotocol/ext-apps/pull/158
+ * The runtime a served view page declares on `window.skybridge`. Every view
+ * emits a single ext-apps resource, so this is always `"mcp-app"`; the Apps
+ * SDK runtime is detected at load time via `window.openai` instead.
  */
-type ExtendedMcpUiResourceCsp = McpUiResourceMeta["csp"] & {
-    /**
-     * Origins that can receive openExternal redirects without safe-link modal (OpenAI-specific)
-     * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields
-     */
+export type ViewHostType = "mcp-app";
+/**
+ * Content Security Policy origins attached to a view's resource. Each list is
+ * passed through to the host's CSP for the view iframe; omit a field to inherit
+ * the host's default for that directive.
+ */
+export interface ViewCsp {
+    /** Origins for static assets (images, fonts, scripts, styles). */
+    resourceDomains?: string[];
+    /** Origins the view may contact via fetch/XHR. */
+    connectDomains?: string[];
+    /** Origins allowed for iframe embeds (opts into stricter app review). */
+    frameDomains?: string[];
+    /** Origins that can receive openExternal redirects without the safe-link modal. */
     redirectDomains?: string[];
+    /** Origins allowed in `<base href>` tags (mcp-apps only). */
+    baseUriDomains?: string[];
+}
+/**
+ * Registry of view component names. The Skybridge Vite plugin augments this
+ * interface in the generated `.skybridge/views.d.ts` with one key per view
+ * file, which narrows {@link ViewName} from `string` to the concrete union.
+ */
+export interface ViewNameRegistry {
+}
+/**
+ * Resolve view component names from a registry: the union of its keys, or
+ * `string` when the registry is empty. The empty case happens before
+ * `.skybridge/views.d.ts` is generated; falling back to `string` keeps valid
+ * view names from erroring on a fresh checkout, and narrowing kicks in once
+ * the generated file augments the registry.
+ */
+export type ViewNameFor<Registry> = [keyof Registry & string] extends [never] ? string : keyof Registry & string;
+/** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */
+export type ViewName = ViewNameFor<ViewNameRegistry>;
+/**
+ * Pass under `view` in a tool's `registerTool` config to render the tool's
+ * result through a Skybridge view instead of a plain text response.
+ */
+export interface ViewConfig {
+    /** Filename of the view module (without extension) — matches a file in your `viewsDir`. */
+    component: ViewName;
+    /** Human-readable label the host may show alongside the view. */
+    description?: string;
+    /** Request a visible border around the view (forwarded as `ui.prefersBorder`). */
+    prefersBorder?: boolean;
+    /** Override the iframe's served domain (advanced; forwarded as `ui.domain`). */
+    domain?: string;
+    /** Per-view CSP overrides — see {@link ViewCsp}. */
+    csp?: ViewCsp;
+    /** Free-form metadata forwarded on the view resource's `_meta`. */
+    _meta?: Record<string, unknown>;
+}
+export type SecurityScheme = {
+    type: "noauth";
+} | {
+    type: "oauth2";
+    scopes?: string[];
 };
-/** Extended MCP Apps resource metadata with upcoming CSP fields */
-type ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, "csp"> & {
-    csp?: ExtendedMcpUiResourceCsp;
-};
-/** User-provided resource configuration with optional CSP override */
-export type WidgetResourceMeta = {
-    ui?: ExtendedMcpUiResourceMeta;
-} & Resource["_meta"];
-export type WidgetHostType = "apps-sdk" | "mcp-app";
-type McpServerOriginalResourceConfig = Omit<Resource, "uri" | "name" | "mimeType" | "_meta"> & {
-    _meta?: WidgetResourceMeta;
-    /** Restrict host types to a specific subset */
-    hosts?: WidgetHostType[];
+/**
+ * Declarative per-tool auth. Enforced when the server has an `oauth` provider:
+ * anonymous or under-scoped calls are rejected before the handler runs. Omit
+ * `auth` entirely for the secure default (sign-in required, no specific scope).
+ */
+export type ToolAuth = {
+    /**
+     * When `true`, the tool is callable signed out; the token is still used when
+     * one is present. Omit (or `false`) to require sign-in.
