skybridge 0.0.0-dev.ddf79c7 → 0.0.0-dev.ddfb4e5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (256) hide show
  1. package/README.md +7 -7
  2. package/dist/cli/build-helpers.d.ts +1 -1
  3. package/dist/cli/build-helpers.js +4 -4
  4. package/dist/cli/build-helpers.js.map +1 -1
  5. package/dist/cli/build-helpers.test.js +2 -2
  6. package/dist/cli/build-helpers.test.js.map +1 -1
  7. package/dist/cli/build-steps.js +1 -1
  8. package/dist/cli/build-steps.js.map +1 -1
  9. package/dist/cli/build-steps.test.js +3 -3
  10. package/dist/cli/build-steps.test.js.map +1 -1
  11. package/dist/cli/detect-port.js +0 -1
  12. package/dist/cli/detect-port.js.map +1 -1
  13. package/dist/cli/telemetry.js +2 -0
  14. package/dist/cli/telemetry.js.map +1 -1
  15. package/dist/cli/use-execute-steps.d.ts +1 -1
  16. package/dist/cli/use-nodemon.js +11 -3
  17. package/dist/cli/use-nodemon.js.map +1 -1
  18. package/dist/cli/use-typescript-check.js +1 -1
  19. package/dist/cli/use-typescript-check.js.map +1 -1
  20. package/dist/commands/dev.js +1 -1
  21. package/dist/commands/dev.js.map +1 -1
  22. package/dist/commands/start.js +2 -2
  23. package/dist/commands/start.js.map +1 -1
  24. package/dist/server/app.d.ts +194 -0
  25. package/dist/server/app.js +266 -0
  26. package/dist/server/app.js.map +1 -0
  27. package/dist/server/app.test.js +97 -0
  28. package/dist/server/app.test.js.map +1 -0
  29. package/dist/server/auth/discovery.d.ts +2 -1
  30. package/dist/server/auth/discovery.js +2 -2
  31. package/dist/server/auth/discovery.js.map +1 -1
  32. package/dist/server/auth/index.d.ts +21 -17
  33. package/dist/server/auth/index.js.map +1 -1
  34. package/dist/server/auth/providers/auth0.d.ts +2 -2
  35. package/dist/server/auth/providers/auth0.js +13 -8
  36. package/dist/server/auth/providers/auth0.js.map +1 -1
  37. package/dist/server/auth/providers/auth0.test.js +1 -1
  38. package/dist/server/auth/providers/auth0.test.js.map +1 -1
  39. package/dist/server/auth/providers/authplane.d.ts +2 -2
  40. package/dist/server/auth/providers/authplane.js.map +1 -1
  41. package/dist/server/auth/providers/authplane.test.js +10 -7
  42. package/dist/server/auth/providers/authplane.test.js.map +1 -1
  43. package/dist/server/auth/providers/clerk.d.ts +2 -2
  44. package/dist/server/auth/providers/clerk.js.map +1 -1
  45. package/dist/server/auth/providers/clerk.test.js +1 -1
  46. package/dist/server/auth/providers/clerk.test.js.map +1 -1
  47. package/dist/server/auth/providers/custom.d.ts +4 -4
  48. package/dist/server/auth/providers/custom.js +5 -2
  49. package/dist/server/auth/providers/custom.js.map +1 -1
  50. package/dist/server/auth/providers/custom.test.js +13 -10
  51. package/dist/server/auth/providers/custom.test.js.map +1 -1
  52. package/dist/server/auth/providers/descope.d.ts +2 -2
  53. package/dist/server/auth/providers/descope.js.map +1 -1
  54. package/dist/server/auth/providers/descope.test.js +3 -3
  55. package/dist/server/auth/providers/descope.test.js.map +1 -1
  56. package/dist/server/auth/providers/stytch.d.ts +2 -2
  57. package/dist/server/auth/providers/stytch.js.map +1 -1
  58. package/dist/server/auth/providers/workos.d.ts +2 -2
  59. package/dist/server/auth/providers/workos.js.map +1 -1
  60. package/dist/server/auth/setup.d.ts +1 -1
  61. package/dist/server/auth/setup.js +3 -4
  62. package/dist/server/auth/setup.js.map +1 -1
  63. package/dist/server/auth/setup.test.js +83 -77
  64. package/dist/server/auth/setup.test.js.map +1 -1
  65. package/dist/server/auth/verify.js +2 -2
  66. package/dist/server/auth/verify.js.map +1 -1
  67. package/dist/server/auth-extra.test-d.js +97 -49
  68. package/dist/server/auth-extra.test-d.js.map +1 -1
  69. package/dist/server/auth.d.ts +7 -8
  70. package/dist/server/auth.js +4 -5
  71. package/dist/server/auth.js.map +1 -1
  72. package/dist/server/build-manifest.test.js +7 -6
  73. package/dist/server/build-manifest.test.js.map +1 -1
  74. package/dist/server/content-helpers.d.ts +1 -1
  75. package/dist/server/content-helpers.js.map +1 -1
  76. package/dist/server/express.d.ts +23 -3
  77. package/dist/server/express.js +38 -32
  78. package/dist/server/express.js.map +1 -1
  79. package/dist/server/express.test.js +220 -103
  80. package/dist/server/express.test.js.map +1 -1
  81. package/dist/server/file-ref.d.ts +1 -1
  82. package/dist/server/file-ref.js +1 -1
  83. package/dist/server/file-ref.js.map +1 -1
  84. package/dist/server/index.d.ts +6 -3
  85. package/dist/server/index.js +3 -1
  86. package/dist/server/index.js.map +1 -1
  87. package/dist/server/mcp-errors.test.js +41 -0
  88. package/dist/server/mcp-errors.test.js.map +1 -0
