skybridge 0.0.0-dev.dd32507 → 0.0.0-dev.dd47ea8

package/dist/server/server.d.ts

@@ -4,8 +4,10 @@ import { McpServer as McpServerBase } from "@modelcontextprotocol/sdk/server/mcp
 import type { AnySchema, SchemaOutput, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
 import type { ContentBlock, Implementation, RequestMeta, ServerNotification, ServerRequest, ServerResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
-import { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import express, { type ErrorRequestHandler, type Express, type RequestHandler } from "express";
+import type { OAuthConfig } from "./auth/index.js";
 import type { McpExtra, McpExtraFor, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard } from "./middleware.js";
+import { type SkillsManifest } from "./skills.js";
 /**
  * Type marker for a registered tool — carries its input, output, and response
  * metadata shapes so views can infer types from `typeof server`.
@@ -18,7 +20,11 @@ export type ToolDef<TInput = unknown, TOutput = unknown, TResponseMetadata = unk
     output: TOutput;
     responseMetadata: TResponseMetadata;
 };
-/** Which host runtime a view targets — `"apps-sdk"` (ChatGPT) or `"mcp-app"` (MCP Apps spec). */
+/**
+ * @deprecated Views now always emit a single ext-apps resource; host targeting
+ * no longer applies. Retained for backwards compatibility; will be removed in a
+ * future major.
+ */
 export type ViewHostType = "apps-sdk" | "mcp-app";
 /**
  * Content Security Policy origins attached to a view's resource. Each list is
@@ -44,8 +50,16 @@ export interface ViewCsp {
  */
 export interface ViewNameRegistry {
 }
+/**
+ * Resolve view component names from a registry: the union of its keys, or
+ * `string` when the registry is empty. The empty case happens before
+ * `.skybridge/views.d.ts` is generated; falling back to `string` keeps valid
+ * view names from erroring on a fresh checkout, and narrowing kicks in once
+ * the generated file augments the registry.
+ */
+export type ViewNameFor<Registry> = [keyof Registry & string] extends [never] ? string : keyof Registry & string;
 /** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */
-export type ViewName = keyof ViewNameRegistry & string;
+export type ViewName = ViewNameFor<ViewNameRegistry>;
 /**
  * Pass under `view` in a tool's `registerTool` config to render the tool's
  * result through a Skybridge view instead of a plain text response.
@@ -55,11 +69,14 @@ export interface ViewConfig {
     component: ViewName;
     /** Human-readable label the host may show alongside the view. */
     description?: string;
-    /** Restrict where the view is rendered. Defaults to all known hosts. */
+    /**
+     * @deprecated No-op. Every view emits a single ext-apps resource regardless
+     * of this value. Will be removed in a future major.
+     */
     hosts?: ViewHostType[];
-    /** Apps SDK only: request a visible border around the widget. */
+    /** Request a visible border around the view (forwarded as `ui.prefersBorder`). */
     prefersBorder?: boolean;
-    /** Apps SDK only: override the iframe's served domain (advanced). */
+    /** Override the iframe's served domain (advanced; forwarded as `ui.domain`). */
     domain?: string;
     /** Per-view CSP overrides — see {@link ViewCsp}. */
     csp?: ViewCsp;
@@ -72,6 +89,37 @@ export type SecurityScheme = {
     type: "oauth2";
     scopes?: string[];
 };
+/**
+ * Declarative per-tool auth. Enforced when the server has an `oauth` provider:
+ * anonymous or under-scoped calls are rejected before the handler runs. Omit
+ * `auth` entirely for the secure default (sign-in required, no specific scope).
+ */
+export type ToolAuth = {
+    /**
+     * When `true`, the tool is callable signed out; the token is still used when
+     * one is present. Omit (or `false`) to require sign-in.
+     */
+    allowsAnonymous?: boolean;
+    /** OAuth scopes the caller's token must carry to invoke the tool. */
+    scopes?: string[];
+};
+/**
+ * Options forwarded to the built-in `express.json()` body parser. Derived
+ * from Express's own types so the public API doesn't depend on `body-parser`.
+ */
+export type JsonOptions = NonNullable<Parameters<typeof express.json>[0]>;
+/** Skybridge-specific server options, passed as the third `McpServer` constructor argument. */
+export interface SkybridgeServerOptions {
+    /** Options for the built-in `express.json()` middleware, e.g. `{ limit: "10mb" }`. */
+    json?: JsonOptions;
+    /** Resource-server OAuth config. When set, mounts well-known metadata and bearer auth on `/mcp`. */
+    oauth?: OAuthConfig;
+    /**
+     * @experimental Serve Agent Skills from `src/skills` over MCP (SEP-2640).