+     */
+    allowsAnonymous?: boolean;
+    /** OAuth scopes the caller's token must carry to invoke the tool. */
+    scopes?: string[];
 };
-type McpServerOriginalToolConfig = Omit<Parameters<typeof McpServerBase.prototype.registerTool<ZodRawShapeCompat, ZodRawShapeCompat>>[1], "inputSchema" | "outputSchema">;
+/**
+ * Options forwarded to the built-in `express.json()` body parser. Derived
+ * from Express's own types so the public API doesn't depend on `body-parser`.
+ */
+export type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;
+/**
+ * Skybridge-specific server options, passed as the third `McpServer` constructor
+ * argument.
+ *
+ * @typeParam TAuthExtra - Claims the `oauth` verifier populates. Inferred from
+ * the config a provider returns, and carried on to tool handlers.
+ */
+export interface SkybridgeServerOptions<TAuthExtra extends ExtraClaims = ExtraClaims> {
+    /** Options for the built-in `express.json()` middleware, e.g. `{ limit: "10mb" }`. */
+    json?: JsonOptions;
+    /** Resource-server OAuth config. When set, mounts well-known metadata and bearer auth on `/mcp`. */
+    oauth?: OAuthConfig<TAuthExtra>;
+    /**
+     * @experimental Serve Agent Skills from `src/skills` over MCP (SEP-2640).
+     * API may change.
+     */
+    skills?: boolean;
+}
+/**
+ * Well-known keys recognized by host runtimes when set on a tool's `_meta`.
+ * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.
+ *
+ * @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters
+ */
+export interface KnownToolMeta {
+    /** Apps SDK: allow the rendered view to call this tool from inside its iframe. */
+    "openai/widgetAccessible"?: boolean;
+    /** Apps SDK: status text shown while the tool is running (e.g. `"Searching trips"`). */
+    "openai/toolInvocation/invoking"?: string;
+    /** Apps SDK: status text shown once the tool returns (e.g. `"Found 3 trips"`). */
+    "openai/toolInvocation/invoked"?: string;
+    /** Apps SDK: input parameters that hold file references — the host attaches uploaded files to them. */
+    "openai/fileParams"?: string[];
+    /** MCP Apps: control whether the tool is exposed to the model, the app, or both. */
+    ui?: Pick<McpUiToolMeta, "visibility">;
+}
+/** {@link KnownToolMeta} merged with arbitrary string-keyed metadata for custom flags. */
+export type ToolMeta = KnownToolMeta & Record<string, unknown>;
+/**
+ * Convenient return type for tool handlers — a plain string, a single
+ * {@link ContentBlock}, or an array. Skybridge normalizes it to the MCP
+ * `content: ContentBlock[]` shape before responding.
+ */
+export type HandlerContent = string | ContentBlock | ContentBlock[];
+/**
+ * Type-level marker interface for cross-package type inference.
+ *
+ * Consumers infer tool types via the structural `$types` property rather than
+ * the `McpServer` class generic, because class-generic inference breaks when
+ * `McpServer` comes from different package installations (e.g. a consumer
+ * with its own `skybridge` dep vs. the in-tree workspace version).
+ *
+ * Inspired by tRPC's `_def` pattern and Hono's type markers.
+ */
+export interface McpServerTypes<TTools extends Record<string, ToolDef>> {
+    readonly tools: TTools;
+}
 type Simplify<T> = {
     [K in keyof T]: T[K];
 };
+type ShapeOutput<Shape extends RawInputShape> = Simplify<{
+    [K in keyof Shape as undefined extends InferSchemaOutput<Shape[K]> ? never : K]: InferSchemaOutput<Shape[K]>;
+} & {
+    [K in keyof Shape as undefined extends InferSchemaOutput<Shape[K]> ? K : never]?: InferSchemaOutput<Shape[K]>;
+}>;
 type ExtractStructuredContent<T> = T extends {
     structuredContent: infer SC;
 } ? Simplify<SC> : never;
@@ -49,57 +176,316 @@ type ExtractMeta<T> = [Extract<T, {
 }> extends {
     _meta: infer M;
 } ? Simplify<M> : unknown;
-/**
- * Type-level marker interface for cross-package type inference.