  89. package/dist/server/middleware.d.ts +6 -6
  90. package/dist/server/middleware.js.map +1 -1
  91. package/dist/server/middleware.test-d.js +1 -1
  92. package/dist/server/middleware.test-d.js.map +1 -1
  93. package/dist/server/middleware.test.js +222 -150
  94. package/dist/server/middleware.test.js.map +1 -1
  95. package/dist/server/register-tool.test.js +27 -0
  96. package/dist/server/register-tool.test.js.map +1 -0
  97. package/dist/server/server.d.ts +74 -119
  98. package/dist/server/server.js +101 -297
  99. package/dist/server/server.js.map +1 -1
  100. package/dist/server/skills-integration.test.js +19 -12
  101. package/dist/server/skills-integration.test.js.map +1 -1
  102. package/dist/server/skills.d.ts +3 -5
  103. package/dist/server/skills.js +17 -24
  104. package/dist/server/skills.js.map +1 -1
  105. package/dist/server/skills.test.js +8 -12
  106. package/dist/server/skills.test.js.map +1 -1
  107. package/dist/server/templateHelper.d.ts +0 -3
  108. package/dist/server/templateHelper.js.map +1 -1
  109. package/dist/server/templates.generated.js +4 -8
  110. package/dist/server/templates.generated.js.map +1 -1
  111. package/dist/server/tool-extra.test.js +88 -0
  112. package/dist/server/tool-extra.test.js.map +1 -0
  113. package/dist/server/view-resource-resolution.test.js +18 -13
  114. package/dist/server/view-resource-resolution.test.js.map +1 -1
  115. package/dist/test/utils.d.ts +9 -11
  116. package/dist/test/utils.js +220 -201
  117. package/dist/test/utils.js.map +1 -1
  118. package/dist/test/view.test.js +25 -37
  119. package/dist/test/view.test.js.map +1 -1
  120. package/dist/views/index.d.ts +10 -0
  121. package/dist/views/index.js +3 -0
  122. package/dist/views/index.js.map +1 -0
  123. package/dist/{web/plugin → views}/scan-views.js +1 -1
  124. package/dist/views/scan-views.js.map +1 -0
  125. package/dist/views/scan-views.test.js.map +1 -0
  126. package/dist/views/validate-view.d.ts +1 -0
  127. package/dist/{web/plugin → views}/validate-view.js +2 -2
  128. package/dist/views/validate-view.js.map +1 -0
  129. package/dist/views/validate-view.test.js.map +1 -0
  130. package/dist/web/bridges/adaptor.test.js +1 -1
  131. package/dist/web/bridges/adaptor.test.js.map +1 -1
  132. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.d.ts +1 -1
  133. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.js +1 -1
  134. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.js.map +1 -1
  135. package/dist/web/bridges/get-adaptor.test.js +2 -2
  136. package/dist/web/bridges/get-adaptor.test.js.map +1 -1
  137. package/dist/web/bridges/mcp-app/bridge.js +1 -1
  138. package/dist/web/bridges/mcp-app/bridge.js.map +1 -1
  139. package/dist/web/bridges/mcp-app/bridge.test.js +2 -2
  140. package/dist/web/bridges/mcp-app/bridge.test.js.map +1 -1
  141. package/dist/web/bridges/mcp-app/use-mcp-app-context.d.ts +1 -1
  142. package/dist/web/bridges/mcp-app/use-mcp-app-context.js +1 -1
  143. package/dist/web/bridges/mcp-app/use-mcp-app-context.js.map +1 -1
  144. package/dist/web/bridges/mcp-app/use-mcp-app-context.test.js +1 -1
  145. package/dist/web/bridges/mcp-app/use-mcp-app-context.test.js.map +1 -1
  146. package/dist/web/bridges/mcp-app/view-tools.test.js +1 -1
  147. package/dist/web/bridges/mcp-app/view-tools.test.js.map +1 -1
  148. package/dist/web/bridges/types.d.ts +17 -12
  149. package/dist/web/bridges/types.js.map +1 -1
  150. package/dist/web/create-store.test.js +2 -2
  151. package/dist/web/create-store.test.js.map +1 -1
  152. package/dist/web/data-llm.test.js +2 -2
  153. package/dist/web/data-llm.test.js.map +1 -1
  154. package/dist/web/generate-helpers.d.ts +22 -18
  155. package/dist/web/generate-helpers.js +19 -15
  156. package/dist/web/generate-helpers.js.map +1 -1
  157. package/dist/web/generate-helpers.test-d.js +3 -3
  158. package/dist/web/generate-helpers.test-d.js.map +1 -1
  159. package/dist/web/generate-helpers.test.js +2 -2
  160. package/dist/web/generate-helpers.test.js.map +1 -1
  161. package/dist/web/hooks/index.d.ts +2 -2
  162. package/dist/web/hooks/index.js +2 -2
  163. package/dist/web/hooks/index.js.map +1 -1
  164. package/dist/web/hooks/use-call-tool.test.js +2 -2
  165. package/dist/web/hooks/use-call-tool.test.js.map +1 -1
  166. package/dist/web/hooks/use-display-mode.d.ts +1 -1
  167. package/dist/web/hooks/use-display-mode.js +1 -1
  168. package/dist/web/hooks/use-display-mode.js.map +1 -1
  169. package/dist/web/hooks/use-display-mode.test.js +1 -1
  170. package/dist/web/hooks/use-display-mode.test.js.map +1 -1
  171. package/dist/web/hooks/use-download.d.ts +1 -3
