skybridge 0.0.0-dev.df0cfdd → 0.0.0-dev.df1e961

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (233) hide show
  1. package/README.md +7 -7
  2. package/dist/cli/build-helpers.d.ts +1 -1
  3. package/dist/cli/build-helpers.js +4 -4
  4. package/dist/cli/build-helpers.js.map +1 -1
  5. package/dist/cli/build-helpers.test.js +2 -2
  6. package/dist/cli/build-helpers.test.js.map +1 -1
  7. package/dist/cli/build-steps.js +1 -1
  8. package/dist/cli/build-steps.js.map +1 -1
  9. package/dist/cli/detect-port.js +0 -1
  10. package/dist/cli/detect-port.js.map +1 -1
  11. package/dist/cli/use-execute-steps.d.ts +1 -1
  12. package/dist/cli/use-nodemon.js +11 -3
  13. package/dist/cli/use-nodemon.js.map +1 -1
  14. package/dist/cli/use-typescript-check.js +1 -1
  15. package/dist/cli/use-typescript-check.js.map +1 -1
  16. package/dist/commands/dev.js +1 -1
  17. package/dist/commands/dev.js.map +1 -1
  18. package/dist/commands/start.js +2 -2
  19. package/dist/commands/start.js.map +1 -1
  20. package/dist/server/app.d.ts +194 -0
  21. package/dist/server/app.js +266 -0
  22. package/dist/server/app.js.map +1 -0
  23. package/dist/server/app.test.js +97 -0
  24. package/dist/server/app.test.js.map +1 -0
  25. package/dist/server/auth/discovery.d.ts +2 -1
  26. package/dist/server/auth/discovery.js +2 -2
  27. package/dist/server/auth/discovery.js.map +1 -1
  28. package/dist/server/auth/index.d.ts +21 -17
  29. package/dist/server/auth/index.js.map +1 -1
  30. package/dist/server/auth/providers/auth0.d.ts +2 -2
  31. package/dist/server/auth/providers/auth0.js +13 -8
  32. package/dist/server/auth/providers/auth0.js.map +1 -1
  33. package/dist/server/auth/providers/auth0.test.js +1 -1
  34. package/dist/server/auth/providers/auth0.test.js.map +1 -1
  35. package/dist/server/auth/providers/authplane.d.ts +2 -2
  36. package/dist/server/auth/providers/authplane.js.map +1 -1
  37. package/dist/server/auth/providers/authplane.test.js +10 -7
  38. package/dist/server/auth/providers/authplane.test.js.map +1 -1
  39. package/dist/server/auth/providers/clerk.d.ts +2 -2
  40. package/dist/server/auth/providers/clerk.js.map +1 -1
  41. package/dist/server/auth/providers/clerk.test.js +1 -1
  42. package/dist/server/auth/providers/clerk.test.js.map +1 -1
  43. package/dist/server/auth/providers/custom.d.ts +4 -4
  44. package/dist/server/auth/providers/custom.js +5 -2
  45. package/dist/server/auth/providers/custom.js.map +1 -1
  46. package/dist/server/auth/providers/custom.test.js +13 -10
  47. package/dist/server/auth/providers/custom.test.js.map +1 -1
  48. package/dist/server/auth/providers/descope.d.ts +2 -2
  49. package/dist/server/auth/providers/descope.js.map +1 -1
  50. package/dist/server/auth/providers/descope.test.js +3 -3
  51. package/dist/server/auth/providers/descope.test.js.map +1 -1
  52. package/dist/server/auth/providers/stytch.d.ts +2 -2
  53. package/dist/server/auth/providers/stytch.js.map +1 -1
  54. package/dist/server/auth/providers/workos.d.ts +2 -2
  55. package/dist/server/auth/providers/workos.js.map +1 -1
  56. package/dist/server/auth/setup.d.ts +1 -1
  57. package/dist/server/auth/setup.js +3 -4
  58. package/dist/server/auth/setup.js.map +1 -1
  59. package/dist/server/auth/setup.test.js +83 -77
  60. package/dist/server/auth/setup.test.js.map +1 -1
  61. package/dist/server/auth/verify.js +2 -2