- * This enables TypeScript to infer tool types across package boundaries
- * using structural typing on the $types property, rather than relying on
- * class generic inference which fails when McpServer comes from different
- * package installations.
- *
- * Inspired by tRPC's _def pattern and Hono's type markers.
- */
-export interface McpServerTypes<TTools extends Record<string, ToolDef>> {
-    readonly tools: TTools;
-}
-type ShapeOutput<Shape extends ZodRawShapeCompat> = Simplify<{
-    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]> ? never : K]: SchemaOutput<Shape[K]>;
-} & {
-    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]> ? K : never]?: SchemaOutput<Shape[K]>;
-}>;
-type AddTool<TTools, TName extends string, TInput extends ZodRawShapeCompat, TOutput, TResponseMetadata = unknown> = McpServer<TTools & {
+type AddTool<TTools, TName extends string, TInput extends RawInputShape, TOutput, TResponseMetadata = unknown, TAuthExtra extends ExtraClaims = ExtraClaims> = McpServer<TTools & {
     [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;
-}>;
-type ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> = {
+}, TAuthExtra>;
+interface ToolConfigBase<TInput extends RawInputShape | StandardSchemaV1> {
+    name: string;
     title?: string;
     description?: string;
     inputSchema?: TInput;
-    outputSchema?: ZodRawShapeCompat | AnySchema;
+    outputSchema?: RawInputShape | StandardSchemaV1;
     annotations?: ToolAnnotations;
-    _meta?: Record<string, unknown>;
+    view?: ViewConfig;
+    _meta?: ToolMeta;
+}
+/**
+ * The auth face of a tool config: either the high-level `auth` shorthand or the
+ * low-level `securitySchemes` escape hatch, never both.
+ */
+type ToolAuthConfig = {
+    auth?: ToolAuth;
+    securitySchemes?: never;
+} | {
+    auth?: never;
+    /**
+     * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).
+     * Lets clients label tools that require sign-in before calling, and pass
+     * the right scopes through the OAuth flow. Listing both `noauth` and
+     * `oauth2` signals that the tool works for anonymous callers and gives
+     * enhanced behavior to authenticated ones.
+     */
+    securitySchemes?: SecurityScheme[];
+};
+type ToolConfig<TInput extends RawInputShape | StandardSchemaV1> = ToolConfigBase<TInput> & ToolAuthConfig;
+/**
+ * Optional client-supplied hints attached to `params._meta` on every tool call
+ * by the Apps SDK host. Hints only: never use for authorization, and tolerate
+ * absence.
+ * @see https://developers.openai.com/apps-sdk/reference#_meta-fields-the-client-provides
+ */
+export interface ClientHintsMeta {
+    /** Requested locale (BCP-47, e.g. `"en-US"`). */
+    "openai/locale"?: string;
+    /** Browser user-agent */
+    "openai/userAgent"?: string;
+    /** Coarse user location. May be partially populated. */
+    "openai/userLocation"?: {
+        city?: string;
+        region?: string;
+        country?: string;
+        timezone?: string;
+        longitude?: number;
+        latitude?: number;
+    };
+    /** Anonymized user id. */
+    "openai/subject"?: string;
+    /** Anonymized conversation id, stable within a ChatGPT session. */
+    "openai/session"?: string;
+    /** Anonymized organization id, when the user account is part of an organization. */
+    "openai/organization"?: string;
+    /** Stable id for the currently mounted widget instance. */
+    "openai/widgetSessionId"?: string;
+}
+type ToolHandlerExtra<TAuthExtra extends ExtraClaims = ExtraClaims> = Omit<McpExtra<TAuthExtra>, "mcpReq"> & {
+    mcpReq: Omit<McpExtra<TAuthExtra>["mcpReq"], "_meta"> & {
+        _meta?: RequestMeta & ClientHintsMeta;
+    };
 };
-type ToolHandler<TInput extends ZodRawShapeCompat, TReturn extends {
-    content: CallToolResult["content"];
-} = CallToolResult> = (args: ShapeOutput<TInput>, extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => TReturn | Promise<TReturn>;
-export declare class McpServer<TTools extends Record<string, ToolDef> = Record<never, ToolDef>> extends McpServerBase {
+type ToolHandler<TInput extends RawInputShape, TReturn extends {
+    content?: HandlerContent;
+} = {
+    content?: HandlerContent;
+}, TAuthExtra extends ExtraClaims = ExtraClaims> = (args: ShapeOutput<TInput>, extra: ToolHandlerExtra<TAuthExtra>) => TReturn | Promise<TReturn>;
+/**
+ * Coerce a tool handler's return value into an MCP `content` array. Strings
+ * become a single `TextContent`; a single block is wrapped in an array;
+ * `undefined` produces `[]`. Mostly used internally — exported so consumers
+ * who build content lazily can apply the same normalization.