  172. package/dist/web/hooks/use-download.js +1 -2
  173. package/dist/web/hooks/use-download.js.map +1 -1
  174. package/dist/web/hooks/use-download.test.js +7 -7
  175. package/dist/web/hooks/use-download.test.js.map +1 -1
  176. package/dist/web/hooks/use-files.test.js +1 -1
  177. package/dist/web/hooks/use-files.test.js.map +1 -1
  178. package/dist/web/hooks/{use-host-info.d.ts → use-host.d.ts} +2 -2
  179. package/dist/web/hooks/{use-host-info.js → use-host.js} +3 -3
  180. package/dist/web/hooks/use-host.js.map +1 -0
  181. package/dist/web/hooks/{use-host-info.test.js → use-host.test.js} +7 -7
  182. package/dist/web/hooks/use-host.test.js.map +1 -0
  183. package/dist/web/hooks/use-open-external.test.js +2 -2
  184. package/dist/web/hooks/use-open-external.test.js.map +1 -1
  185. package/dist/web/hooks/use-register-view-tool.d.ts +2 -3
  186. package/dist/web/hooks/use-register-view-tool.js.map +1 -1
  187. package/dist/web/hooks/use-request-close.test.js +1 -1
  188. package/dist/web/hooks/use-request-close.test.js.map +1 -1
  189. package/dist/web/hooks/use-request-modal.test.js +1 -1
  190. package/dist/web/hooks/use-request-modal.test.js.map +1 -1
  191. package/dist/web/hooks/use-request-size.d.ts +1 -1
  192. package/dist/web/hooks/use-request-size.js +1 -1
  193. package/dist/web/hooks/use-request-size.js.map +1 -1
  194. package/dist/web/hooks/use-request-size.test.js +1 -1
  195. package/dist/web/hooks/use-request-size.test.js.map +1 -1
  196. package/dist/web/hooks/use-set-open-in-app-url.test.js +2 -8
  197. package/dist/web/hooks/use-set-open-in-app-url.test.js.map +1 -1
  198. package/dist/web/hooks/use-tool-info.d.ts +1 -20
  199. package/dist/web/hooks/use-tool-info.js +0 -1
  200. package/dist/web/hooks/use-tool-info.js.map +1 -1
  201. package/dist/web/hooks/use-tool-info.test-d.js +0 -5
  202. package/dist/web/hooks/use-tool-info.test-d.js.map +1 -1
  203. package/dist/web/hooks/use-tool-info.test.js +2 -7
  204. package/dist/web/hooks/use-tool-info.test.js.map +1 -1
  205. package/dist/web/hooks/use-user.d.ts +3 -2
  206. package/dist/web/hooks/use-user.js +4 -3
  207. package/dist/web/hooks/use-user.js.map +1 -1
  208. package/dist/web/hooks/use-user.test.js +5 -3
  209. package/dist/web/hooks/use-user.test.js.map +1 -1
  210. package/dist/web/hooks/use-view-state.test.js +2 -2
  211. package/dist/web/hooks/use-view-state.test.js.map +1 -1
  212. package/dist/web/hooks/use-viewport.d.ts +20 -0
  213. package/dist/web/hooks/use-viewport.js +21 -0
  214. package/dist/web/hooks/use-viewport.js.map +1 -0
  215. package/dist/web/hooks/{use-layout.test.js → use-viewport.test.js} +12 -32
  216. package/dist/web/hooks/use-viewport.test.js.map +1 -0
  217. package/dist/web/mount-view.d.ts +3 -2
  218. package/dist/web/mount-view.js +5 -8
  219. package/dist/web/mount-view.js.map +1 -1
  220. package/package.json +14 -11
  221. package/dist/web/hooks/use-host-info.js.map +0 -1
  222. package/dist/web/hooks/use-host-info.test.js.map +0 -1
  223. package/dist/web/hooks/use-layout.d.ts +0 -24
  224. package/dist/web/hooks/use-layout.js +0 -25
  225. package/dist/web/hooks/use-layout.js.map +0 -1
  226. package/dist/web/hooks/use-layout.test.js.map +0 -1
  227. package/dist/web/plugin/data-llm.test.js +0 -81
  228. package/dist/web/plugin/data-llm.test.js.map +0 -1
  229. package/dist/web/plugin/plugin-build.test.js +0 -54
  230. package/dist/web/plugin/plugin-build.test.js.map +0 -1
  231. package/dist/web/plugin/plugin.d.ts +0 -39
  232. package/dist/web/plugin/plugin.js +0 -200
  233. package/dist/web/plugin/plugin.js.map +0 -1
  234. package/dist/web/plugin/plugin.test.js +0 -61
  235. package/dist/web/plugin/plugin.test.js.map +0 -1
  236. package/dist/web/plugin/scan-views.js.map +0 -1
  237. package/dist/web/plugin/scan-views.test.js.map +0 -1
  238. package/dist/web/plugin/transform-data-llm.d.ts +0 -12
  239. package/dist/web/plugin/transform-data-llm.js +0 -96
  240. package/dist/web/plugin/transform-data-llm.js.map +0 -1
  241. package/dist/web/plugin/transform-data-llm.test.js +0 -81
  242. package/dist/web/plugin/transform-data-llm.test.js.map +0 -1
  243. package/dist/web/plugin/validate-view.d.ts +0 -1
  244. package/dist/web/plugin/validate-view.js.map +0 -1
  245. package/dist/web/plugin/validate-view.test.js.map +0 -1
  246. /package/dist/{web/hooks/use-host-info.test.d.ts → server/app.test.d.ts} +0 -0
  247. /package/dist/{web/hooks/use-layout.test.d.ts → server/mcp-errors.test.d.ts} +0 -0
  248. /package/dist/{web/plugin/data-llm.test.d.ts → server/register-tool.test.d.ts} +0 -0
  249. /package/dist/{web/plugin/plugin-build.test.d.ts → server/tool-extra.test.d.ts} +0 -0