  62. package/dist/server/auth/verify.js.map +1 -1
  63. package/dist/server/auth-extra.test-d.js +97 -49
  64. package/dist/server/auth-extra.test-d.js.map +1 -1
  65. package/dist/server/auth.d.ts +7 -8
  66. package/dist/server/auth.js +4 -5
  67. package/dist/server/auth.js.map +1 -1
  68. package/dist/server/build-manifest.test.js +7 -6
  69. package/dist/server/build-manifest.test.js.map +1 -1
  70. package/dist/server/content-helpers.d.ts +1 -1
  71. package/dist/server/content-helpers.js.map +1 -1
  72. package/dist/server/express.d.ts +23 -3
  73. package/dist/server/express.js +38 -32
  74. package/dist/server/express.js.map +1 -1
  75. package/dist/server/express.test.js +220 -103
  76. package/dist/server/express.test.js.map +1 -1
  77. package/dist/server/file-ref.d.ts +1 -1
  78. package/dist/server/file-ref.js +1 -1
  79. package/dist/server/file-ref.js.map +1 -1
  80. package/dist/server/index.d.ts +6 -3
  81. package/dist/server/index.js +3 -1
  82. package/dist/server/index.js.map +1 -1
  83. package/dist/server/mcp-errors.test.js +41 -0
  84. package/dist/server/mcp-errors.test.js.map +1 -0
  85. package/dist/server/middleware.d.ts +6 -6
  86. package/dist/server/middleware.js.map +1 -1
  87. package/dist/server/middleware.test-d.js +1 -1
  88. package/dist/server/middleware.test-d.js.map +1 -1
  89. package/dist/server/middleware.test.js +222 -150
  90. package/dist/server/middleware.test.js.map +1 -1
  91. package/dist/server/register-tool.test.d.ts +1 -0
  92. package/dist/server/register-tool.test.js +27 -0
  93. package/dist/server/register-tool.test.js.map +1 -0
  94. package/dist/server/server.d.ts +74 -122
  95. package/dist/server/server.js +101 -302
  96. package/dist/server/server.js.map +1 -1
  97. package/dist/server/skills-integration.test.js +19 -12
  98. package/dist/server/skills-integration.test.js.map +1 -1
  99. package/dist/server/skills.d.ts +3 -5
  100. package/dist/server/skills.js +17 -24
  101. package/dist/server/skills.js.map +1 -1
  102. package/dist/server/skills.test.js +8 -12
  103. package/dist/server/skills.test.js.map +1 -1
  104. package/dist/server/templateHelper.d.ts +0 -3
  105. package/dist/server/templateHelper.js.map +1 -1
  106. package/dist/server/templates.generated.js +4 -8
  107. package/dist/server/templates.generated.js.map +1 -1
  108. package/dist/server/tool-extra.test.d.ts +1 -0
  109. package/dist/server/tool-extra.test.js +88 -0
  110. package/dist/server/tool-extra.test.js.map +1 -0
  111. package/dist/server/view-resource-resolution.test.js +18 -13
  112. package/dist/server/view-resource-resolution.test.js.map +1 -1
  113. package/dist/test/utils.d.ts +9 -11
  114. package/dist/test/utils.js +220 -201
  115. package/dist/test/utils.js.map +1 -1
  116. package/dist/test/view.test.js +25 -37
  117. package/dist/test/view.test.js.map +1 -1
  118. package/dist/views/index.d.ts +10 -0
  119. package/dist/views/index.js +3 -0
  120. package/dist/views/index.js.map +1 -0
  121. package/dist/views/scan-views.d.ts +16 -0
  122. package/dist/views/scan-views.js +88 -0
  123. package/dist/views/scan-views.js.map +1 -0
  124. package/dist/views/scan-views.test.d.ts +1 -0
  125. package/dist/views/scan-views.test.js +99 -0
  126. package/dist/views/scan-views.test.js.map +1 -0
  127. package/dist/views/validate-view.d.ts +1 -0
  128. package/dist/views/validate-view.js +9 -0