+     * API may change.
+     */
+    skills?: boolean;
+}
 /**
  * Well-known keys recognized by host runtimes when set on a tool's `_meta`.
  * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.
@@ -133,7 +181,7 @@ type ExtractMeta<T> = [Extract<T, {
 type AddTool<TTools, TName extends string, TInput extends ZodRawShapeCompat, TOutput, TResponseMetadata = unknown> = McpServer<TTools & {
     [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;
 }>;
-interface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {
+interface ToolConfigBase<TInput extends ZodRawShapeCompat | AnySchema> {
     name: string;
     title?: string;
     description?: string;
@@ -141,6 +189,17 @@ interface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {
     outputSchema?: ZodRawShapeCompat | AnySchema;
     annotations?: ToolAnnotations;
     view?: ViewConfig;
+    _meta?: ToolMeta;
+}
+/**
+ * The auth face of a tool config: either the high-level `auth` shorthand or the
+ * low-level `securitySchemes` escape hatch, never both.
+ */
+type ToolAuthConfig = {
+    auth?: ToolAuth;
+    securitySchemes?: never;
+} | {
+    auth?: never;
     /**
      * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).
      * Lets clients label tools that require sign-in before calling, and pass
@@ -149,8 +208,8 @@ interface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {
      * enhanced behavior to authenticated ones.
      */
     securitySchemes?: SecurityScheme[];
-    _meta?: ToolMeta;
-}
+};
+type ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> = ToolConfigBase<TInput> & ToolAuthConfig;
 /**
  * Optional client-supplied hints attached to `params._meta` on every tool call
  * by the Apps SDK host. Hints only: never use for authorization, and tolerate
@@ -208,6 +267,7 @@ declare const McpServerBaseOmitted: new (...args: ConstructorParameters<typeof M
 export declare function __setBuildManifest(manifest: Record<string, {
     file: string;
 }>): void;
+export declare function __setSkillsManifest(manifest: SkillsManifest): void;
 export declare class McpServer<TTools extends Record<string, ToolDef> = Record<never, ToolDef>> extends McpServerBaseOmitted {
     readonly $types: McpServerTypes<TTools>;
     /**
@@ -215,7 +275,9 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
      * custom routes, middleware, or settings — e.g.
      * `server.express.get("/health", ...)`.
      *
-     * `express.json()` is pre-applied. Register your handlers before `run()`;
+     * `express.json()` is pre-applied — tune it via the constructor's third
+     * argument, e.g. `new McpServer(info, {}, { json: { limit: "10mb" } })`.
+     * Register your handlers before `run()`;
      * after `run()`, dev-mode middleware, the `/mcp` route, and the default
      * error handler are appended in that order.
      *
@@ -228,10 +290,21 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
     private mcpMiddlewareApplied;
     private claimedViews;
     private viewMetaBuilders;
+    /**
+     * Maps a view resource's query-less path to its canonical registered URI
+     * (the one carrying the `?v=` cache key). Lets `resources/read` resolve the
+     * underlying view no matter which version param the consumer sends, since
+     * the param is only a cache key, not part of the resource's identity.
+     */
+    private viewUriByPath;
     private viteManifest;
     private readonly serverInfo;
     private readonly serverOptions?;
-    constructor(serverInfo: Implementation, options?: ServerOptions);
+    private oauthEnabled;
+    private resolveResourceMetadataUrl?;
+    private securitySchemesByTool;
+    constructor(serverInfo: Implementation, options?: ServerOptions, skybridgeOptions?: SkybridgeServerOptions);
+    private setupSkills;
     /**
      * Register Express middleware on the underlying app. Mirrors `app.use` —
      * pass handlers directly or a path-prefixed handler list. Register before
@@ -328,7 +401,8 @@ export declare class McpServer<TTools extends Record<string, ToolDef> = Record<n
     private resolveViewRequestContext;
     private registerViewResources;
     private registerViewResource;
-    private wrapHandler;
+    private serveLegacyAppsSdkUrl;
+    private decorateToolHandler;
     private computeViewVersionParam;
     private lookupViewFile;
     private lookupDistFile;