  250. /package/dist/{web/plugin → views}/scan-views.d.ts +0 -0
  251. /package/dist/{web/plugin → views}/scan-views.test.d.ts +0 -0
  252. /package/dist/{web/plugin → views}/scan-views.test.js +0 -0
  253. /package/dist/{web/plugin → views}/validate-view.test.d.ts +0 -0
  254. /package/dist/{web/plugin → views}/validate-view.test.js +0 -0
  255. /package/dist/web/{plugin/plugin.test.d.ts → hooks/use-host.test.d.ts} +0 -0
  256. /package/dist/web/{plugin/transform-data-llm.test.d.ts → hooks/use-viewport.test.d.ts} +0 -0
@@ -1,28 +1,15 @@
1
1
  import crypto from "node:crypto";
2
2
  import { readFileSync } from "node:fs";
3
- import http from "node:http";
4
3
  import path from "node:path";
5
- import { Server as SdkServer, } from "@modelcontextprotocol/sdk/server/index.js";
6
- import { McpServer as McpServerBase } from "@modelcontextprotocol/sdk/server/mcp.js";
7
- import { mergeWith, union } from "es-toolkit";
8
- import express, {} from "express";
4
+ import { McpServer as McpServerBase, } from "@modelcontextprotocol/server";
9
5
  import { warnOnLargeToolOutput } from "../context-warnings.js";
10
6
  import { authToSecuritySchemes, evaluateSecuritySchemes, inBandChallengeResult, } from "./auth/security-schemes.js";
11
- import { setupOAuth } from "./auth/setup.js";
12
- import { createApp } from "./express.js";
13
7
  import { hostFromUserAgent } from "./host.js";
14
- import { createMiddlewareEntry } from "./metric.js";
15
- import { buildMiddlewareChain, captureToolError, getHandlerMaps, } from "./middleware.js";
8
+ import { captureToolError } from "./middleware.js";
16
9
  import { resolveServerOrigin } from "./requestOrigin.js";
17
10
  import { discoverSkills, registerSkills, SKILLS_EXTENSION_KEY, } from "./skills.js";
18
11
  import { templateHelper } from "./templateHelper.js";
19
- const mergeWithUnion = (target, source) => {
20
- return mergeWith(target, source, (targetVal, sourceVal) => {
21
- if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {
22
- return union(targetVal, sourceVal);
23
- }
24
- });
25
- };
12
+ const unionOf = (base, extra) => extra ? [...new Set([...base, ...extra])] : base;
26
13
  const SKILLS_DIR = "src/skills";
27
14
  /**
28
15
  * Normalize an `x-forwarded-prefix` value into a leading-slash, no-trailing-slash
@@ -65,35 +52,6 @@ export function normalizeContent(content) {
65
52
  return [content];
66
53
  }
67
54
  const McpServerBaseOmitted = McpServerBase;
68
- /**
69
- * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool
70
- * registry, view resources, an embedded Express app, and protocol-level
71
- * middleware. Construct it with the same `Implementation` info you would pass
72
- * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,
73
- * then call {@link McpServer.run} to start the HTTP server.
74
- *
75
- * The `TTools` generic accumulates each registered tool's input/output/meta
76
- * shape, so `typeof server` carries enough information for view-side helpers
77
- * like {@link generateHelpers} to produce fully-typed hooks.
78
- *
79
- * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`
80
- * chaining; you almost never set this manually.
81
- *
82
- * @example
83
- * ```ts
84
- * const server = new McpServer({ name: "my-app", version: "1.0.0" }, {})
85
- * .registerTool({
86
- * name: "search",
87
- * inputSchema: { query: z.string() },
88
- * view: { component: "search" },
89
- * }, async ({ query }) => ({ content: `Results for ${query}` }));
90
- *
91
- * await server.run();
92
- * export type AppType = typeof server;
93
- * ```
94
- *
95
- * @see https://docs.skybridge.tech/api-reference/mcp-server
96
- */
97
55
  // Side channel populated by `dist/__entry.js` before user code is imported.
98
56
  // Set at module scope rather than passed through the constructor because the
99
57
  // wrapper has the manifest before the user's `new McpServer(...)` runs, and
@@ -111,8 +69,12 @@ export function __setBuildManifest(manifest) {
111
69
  pendingBuildManifest = manifest;
112
70
  }
113
71
  let pendingSkillsManifest = null;
72
+ let cachedDiskManifest = null;
73
+ let discoveredSkills = null;
74
+ let warnedOnMissingSkills = false;
114
75
  export function __setSkillsManifest(manifest) {
115
76
  pendingSkillsManifest = manifest;
77
+ discoveredSkills = null;
116
78
  }
117
79
  // Pure and `this`-free so it can run inside the `super(...)` call, before `this`
118
80
  // exists — the capability must be present for the `initialize` response.
@@ -131,45 +93,37 @@ function withSkillsCapability(options, skybridgeOptions) {
131
93
  },
132
94
  };
133
95
  }
134
- // Collapses registerTool's two overloads into a single { config, cb } shape.