  129. package/dist/views/validate-view.js.map +1 -0
  130. package/dist/views/validate-view.test.d.ts +1 -0
  131. package/dist/views/validate-view.test.js +24 -0
  132. package/dist/views/validate-view.test.js.map +1 -0
  133. package/dist/web/bridges/adaptor.test.js +1 -1
  134. package/dist/web/bridges/adaptor.test.js.map +1 -1
  135. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.d.ts +1 -1
  136. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.js +1 -1
  137. package/dist/web/bridges/apps-sdk/use-apps-sdk-context.js.map +1 -1
  138. package/dist/web/bridges/get-adaptor.test.js +2 -2
  139. package/dist/web/bridges/get-adaptor.test.js.map +1 -1
  140. package/dist/web/bridges/mcp-app/bridge.js +1 -1
  141. package/dist/web/bridges/mcp-app/bridge.js.map +1 -1
  142. package/dist/web/bridges/mcp-app/bridge.test.js +2 -2
  143. package/dist/web/bridges/mcp-app/bridge.test.js.map +1 -1
  144. package/dist/web/bridges/mcp-app/use-mcp-app-context.d.ts +1 -1
  145. package/dist/web/bridges/mcp-app/use-mcp-app-context.js +1 -1
  146. package/dist/web/bridges/mcp-app/use-mcp-app-context.js.map +1 -1
  147. package/dist/web/bridges/mcp-app/use-mcp-app-context.test.js +1 -1
  148. package/dist/web/bridges/mcp-app/use-mcp-app-context.test.js.map +1 -1
  149. package/dist/web/bridges/mcp-app/view-tools.test.js +1 -1
  150. package/dist/web/bridges/mcp-app/view-tools.test.js.map +1 -1
  151. package/dist/web/bridges/types.d.ts +17 -12
  152. package/dist/web/bridges/types.js.map +1 -1
  153. package/dist/web/create-store.test.js +2 -2
  154. package/dist/web/create-store.test.js.map +1 -1
  155. package/dist/web/data-llm.test.js +2 -2
  156. package/dist/web/data-llm.test.js.map +1 -1
  157. package/dist/web/generate-helpers.d.ts +22 -18
  158. package/dist/web/generate-helpers.js +19 -15
  159. package/dist/web/generate-helpers.js.map +1 -1
  160. package/dist/web/generate-helpers.test-d.js +3 -3
  161. package/dist/web/generate-helpers.test-d.js.map +1 -1
  162. package/dist/web/generate-helpers.test.js +2 -2
  163. package/dist/web/generate-helpers.test.js.map +1 -1
  164. package/dist/web/hooks/index.d.ts +2 -2
  165. package/dist/web/hooks/index.js +2 -2
  166. package/dist/web/hooks/index.js.map +1 -1
  167. package/dist/web/hooks/use-call-tool.test.js +2 -2
  168. package/dist/web/hooks/use-call-tool.test.js.map +1 -1
  169. package/dist/web/hooks/use-display-mode.d.ts +1 -1
  170. package/dist/web/hooks/use-display-mode.js +1 -1
  171. package/dist/web/hooks/use-display-mode.js.map +1 -1
  172. package/dist/web/hooks/use-display-mode.test.js +1 -1
  173. package/dist/web/hooks/use-display-mode.test.js.map +1 -1
  174. package/dist/web/hooks/use-download.d.ts +1 -3
  175. package/dist/web/hooks/use-download.js +1 -2
  176. package/dist/web/hooks/use-download.js.map +1 -1
  177. package/dist/web/hooks/use-download.test.js +7 -7
  178. package/dist/web/hooks/use-download.test.js.map +1 -1
  179. package/dist/web/hooks/use-files.test.js +1 -1
  180. package/dist/web/hooks/use-files.test.js.map +1 -1
  181. package/dist/web/hooks/{use-host-info.d.ts → use-host.d.ts} +2 -2
  182. package/dist/web/hooks/{use-host-info.js → use-host.js} +3 -3
  183. package/dist/web/hooks/use-host.js.map +1 -0
  184. package/dist/web/hooks/use-host.test.d.ts +1 -0
  185. package/dist/web/hooks/{use-host-info.test.js → use-host.test.js} +7 -7