+ */
+export declare function normalizeContent(content: HandlerContent | undefined): ContentBlock[];
+interface McpServerBaseOmitted extends Omit<McpServerBase, "registerTool" | "registerResource" | "registerPrompt" | "connect"> {
+}
+declare const McpServerBaseOmitted: new (...args: ConstructorParameters<typeof McpServerBase>) => McpServerBaseOmitted;
+/**
+ * Prime the build-time Vite manifest before user code constructs its
+ * `McpServer`. Called from the generated `dist/__entry.js`; not part of the
+ * user-facing API.
+ *
+ * @internal
+ */
+export declare function __setBuildManifest(manifest: Record<string, {
+    file: string;
+}>): void;
+export declare function __setSkillsManifest(manifest: SkillsManifest): void;
+export declare class McpServer<TTools extends Record<string, ToolDef> = Record<never, ToolDef>, TAuthExtra extends ExtraClaims = ExtraClaims> extends McpServerBaseOmitted {
     readonly $types: McpServerTypes<TTools>;
-    private express?;
-    private customMiddleware;
+    /**
+     * The underlying Express app. Use this to extend the HTTP server with
+     * custom routes, middleware, or settings — e.g.
+     * `server.express.get("/health", ...)`.
+     *
+     * `express.json()` is pre-applied — tune it via the constructor's third
+     * argument, e.g. `new McpServer(info, {}, { json: { limit: "10mb" } })`.
+     * Register your handlers before `run()`;
+     * after `run()`, dev-mode middleware, the `/mcp` route, and the default
+     * error handler are appended in that order.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
+     * locally and on self-hosted deployments.
+     */
+    readonly express: Express;
+    private customErrorMiddleware;
+    private mcpMiddlewareEntries;
+    private mcpMiddlewareApplied;
+    private middlewareEntriesCache;
+    private readonly registrations;
+    private claimedViews;
+    private viewMetaBuilders;
+    /**
+     * Maps a view resource's query-less path to its canonical registered URI
+     * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the
+     * underlying view no matter which version param the consumer sends, since
+     * the param is only a cache key, not part of the resource's identity.
+     */
+    private viewUriByPath;
+    private viteManifest;
+    private readonly serverInfo;
+    private readonly serverOptions?;
+    private oauthEnabled;
+    private resolveResourceMetadataUrl?;
+    private securitySchemesByTool;
+    constructor(serverInfo: Implementation, options?: ServerOptions, skybridgeOptions?: SkybridgeServerOptions<TAuthExtra>);
+    /**
+     * Register a resource, recorded so every per-request instance carries it.
+     * Signature owned by Skybridge (not inherited) so a typed wrapper can land
+     * in a minor without a type-level break.
+     */
+    registerResource(name: string, uri: string, config: ResourceMetadata & {
+        cacheHint?: CacheHint;
+    }, readCallback: ReadResourceCallback): RegisteredResource;
+    registerResource(name: string, template: ResourceTemplate, config: ResourceMetadata & {
+        cacheHint?: CacheHint;
+    }, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
+    /**
+     * Register a prompt, recorded so every per-request instance carries it.
+     * Signature owned by Skybridge (not inherited) so a typed wrapper can land
+     * in a minor without a type-level break.