135
- // registerTool("greet", { description }, handler)
136
- // -> { config: { name: "greet", description }, cb: handler }
137
- // registerTool({ name: "greet", description }, handler)
138
- // -> { config: { name: "greet", description }, cb: handler }
139
- function normalizeRegisterToolArgs(args) {
140
- if (typeof args[0] === "string") {
141
- return {
142
- config: {
143
- name: args[0],
144
- ...args[1],
145
- },
146
- cb: args[2],
147
- };
148
- }
149
- return {
150
- config: args[0],
151
- cb: args[1],
152
- };
153
- }
96
+ /**
97
+ * Typed registration sugar over the MCP SDK's `McpServer`: a tool registry
98
+ * that carries input/output/meta shapes, view resources, per-tool security
99
+ * schemes, and prompt/resource registration. A {@link Skybridge} app builds
100
+ * one of these per request and hands it to your `handler`; chain
101
+ * {@link McpServer.registerTool} calls on it and return the result.
102
+ *
103
+ * The `TTools` generic accumulates each registered tool's input/output/meta
104
+ * shape, so `typeof app` carries enough information for view-side helpers
105
+ * like {@link generateHelpers} to produce fully-typed hooks.
106
+ *
107
+ * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`
108
+ * chaining; you almost never set this manually.
109
+ *
110
+ * @example
111
+ * ```ts
112
+ * export const app = new Skybridge({
113
+ * name: "my-app",
114
+ * version: "1.0.0",
115
+ * handler: (server) =>
116
+ * server.registerTool({
117
+ * name: "search",
118
+ * inputSchema: { query: z.string() },
119
+ * view: { component: "search" },
120
+ * }, async ({ query }) => ({ content: `Results for ${query}` })),
121
+ * });
122
+ * ```
123
+ *
124
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
125
+ */
154
126
  export class McpServer extends McpServerBaseOmitted {
155
- /**
156
- * The underlying Express app. Use this to extend the HTTP server with
157
- * custom routes, middleware, or settings — e.g.
158
- * `server.express.get("/health", ...)`.
159
- *
160
- * `express.json()` is pre-applied — tune it via the constructor's third
161
- * argument, e.g. `new McpServer(info, {}, { json: { limit: "10mb" } })`.
162
- * Register your handlers before `run()`;
163
- * after `run()`, dev-mode middleware, the `/mcp` route, and the default
164
- * error handler are appended in that order.
165
- *
166
- * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
167
- * locally and on self-hosted deployments.
168
- */
169
- express;
170
- customErrorMiddleware = [];
171
- mcpMiddlewareEntries = [];
172
- mcpMiddlewareApplied = false;
173
127
  claimedViews = new Map();
174
128
  viewMetaBuilders = new Map();
175
129
  /**
@@ -180,82 +134,64 @@ export class McpServer extends McpServerBaseOmitted {
180
134
  */
181
135
  viewUriByPath = new Map();
182
136
  viteManifest = null;
183
- serverInfo;
184
- serverOptions;
185
137
  oauthEnabled = false;
186
138
  resolveResourceMetadataUrl;
187
- securitySchemesByTool = new Map();
139
+ toolSecuritySchemes = new Map();
140
+ userMiddlewareEntries = [];
188
141
  constructor(serverInfo, options, skybridgeOptions) {
189
- const mergedOptions = withSkillsCapability(options, skybridgeOptions);
190
- super(serverInfo, mergedOptions);
191
- this.serverInfo = serverInfo;
192
- this.serverOptions = mergedOptions;
193
- this.express = express();
194
- this.express.use(express.json(skybridgeOptions?.json));
195
- if (skybridgeOptions?.oauth) {
196
- this.oauthEnabled = true;
197
- this.resolveResourceMetadataUrl = setupOAuth(this.express, skybridgeOptions.oauth, this.securitySchemesByTool);
198
- }
142
+ super(serverInfo, withSkillsCapability(options, skybridgeOptions));
143
+ this.oauthEnabled = Boolean(skybridgeOptions?.oauth);
199
144
  // Pick up the manifest if `dist/__entry.js` primed it before importing
200
- // user code. Consume-once: clear after the first construction so a
201
- // subsequent test that doesn't prime can't inherit stale state.
202
- // Explicit `setViteManifest` calls still win because they happen after
203
- // construction.
145
+ // user code. Explicit `setViteManifest` calls still win because they
146
+ // happen after construction.
204
147
  if (pendingBuildManifest) {
205
148
  this.setViteManifest(pendingBuildManifest);
206
- pendingBuildManifest = null;
207
149
  }
208
150
  this.setupSkills(Boolean(skybridgeOptions?.skills));
209
151
  }
152
+ /**
153
+ * The per-tool security schemes collected during registration, keyed by tool
154
+ * name. Read by the OAuth layer to decide whether anonymous requests are
155
+ * allowed and which schemes gate a given `tools/call`.
156
+ *
157
+ * @internal
158
+ */
159
+ get securitySchemesByTool() {
160
+ return this.toolSecuritySchemes;
161
+ }
162
+ /**
163
+ * Inject the resolver the app uses to build the protected-resource metadata
164
+ * URL, so tool handlers can emit in-band auth challenges.