  186. package/dist/web/hooks/use-host.test.js.map +1 -0
  187. package/dist/web/hooks/use-open-external.test.js +2 -2
  188. package/dist/web/hooks/use-open-external.test.js.map +1 -1
  189. package/dist/web/hooks/use-register-view-tool.d.ts +2 -3
  190. package/dist/web/hooks/use-register-view-tool.js.map +1 -1
  191. package/dist/web/hooks/use-request-close.test.js +1 -1
  192. package/dist/web/hooks/use-request-close.test.js.map +1 -1
  193. package/dist/web/hooks/use-request-modal.test.js +1 -1
  194. package/dist/web/hooks/use-request-modal.test.js.map +1 -1
  195. package/dist/web/hooks/use-request-size.d.ts +1 -1
  196. package/dist/web/hooks/use-request-size.js +1 -1
  197. package/dist/web/hooks/use-request-size.js.map +1 -1
  198. package/dist/web/hooks/use-request-size.test.js +1 -1
  199. package/dist/web/hooks/use-request-size.test.js.map +1 -1
  200. package/dist/web/hooks/use-set-open-in-app-url.test.js +2 -8
  201. package/dist/web/hooks/use-set-open-in-app-url.test.js.map +1 -1
  202. package/dist/web/hooks/use-tool-info.d.ts +1 -20
  203. package/dist/web/hooks/use-tool-info.js +0 -1
  204. package/dist/web/hooks/use-tool-info.js.map +1 -1
  205. package/dist/web/hooks/use-tool-info.test-d.js +0 -5
  206. package/dist/web/hooks/use-tool-info.test-d.js.map +1 -1
  207. package/dist/web/hooks/use-tool-info.test.js +2 -7
  208. package/dist/web/hooks/use-tool-info.test.js.map +1 -1
  209. package/dist/web/hooks/use-user.d.ts +3 -2
  210. package/dist/web/hooks/use-user.js +4 -3
  211. package/dist/web/hooks/use-user.js.map +1 -1
  212. package/dist/web/hooks/use-user.test.js +5 -3
  213. package/dist/web/hooks/use-user.test.js.map +1 -1
  214. package/dist/web/hooks/use-view-state.test.js +2 -2
  215. package/dist/web/hooks/use-view-state.test.js.map +1 -1
  216. package/dist/web/hooks/use-viewport.d.ts +20 -0
  217. package/dist/web/hooks/use-viewport.js +21 -0
  218. package/dist/web/hooks/use-viewport.js.map +1 -0
  219. package/dist/web/hooks/use-viewport.test.d.ts +1 -0
  220. package/dist/web/hooks/{use-layout.test.js → use-viewport.test.js} +12 -32
  221. package/dist/web/hooks/use-viewport.test.js.map +1 -0
  222. package/dist/web/mount-view.d.ts +3 -2
  223. package/dist/web/mount-view.js +5 -8
  224. package/dist/web/mount-view.js.map +1 -1
  225. package/package.json +15 -8
  226. package/dist/web/hooks/use-host-info.js.map +0 -1
  227. package/dist/web/hooks/use-host-info.test.js.map +0 -1
  228. package/dist/web/hooks/use-layout.d.ts +0 -24
  229. package/dist/web/hooks/use-layout.js +0 -25
  230. package/dist/web/hooks/use-layout.js.map +0 -1
  231. package/dist/web/hooks/use-layout.test.js.map +0 -1
  232. /package/dist/{web/hooks/use-host-info.test.d.ts → server/app.test.d.ts} +0 -0
  233. /package/dist/{web/hooks/use-layout.test.d.ts → server/mcp-errors.test.d.ts} +0 -0
@@ -1,28 +1,15 @@
1
1
  import crypto from "node:crypto";
2
2
  import { readFileSync } from "node:fs";
3
- import http from "node:http";
4
3
  import path from "node:path";
5
- import { Server as SdkServer, } from "@modelcontextprotocol/sdk/server/index.js";
6
- import { McpServer as McpServerBase } from "@modelcontextprotocol/sdk/server/mcp.js";
7
- import { mergeWith, union } from "es-toolkit";
8
- import express, {} from "express";
4
+ import { McpServer as McpServerBase, } from "@modelcontextprotocol/server";
9
5
  import { warnOnLargeToolOutput } from "../context-warnings.js";