+     */
+    registerPrompt<Args extends StandardSchemaWithJSON>(name: string, config: {
+        title?: string;
+        description?: string;
+        argsSchema?: Args;
+        icons?: Icon[];
+        _meta?: Record<string, unknown>;
+    }, cb: PromptCallback<Args>): RegisteredPrompt;
+    private recordInherited;
+    private skillRegistrar;
+    private setupSkills;
+    /**
+     * Register Express middleware on the underlying app. Mirrors `app.use` —
+     * pass handlers directly or a path-prefixed handler list. Register before
+     * {@link McpServer.run}; ordering matches Express.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work
+     * locally and on self-hosted deployments.
+     */
     use(...handlers: RequestHandler[]): this;
     use(path: string, ...handlers: RequestHandler[]): this;
-    run(): Promise<void>;
-    registerWidget<TName extends string, TInput extends ZodRawShapeCompat, TReturn extends {
-        content: CallToolResult["content"];
-    }>(name: TName, resourceConfig: McpServerOriginalResourceConfig, toolConfig: McpServerOriginalToolConfig & {
-        inputSchema?: TInput;
-        outputSchema?: ZodRawShapeCompat | AnySchema;
-    }, toolCallback: ToolHandler<TInput, TReturn>): AddTool<TTools, TName, TInput, ExtractStructuredContent<TReturn>, ExtractMeta<TReturn>>;
-    registerTool<TName extends string, InputArgs extends ZodRawShapeCompat, TReturn extends {
-        content: CallToolResult["content"];
-    }>(name: TName, config: ToolConfig<InputArgs>, cb: ToolHandler<InputArgs, TReturn>): AddTool<TTools, TName, InputArgs, ExtractStructuredContent<TReturn>, ExtractMeta<TReturn>>;
-    registerTool<InputArgs extends ZodRawShapeCompat>(name: string, config: ToolConfig<InputArgs>, cb: ToolHandler<InputArgs>): RegisteredTool;
-    private registerWidgetResource;
+    /**
+     * Register Express error-handling middleware to run after the built-in
+     * `/mcp` route (or your custom route). Use this to log or transform errors
+     * thrown by tool handlers before the default error handler responds.
+     *
+     * @example
+     * ```ts
+     * server.useOnError((err, _req, _res, next) => {
+     *   logger.error(err);
+     *   next(err);
+     * });
+     * ```
+     */
+    useOnError(...handlers: ErrorRequestHandler[]): this;
+    useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;
+    /** Register MCP protocol-level middleware (catch-all). */
+    mcpMiddleware(handler: McpMiddlewareFn<TAuthExtra>): this;
+    /** Register MCP protocol-level middleware for all requests (`extra` is `McpExtra`). */
+    mcpMiddleware(filter: "request", handler: (request: {
+        method: string;
+        params: Record<string, unknown>;
+    }, extra: McpExtra<TAuthExtra>, next: () => Promise<ServerResult>) => Promise<unknown> | unknown): this;
+    /** Register MCP protocol-level middleware for all notifications (`extra` is `undefined`). */
+    mcpMiddleware(filter: "notification", handler: (request: {
+        method: string;
+        params: Record<string, unknown>;
+    }, extra: undefined, next: () => Promise<undefined>) => Promise<unknown> | unknown): this;
+    /**
+     * Register MCP protocol-level middleware for an exact method.
+     * Narrows `params`, `extra`, and `next()` result based on the method string.
+     */
+    mcpMiddleware<M extends McpMethodString>(filter: M, handler: McpTypedMiddlewareFn<M, TAuthExtra>): this;
+    /**
+     * Register MCP protocol-level middleware for a wildcard pattern (e.g. `"tools/*"`).
+     * `next()` returns the union of result types for matching methods.
+     */
+    mcpMiddleware<W extends McpWildcard>(filter: W, handler: (request: {
+        method: string;
+        params: Record<string, unknown>;
+    }, extra: McpExtraFor<W, TAuthExtra>, next: () => Promise<McpResultFor<W>>) => Promise<unknown> | unknown): this;
+    /**
+     * Register MCP protocol-level middleware with a method filter.
+     * Filter can be an exact method (`"tools/call"`), wildcard (`"tools/*"`),
+     * category (`"request"` | `"notification"`), or an array of those.