165
+ *
166
+ * @internal
167
+ */
168
+ setResourceMetadataUrlResolver(resolve) {
169
+ this.resolveResourceMetadataUrl = resolve;
170
+ return this;
171
+ }
210
172
  setupSkills(enabled) {
211
- const manifest = pendingSkillsManifest;
212
- pendingSkillsManifest = null;
213
173
  if (!enabled) {
214
174
  return;
215
175
  }
216
- const skills = manifest ?? discoverSkills(SKILLS_DIR);
217
- if (skills.length === 0) {
176
+ discoveredSkills ??= pendingSkillsManifest ?? discoverSkills(SKILLS_DIR);
177
+ if (discoveredSkills.length === 0 && !warnedOnMissingSkills) {
178
+ warnedOnMissingSkills = true;
218
179
  console.warn(`skybridge: the "skills" option is enabled but no skills were found in "${SKILLS_DIR}". Add a <name>/SKILL.md there, or remove the option.`);
219
180
  }
220
- registerSkills(this, skills);
221
- }
222
- use(pathOrHandler, ...handlers) {
223
- // Branching is load-bearing: Express's `app.use` overloads can't be
224
- // resolved against a `string | RequestHandler` union, so we narrow.
225
- if (typeof pathOrHandler === "string") {
226
- this.express.use(pathOrHandler, ...handlers);
227
- }
228
- else {
229
- this.express.use(pathOrHandler, ...handlers);
230
- }
231
- return this;
232
- }
233
- useOnError(pathOrHandler, ...handlers) {
234
- if (typeof pathOrHandler === "string") {
235
- this.customErrorMiddleware.push({ path: pathOrHandler, handlers });
236
- }
237
- else {
238
- this.customErrorMiddleware.push({
239
- handlers: [pathOrHandler, ...handlers],
240
- });
241
- }
242
- return this;
181
+ registerSkills(this, discoveredSkills);
243
182
  }
244
183
  mcpMiddleware(filterOrHandler,
245
184
  // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants
246
185
  maybeHandler) {
247
- if (this.mcpMiddlewareApplied) {
248
- throw new Error("Cannot register MCP middleware after run() or connect() has been called");
249
- }
250
186
  const handler = maybeHandler;
251
187
  if (typeof filterOrHandler === "function") {
252
- this.mcpMiddlewareEntries.push({
188
+ this.userMiddlewareEntries.push({
253
189
  filter: null,
254
190
  handler: filterOrHandler,
255
191
  });
256
192
  }
257
193
  else if (handler) {
258
- this.mcpMiddlewareEntries.push({
194
+ this.userMiddlewareEntries.push({
259
195
  filter: filterOrHandler,
260
196
  handler,
261
197
  });
@@ -265,11 +201,15 @@ export class McpServer extends McpServerBaseOmitted {
265
201
  }
266
202
  return this;
267
203
  }
268
- applyMcpMiddleware() {
269
- if (this.mcpMiddlewareApplied) {
270
- return;
271
- }
272
- this.mcpMiddlewareApplied = true;
204
+ /**
205
+ * This instance's protocol-level middleware: the framework's own entries
206
+ * (view `_meta` on `resources/list`, version-agnostic view resolution on
207
+ * `resources/read`, the top-level `securitySchemes` mirror on `tools/list`)
208
+ * followed by the ones registered via {@link McpServer.mcpMiddleware}.
209
+ *
210
+ * @internal
211
+ */
212
+ protocolMiddlewareEntries() {
273
213
  // Surface view-resource _meta on `resources/list` (per ext-apps spec:
274
214
  // hosts/checkers read CSP & domain at list time before fetching content).
275
215
  const viewListMetaEntry = {
@@ -345,121 +285,12 @@ export class McpServer extends McpServerBaseOmitted {
345
285
  return result;
346
286
  },
347
287
  };
348
- const monitoringEntry = createMiddlewareEntry();
349
- const entries = [
350
- ...(monitoringEntry ? [monitoringEntry] : []),
288
+ return [
351
289
  viewListMetaEntry,
352
290
  viewReadResolveEntry,
353
291
  toolsListSecuritySchemesEntry,
354
- ...this.mcpMiddlewareEntries,
292
+ ...this.userMiddlewareEntries,
355
293
  ];
356
- const { requestHandlers, notificationHandlers } = getHandlerMaps(this.server);
357
- const instrumentMap = (map, isNotification) => {
358
- for (const [method, handler] of map) {
359
- map.set(method, buildMiddlewareChain(method, isNotification, handler, entries));
360
- }
361
- const originalSet = map.set.bind(map);
362
- map.set = (method, handler) => originalSet(method, buildMiddlewareChain(method, isNotification, handler, entries));
363
- };
364
- instrumentMap(requestHandlers, false);
365
- instrumentMap(notificationHandlers, true);
366
- }
367
- /**
368
- * Connect to an MCP transport (override of the SDK's `connect`). Use this
369
- * when you're embedding Skybridge in a host that already manages its own
370
- * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}
371
- * which sets the transport up for you. Locks in any middleware registered
372
- * via {@link McpServer.mcpMiddleware} — further calls to that method will
373
- * throw afterwards.
374
- */
375
- async connect(transport) {
376
- this.applyMcpMiddleware();
377
- return McpServerBase.prototype.connect.call(this, transport);
378
- }
379
- /**
380
- * Per-request stateless connect. The SDK's `Protocol` only allows one
381
- * transport per instance, so we can't reuse this `McpServer` across
382
- * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`
383
- * factory, but that would break Skybridge's singleton API — so instead
384
- * we build a fresh underlying `Server` per request and share the main
385
- * server's handler maps by reference. The cast is unavoidable: there's
386
- * no public API to inject handler maps. `getHandlerMaps` validates the
387
- * read side and fails fast on SDK field renames.
388
- */
389
- async connectStatelessTransport(transport) {
390
- this.applyMcpMiddleware();
391
- const { requestHandlers, notificationHandlers } = getHandlerMaps(this.server);
392
- const fresh = new SdkServer(this.serverInfo, this.serverOptions);
393
- const target = fresh;
394
- target._requestHandlers = requestHandlers;
395
- target._notificationHandlers = notificationHandlers;
396
- await fresh.connect(transport);
397
- }
398
- /**
399
- * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
400
- * mounts the `/mcp` route, applies any custom Express middleware registered
401
- * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in
402
- * any MCP middleware registered via {@link McpServer.mcpMiddleware}.