10
6
  import { authToSecuritySchemes, evaluateSecuritySchemes, inBandChallengeResult, } from "./auth/security-schemes.js";
11
- import { setupOAuth } from "./auth/setup.js";
12
- import { createApp } from "./express.js";
13
7
  import { hostFromUserAgent } from "./host.js";
14
- import { createMiddlewareEntry } from "./metric.js";
15
- import { buildMiddlewareChain, captureToolError, getHandlerMaps, } from "./middleware.js";
8
+ import { captureToolError } from "./middleware.js";
16
9
  import { resolveServerOrigin } from "./requestOrigin.js";
17
10
  import { discoverSkills, registerSkills, SKILLS_EXTENSION_KEY, } from "./skills.js";
18
11
  import { templateHelper } from "./templateHelper.js";
19
- const mergeWithUnion = (target, source) => {
20
- return mergeWith(target, source, (targetVal, sourceVal) => {
21
- if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {
22
- return union(targetVal, sourceVal);
23
- }
24
- });
25
- };
12
+ const unionOf = (base, extra) => extra ? [...new Set([...base, ...extra])] : base;
26
13
  const SKILLS_DIR = "src/skills";
27
14
  /**
28
15
  * Normalize an `x-forwarded-prefix` value into a leading-slash, no-trailing-slash
@@ -65,35 +52,6 @@ export function normalizeContent(content) {
65
52
  return [content];
66
53
  }
67
54
  const McpServerBaseOmitted = McpServerBase;
68
- /**
69
- * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool
70
- * registry, view resources, an embedded Express app, and protocol-level
71
- * middleware. Construct it with the same `Implementation` info you would pass
72
- * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,
73
- * then call {@link McpServer.run} to start the HTTP server.
74
- *
75
- * The `TTools` generic accumulates each registered tool's input/output/meta
76
- * shape, so `typeof server` carries enough information for view-side helpers
77
- * like {@link generateHelpers} to produce fully-typed hooks.
78
- *
79
- * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`
80
- * chaining; you almost never set this manually.
81
- *
82
- * @example
83
- * ```ts
84
- * const server = new McpServer({ name: "my-app", version: "1.0.0" }, {})
85
- * .registerTool({
86
- * name: "search",
87
- * inputSchema: { query: z.string() },
88
- * view: { component: "search" },
89
- * }, async ({ query }) => ({ content: `Results for ${query}` }));
90
- *
91
- * await server.run();
92
- * export type AppType = typeof server;
93
- * ```
94
- *
95
- * @see https://docs.skybridge.tech/api-reference/mcp-server
96
- */
97
55
  // Side channel populated by `dist/__entry.js` before user code is imported.
98
56
  // Set at module scope rather than passed through the constructor because the
99
57
  // wrapper has the manifest before the user's `new McpServer(...)` runs, and
@@ -111,8 +69,12 @@ export function __setBuildManifest(manifest) {
111
69
  pendingBuildManifest = manifest;
112
70
  }
113
71
  let pendingSkillsManifest = null;
72
+ let cachedDiskManifest = null;
73
+ let discoveredSkills = null;
74
+ let warnedOnMissingSkills = false;
114
75
  export function __setSkillsManifest(manifest) {
115
76
  pendingSkillsManifest = manifest;
77
+ discoveredSkills = null;
116
78
  }
117
79
  // Pure and `this`-free so it can run inside the `super(...)` call, before `this`
118
80
  // exists — the capability must be present for the `initialize` response.