+     */
+    mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn<TAuthExtra>): this;
+    private applyMcpMiddleware;
+    private instrumentHandlers;
+    /**
+     * Connect to an MCP transport (override of the SDK's `connect`). Use this
+     * when you're embedding Skybridge in a host that already manages its own
+     * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}
+     * which sets the transport up for you. Locks in any middleware registered
+     * via {@link McpServer.mcpMiddleware} — further calls to that method will
+     * throw afterwards.
+     */
+    connect(transport: Parameters<typeof McpServerBase.prototype.connect>[0]): Promise<void>;
+    /**
+     * Build a fresh server for one stateless HTTP request, as
+     * `createMcpHandler`'s factory contract requires: every registration is
+     * replayed onto the new instance so the SDK's handler closures belong to
+     * the instance whose protocol era it stamps. Sharing the singleton's
+     * handler maps instead would bind them to an instance that is never
+     * marked, pinning every request to the 2025 codec and letting concurrent
+     * callers overwrite each other's negotiated version.
+     */
+    createStatelessServerInstance(): SdkServer;
+    /**
+     * Apply an SDK registration to the singleton and remember it, so each
+     * per-request instance can be built with the same surface.
+     */
+    private record;
+    /** Records a raw request handler (used for methods the SDK has no sugar for). */
+    private recordRequestHandler;
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, applies any custom Express middleware registered
+     * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in
+     * any MCP middleware registered via {@link McpServer.mcpMiddleware}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Vercel (`VERCEL === "1"`), returns the Express app directly so the
+     * serverless function entry can call it as a `(req, res)` handler. On
+     * Node, returns `undefined` once listening.
+     */
+    run(): Promise<{
+        fetch: (...args: unknown[]) => unknown;
+    } | Express | undefined>;
+    private enforceOneToolPerView;
+    private resolveViewRequestContext;
+    private registerViewResources;
+    private registerViewResource;
+    private serveLegacyAppsSdkUrl;
+    private decorateToolHandler;
+    private computeViewVersionParam;
+    private lookupViewFile;
     private lookupDistFile;
-    private lookupDistFileWithIndexFallback;
+    /**
+     * Inject the Vite manifest as a value rather than letting `readManifest()`
+     * load it from disk. Required for runtimes without a usable filesystem
+     * (Cloudflare Workers, etc.) — the user's `skybridge build` emits the
+     * manifest as a JS module which the entry imports and passes here.
+     */
+    setViteManifest(manifest: Record<string, {
+        file: string;
+    }>): this;
     private readManifest;
+    /**
+     * Register a tool. Pass a `config` describing the tool (name, schemas,
+     * optional {@link ViewConfig}, optional {@link ToolMeta}) and a handler that
+     * returns the tool's result.
+     *
+     * Chain calls to build up a server: each call returns a new `McpServer`
+     * type that captures the tool's input/output/`_meta` shape so the
+     * resulting `typeof server` can drive {@link generateHelpers}.
+     *
+     * The handler's return shape determines the output types: the
+     * `structuredContent` field becomes the tool's typed output, and `_meta`
+     * becomes its `responseMetadata`. The `content` field is normalized through
+     * {@link normalizeContent}.
+     *
+     * @example
+     * ```ts
+     * server.registerTool({
+     *   name: "search",
+     *   inputSchema: { query: z.string() },
+     *   outputSchema: { results: z.array(z.string()) },
+     *   view: { component: "search" },
+     * }, async ({ query }) => ({
+     *   content: `Found results for ${query}`,
+     *   structuredContent: { results: [...] },
+     * }));
+     * ```
+     *
+     * @see https://docs.skybridge.tech/api-reference/register-tool
+     */
+    registerTool<TName extends string, InputArgs extends RawInputShape, TReturn extends {
+        content?: HandlerContent;
+    }>(config: ToolConfig<InputArgs> & {
+        name: TName;
+    }, cb: ToolHandler<InputArgs, TReturn, TAuthExtra>): AddTool<TTools, TName, InputArgs, ExtractStructuredContent<TReturn>, ExtractMeta<TReturn>, TAuthExtra>;
+    registerTool<InputArgs extends RawInputShape>(config: ToolConfig<InputArgs>, cb: ToolHandler<InputArgs, {
+        content?: HandlerContent;
+    }, TAuthExtra>): this;
 }
 export {};