403
- *
404
- * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
405
- * the runtime can bridge incoming requests to the Node HTTP server. On
406
- * Vercel (`VERCEL === "1"`), returns the Express app directly so the
407
- * serverless function entry can call it as a `(req, res)` handler. On
408
- * Node, returns `undefined` once listening.
409
- */
410
- async run() {
411
- this.applyMcpMiddleware();
412
- if (process.env.VERCEL === "1") {
413
- // createApp only reads httpServer inside its dev-only branch
414
- // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a
415
- // bare object passed to satisfy the required parameter.
416
- const httpServer = http.createServer();
417
- await createApp({
418
- mcpServer: this,
419
- httpServer,
420
- errorMiddleware: this.customErrorMiddleware,
421
- });
422
- return this.express;
423
- }
424
- const httpServer = http.createServer();
425
- await createApp({
426
- mcpServer: this,
427
- httpServer,
428
- errorMiddleware: this.customErrorMiddleware,
429
- });
430
- httpServer.on("request", this.express);
431
- const port = parseInt(process.env.__PORT ?? "3000", 10);
432
- await new Promise((resolve, reject) => {
433
- httpServer.on("error", (error) => {
434
- console.error("Failed to start server:", error);
435
- reject(error);
436
- });
437
- httpServer.listen(port, () => {
438
- resolve();
439
- });
440
- });
441
- // On workerd, bridge the Node http server to a Workers fetch handler.
442
- // The specifier is held in a variable to sidestep tsc's module resolution
443
- // (`cloudflare:node` only exists under wrangler/workerd).
444
- if (typeof navigator !== "undefined" &&
445
- navigator.userAgent === "Cloudflare-Workers") {
446
- const cloudflareNode = "cloudflare:node";
447
- const { httpServerHandler } = await import(cloudflareNode);
448
- return httpServerHandler({ port });
449
- }
450
- const shutdown = () => {
451
- // Drop both handlers so a second signal falls through to Node's default
452
- // (force-quit on a second Ctrl+C while drain is hanging).
453
- process.off("SIGTERM", shutdown);
454
- process.off("SIGINT", shutdown);
455
- httpServer.close(() => process.exit(0));
456
- // Force exit if connections don't drain in time so the port is still
457
- // released promptly (e.g. for nodemon restarts).
458
- setTimeout(() => process.exit(0), 3000).unref();
459
- };
460
- process.on("SIGTERM", shutdown);
461
- process.on("SIGINT", shutdown);
462
- return undefined;
463
294
  }
464
295
  enforceOneToolPerView(component, toolName) {
465
296
  const existingTool = this.claimedViews.get(component);
@@ -468,13 +299,9 @@ export class McpServer extends McpServerBaseOmitted {
468
299
  }
469
300
  this.claimedViews.set(component, toolName);
470
301
  }
471
- resolveViewRequestContext(extra) {
302
+ resolveViewRequestContext(ctx) {
472
303
  const isProduction = process.env.NODE_ENV === "production";
473
- const headers = extra?.requestInfo?.headers || {};
474
- const header = (key) => {
475
- const val = headers[key];
476
- return Array.isArray(val) ? val[0] : val;
477
- };
304
+ const header = (key) => ctx?.http?.req?.headers.get(key) ?? undefined;
478
305
  const isClaude = hostFromUserAgent(header("user-agent")) === "claude";
479
306
  const serverUrl = resolveServerOrigin(header);
480
307
  // Path prefix the proxy routed this request under (e.g. `foo.com/v1`). Read
@@ -490,7 +317,7 @@ export class McpServer extends McpServerBaseOmitted {
490
317
  }
491
318
  let contentMetaOverrides = {};
492
319
  if (isClaude) {
493
- const pathname = extra?.requestInfo?.url?.pathname ?? "";
320
+ const pathname = ctx?.http?.req ? new URL(ctx.http.req.url).pathname : "";
494
321
  const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
495
322
  // Strip a lone trailing slash so the hash matches the connector URL
496
323
  // as registered with Claude (which has no trailing slash on bare origins).
@@ -510,46 +337,26 @@ export class McpServer extends McpServerBaseOmitted {
510
337
  // `tools/list` calls when the bundle hasn't changed.