@@ -131,45 +93,37 @@ function withSkillsCapability(options, skybridgeOptions) {
131
93
  },
132
94
  };
133
95
  }
134
- // Collapses registerTool's two overloads into a single { config, cb } shape.
135
- // registerTool("greet", { description }, handler)
136
- // -> { config: { name: "greet", description }, cb: handler }
137
- // registerTool({ name: "greet", description }, handler)
138
- // -> { config: { name: "greet", description }, cb: handler }
139
- function normalizeRegisterToolArgs(args) {
140
- if (typeof args[0] === "string") {
141
- return {
142
- config: {
143
- name: args[0],
144
- ...args[1],
145
- },
146
- cb: args[2],
147
- };
148
- }
149
- return {
150
- config: args[0],
151
- cb: args[1],
152
- };
153
- }
96
+ /**
97
+ * Typed registration sugar over the MCP SDK's `McpServer`: a tool registry
98
+ * that carries input/output/meta shapes, view resources, per-tool security
99
+ * schemes, and prompt/resource registration. A {@link Skybridge} app builds
100
+ * one of these per request and hands it to your `handler`; chain
101
+ * {@link McpServer.registerTool} calls on it and return the result.
102
+ *
103
+ * The `TTools` generic accumulates each registered tool's input/output/meta
104
+ * shape, so `typeof app` carries enough information for view-side helpers
105
+ * like {@link generateHelpers} to produce fully-typed hooks.
106
+ *
107
+ * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`
108
+ * chaining; you almost never set this manually.
109
+ *
110
+ * @example
111
+ * ```ts
112
+ * export const app = new Skybridge({
113
+ * name: "my-app",
114
+ * version: "1.0.0",
115
+ * handler: (server) =>
116
+ * server.registerTool({
117
+ * name: "search",
118
+ * inputSchema: { query: z.string() },
119
+ * view: { component: "search" },
120
+ * }, async ({ query }) => ({ content: `Results for ${query}` })),
121
+ * });
122
+ * ```
123
+ *
124
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
125
+ */
154
126
  export class McpServer extends McpServerBaseOmitted {
155
- /**
156
- * The underlying Express app. Use this to extend the HTTP server with
157
- * custom routes, middleware, or settings — e.g.
158
- * `server.express.get("/health", ...)`.
159
- *
160
- * `express.json()` is pre-applied — tune it via the constructor's third
161
- * argument, e.g. `new McpServer(info, {}, { json: { limit: "10mb" } })`.
162
- * Register your handlers before `run()`;
163
- * after `run()`, dev-mode middleware, the `/mcp` route, and the default
164
- * error handler are appended in that order.
165
- *
166
- * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
167
- * locally and on self-hosted deployments.
168
- */
169
- express;
170
- customErrorMiddleware = [];
171
- mcpMiddlewareEntries = [];
172
- mcpMiddlewareApplied = false;
173
127
  claimedViews = new Map();
174
128
  viewMetaBuilders = new Map();
175
129
  /**
@@ -180,82 +134,64 @@ export class McpServer extends McpServerBaseOmitted {
180
134
  */
181
135
  viewUriByPath = new Map();
182
136
  viteManifest = null;
183
- serverInfo;
184
- serverOptions;
185
137
  oauthEnabled = false;
186
138
  resolveResourceMetadataUrl;
187
- securitySchemesByTool = new Map();
139
+ toolSecuritySchemes = new Map();
140
+ userMiddlewareEntries = [];
188
141
  constructor(serverInfo, options, skybridgeOptions) {
189
- const mergedOptions = withSkillsCapability(options, skybridgeOptions);
190
- super(serverInfo, mergedOptions);
191
- this.serverInfo = serverInfo;
192
- this.serverOptions = mergedOptions;
193
- this.express = express();
194
- this.express.use(express.json(skybridgeOptions?.json));
195
- if (skybridgeOptions?.oauth) {
196
- this.oauthEnabled = true;
197
- this.resolveResourceMetadataUrl = setupOAuth(this.express, skybridgeOptions.oauth, this.securitySchemesByTool);
198
- }
142
+ super(serverInfo, withSkillsCapability(options, skybridgeOptions));
143
+ this.oauthEnabled = Boolean(skybridgeOptions?.oauth);
199
144
  // Pick up the manifest if `dist/__entry.js` primed it before importing
200
- // user code. Consume-once: clear after the first construction so a
201
- // subsequent test that doesn't prime can't inherit stale state.
202
- // Explicit `setViteManifest` calls still win because they happen after
203
- // construction.
145
+ // user code. Explicit `setViteManifest` calls still win because they
146
+ // happen after construction.
204
147
  if (pendingBuildManifest) {
205
148
  this.setViteManifest(pendingBuildManifest);
206
- pendingBuildManifest = null;
207
149
  }
208
150
  this.setupSkills(Boolean(skybridgeOptions?.skills));
209
151
  }
152
+ /**
153
+ * The per-tool security schemes collected during registration, keyed by tool
154
+ * name. Read by the OAuth layer to decide whether anonymous requests are
155
+ * allowed and which schemes gate a given `tools/call`.
156
+ *
157
+ * @internal
158
+ */
159
+ get securitySchemesByTool() {
160
+ return this.toolSecuritySchemes;
161
+ }
162
+ /**
163
+ * Inject the resolver the app uses to build the protected-resource metadata
164
+ * URL, so tool handlers can emit in-band auth challenges.
165
+ *
166
+ * @internal
167
+ */
168
+ setResourceMetadataUrlResolver(resolve) {
169
+ this.resolveResourceMetadataUrl = resolve;
170
+ return this;
171
+ }
210
172
  setupSkills(enabled) {
211
- const manifest = pendingSkillsManifest;
212
- pendingSkillsManifest = null;
213
173
  if (!enabled) {
214
174
  return;
215
175
  }
216
- const skills = manifest ?? discoverSkills(SKILLS_DIR);
217
- if (skills.length === 0) {
176
+ discoveredSkills ??= pendingSkillsManifest ?? discoverSkills(SKILLS_DIR);
177
+ if (discoveredSkills.length === 0 && !warnedOnMissingSkills) {
178
+ warnedOnMissingSkills = true;
218
179
  console.warn(`skybridge: the "skills" option is enabled but no skills were found in "${SKILLS_DIR}". Add a <name>/SKILL.md there, or remove the option.`);
219
180
  }
220
- registerSkills(this, skills);
221
- }
222
- use(pathOrHandler, ...handlers) {
223
- // Branching is load-bearing: Express's `app.use` overloads can't be
224
- // resolved against a `string | RequestHandler` union, so we narrow.
225
- if (typeof pathOrHandler === "string") {
226
- this.express.use(pathOrHandler, ...handlers);
227
- }
228
- else {
229
- this.express.use(pathOrHandler, ...handlers);
230
- }
231
- return this;
232
- }
233
- useOnError(pathOrHandler, ...handlers) {
234
- if (typeof pathOrHandler === "string") {
235
- this.customErrorMiddleware.push({ path: pathOrHandler, handlers });
236
- }
237
- else {
238
- this.customErrorMiddleware.push({
239
- handlers: [pathOrHandler, ...handlers],
240
- });
241
- }
242
- return this;
181
+ registerSkills(this, discoveredSkills);
243
182
  }
244
183
  mcpMiddleware(filterOrHandler,
245
184
  // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants
246
185
  maybeHandler) {
247
- if (this.mcpMiddlewareApplied) {
248
- throw new Error("Cannot register MCP middleware after run() or connect() has been called");
249
- }
250
186
  const handler = maybeHandler;
251
187
  if (typeof filterOrHandler === "function") {
252
- this.mcpMiddlewareEntries.push({
188
+ this.userMiddlewareEntries.push({
253
189
  filter: null,
254
190
  handler: filterOrHandler,
255
191
  });
256
192
  }
257
193
  else if (handler) {
258
- this.mcpMiddlewareEntries.push({
194
+ this.userMiddlewareEntries.push({
259
195
  filter: filterOrHandler,
260
196
  handler,
261
197
  });
@@ -265,11 +201,15 @@ export class McpServer extends McpServerBaseOmitted {
265
201
  }
266
202
  return this;
267
203
  }
268
- applyMcpMiddleware() {
269
- if (this.mcpMiddlewareApplied) {
270
- return;
271
- }
272
- this.mcpMiddlewareApplied = true;
204
+ /**
205
+ * This instance's protocol-level middleware: the framework's own entries
206
+ * (view `_meta` on `resources/list`, version-agnostic view resolution on
207
+ * `resources/read`, the top-level `securitySchemes` mirror on `tools/list`)
208
+ * followed by the ones registered via {@link McpServer.mcpMiddleware}.