511
338
  const versionParam = this.computeViewVersionParam(view.component);
512
339
  const viewResource = {
513
- hostType: "mcp-app",
514
340
  uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,
515
341
  mimeType: "text/html;profile=mcp-app",
516
342
  buildContentMeta: ({ resourceDomains, connectDomains, domain, baseUriDomains }, overrides) => {
517
- const defaults = {
518
- ui: {
519
- csp: {
520
- resourceDomains,
521
- connectDomains,
522
- baseUriDomains,
523
- },
524
- domain,
525
- },
526
- };
527
- const fromView = {
343
+ const ui = {
528
344
  ui: {
529
345
  ...(view.description && { description: view.description }),
530
346
  ...(view.prefersBorder !== undefined && {
531
347
  prefersBorder: view.prefersBorder,
532
348
  }),
533
- ...(view.domain && { domain: view.domain }),
349
+ domain: overrides.domain ?? view.domain ?? domain,
534
350
  csp: {
535
- ...(view.csp?.resourceDomains && {
536
- resourceDomains: view.csp.resourceDomains,
537
- }),
538
- ...(view.csp?.connectDomains && {
539
- connectDomains: view.csp.connectDomains,
540
- }),
351
+ resourceDomains: unionOf(resourceDomains, view.csp?.resourceDomains),
352
+ connectDomains: unionOf(connectDomains, view.csp?.connectDomains),
353
+ baseUriDomains: unionOf(baseUriDomains, view.csp?.baseUriDomains),
541
354
  ...(view.csp?.frameDomains && {
542
355
  frameDomains: view.csp.frameDomains,
543
356
  }),
544
- ...(view.csp?.baseUriDomains && {
545
- baseUriDomains: view.csp.baseUriDomains,
546
- }),
547
357
  },
548
358
  },
549
359
  };
550
- const ui = mergeWithUnion(mergeWithUnion(defaults, fromView), {
551
- ui: overrides,
552
- });
553
360
  const base = {
554
361
  ...ui,
555
362
  ...(view.description && {
@@ -575,7 +382,7 @@ export class McpServer extends McpServerBaseOmitted {
575
382
  toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };
576
383
  }
577
384
  registerViewResource({ name, viewResource, view, }) {
578
- const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;
385
+ const { uri: viewUri, mimeType, buildContentMeta } = viewResource;
579
386
  const buildMeta = (extra) => {
580
387
  const { serverUrl, connectDomains, contentMetaOverrides } = this.resolveViewRequestContext(extra);
581
388
  return buildContentMeta({
@@ -597,13 +404,11 @@ export class McpServer extends McpServerBaseOmitted {
597
404
  const viewBase = `${serverUrl}${assetsBasePath}`;
598
405
  const html = isProduction
599
406
  ? templateHelper.renderProduction({
600
- hostType,
601
407
  serverUrl: viewBase,
602
408
  viewFile: this.lookupViewFile(view.component),
603
409
  styleFile: this.lookupDistFile("style.css") ?? "",
604
410
  })
605
411
  : templateHelper.renderDevelopment({
606
- hostType,
607
412
  serverUrl: viewBase,
608
413
  viewName: view.component,
609
414
  });
@@ -621,15 +426,10 @@ export class McpServer extends McpServerBaseOmitted {
621
426
  }
622
427
  decorateToolHandler(cb, { attachViewUUID, securitySchemes, toolName, }) {
623
428
  return async (args, extra) => {
624
- const toolExtra = extra ?? args;
625
429
  if (this.oauthEnabled) {
626
- const failure = evaluateSecuritySchemes(securitySchemes, toolExtra?.authInfo);
430
+ const failure = evaluateSecuritySchemes(securitySchemes, extra.http?.authInfo);
627
431
  if (failure) {
628
- const headers = toolExtra?.requestInfo?.headers ?? {};
629
- const header = (key) => {
630
- const value = headers[key];
631
- return Array.isArray(value) ? value[0] : value;
632
- };
432
+ const header = (key) => extra.http?.req?.headers.get(key) ?? undefined;
633
433
  return inBandChallengeResult(failure, this.resolveResourceMetadataUrl?.(header));
634
434
  }
635
435
  }
@@ -638,7 +438,7 @@ export class McpServer extends McpServerBaseOmitted {
638
438
  result = await cb(args, extra);
639
439
  }
640
440
  catch (error) {
641
- captureToolError(toolExtra, error);
441
+ captureToolError(extra, error);
642
442
  throw error;
643
443
  }
644
444
  warnOnLargeToolOutput(result, toolName);
@@ -701,11 +501,13 @@ export class McpServer extends McpServerBaseOmitted {
701
501
  if (this.viteManifest) {
702
502
  return this.viteManifest;
703
503
  }
704
- return JSON.parse(readFileSync(path.join(process.cwd(), "dist", "assets", ".vite", "manifest.json"), "utf-8"));
504
+ cachedDiskManifest ??= JSON.parse(readFileSync(path.join(process.cwd(), "dist", "assets", ".vite", "manifest.json"), "utf-8"));
505
+ return cachedDiskManifest ?? {};
705
506
  }
706
- registerTool(...args) {
507
+ registerTool(rawConfig, rawCb) {
707
508
  const baseFn = McpServerBase.prototype.registerTool;
708
- const { config, cb } = normalizeRegisterToolArgs(args);
509
+ const config = rawConfig;
510
+ const cb = rawCb;
709
511
  const { name, view, auth, securitySchemes: rawSecuritySchemes, _meta: userToolMeta, ...toolFields } = config;
710
512
  const authNeedsProvider = auth !== undefined &&
711
513
  (!auth.allowsAnonymous || Boolean(auth.scopes?.length));
@@ -717,7 +519,7 @@ export class McpServer extends McpServerBaseOmitted {
717
519
  const securitySchemes = rawSecuritySchemes ??
718
520
  (auth && this.oauthEnabled ? authToSecuritySchemes(auth) : undefined);
719
521
  const toolMeta = { ...userToolMeta };
720
- this.securitySchemesByTool.set(name, securitySchemes);
522
+ this.toolSecuritySchemes.set(name, securitySchemes);
721
523
  if (securitySchemes) {
722
524
  // SEP-1488 puts `securitySchemes` at the top level of the tool
723
525
  // descriptor, but the SDK's `registerTool` drops unknown top-level
@@ -735,7 +537,9 @@ export class McpServer extends McpServerBaseOmitted {
735
537
  securitySchemes,
736
538
  toolName: name,
737
539
  });
738
- baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);
540
+ baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, toolFields.inputSchema === undefined
541
+ ? (extra) => wrappedCb({}, extra)
542
+ : wrappedCb);
739
543
  return this;
740
544
  }
741
545
  }