209
+ *
210
+ * @internal
211
+ */
212
+ protocolMiddlewareEntries() {
273
213
  // Surface view-resource _meta on `resources/list` (per ext-apps spec:
274
214
  // hosts/checkers read CSP & domain at list time before fetching content).
275
215
  const viewListMetaEntry = {
@@ -345,126 +285,12 @@ export class McpServer extends McpServerBaseOmitted {
345
285
  return result;
346
286
  },
347
287
  };
348
- const monitoringEntry = createMiddlewareEntry();
349
- const entries = [
350
- ...(monitoringEntry ? [monitoringEntry] : []),
288
+ return [
351
289
  viewListMetaEntry,
352
290
  viewReadResolveEntry,
353
291
  toolsListSecuritySchemesEntry,
354
- ...this.mcpMiddlewareEntries,
292
+ ...this.userMiddlewareEntries,
355
293
  ];
356
- const { requestHandlers, notificationHandlers } = getHandlerMaps(this.server);
357
- const instrumentMap = (map, isNotification) => {
358
- for (const [method, handler] of map) {
359
- map.set(method, buildMiddlewareChain(method, isNotification, handler, entries));
360
- }
361
- const originalSet = map.set.bind(map);
362
- map.set = (method, handler) => originalSet(method, buildMiddlewareChain(method, isNotification, handler, entries));
363
- };
364
- instrumentMap(requestHandlers, false);
365
- instrumentMap(notificationHandlers, true);
366
- }
367
- /**
368
- * Connect to an MCP transport (override of the SDK's `connect`). Use this
369
- * when you're embedding Skybridge in a host that already manages its own
370
- * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}
371
- * which sets the transport up for you. Locks in any middleware registered
372
- * via {@link McpServer.mcpMiddleware} — further calls to that method will
373
- * throw afterwards.
374
- */
375
- async connect(transport) {
376
- this.applyMcpMiddleware();
377
- return McpServerBase.prototype.connect.call(this, transport);
378
- }
379
- /**
380
- * Per-request stateless connect. The SDK's `Protocol` only allows one
381
- * transport per instance, so we can't reuse this `McpServer` across
382
- * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`
383
- * factory, but that would break Skybridge's singleton API — so instead
384
- * we build a fresh underlying `Server` per request and share the main
385
- * server's handler maps by reference. The cast is unavoidable: there's
386
- * no public API to inject handler maps. `getHandlerMaps` validates the
387
- * read side and fails fast on SDK field renames.
388
- */
389
- async connectStatelessTransport(transport) {
390
- this.applyMcpMiddleware();
391
- const { requestHandlers, notificationHandlers } = getHandlerMaps(this.server);
392
- const fresh = new SdkServer(this.serverInfo, this.serverOptions);
393
- const target = fresh;
394
- target._requestHandlers = requestHandlers;
395
- target._notificationHandlers = notificationHandlers;
396
- await fresh.connect(transport);
397
- }
398
- /**
399
- * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
400
- * mounts the `/mcp` route, applies any custom Express middleware registered
401
- * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in
402
- * any MCP middleware registered via {@link McpServer.mcpMiddleware}.
403
- *
404
- * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
405
- * the runtime can bridge incoming requests to the Node HTTP server. On
406
- * Vercel (`VERCEL === "1"`), returns the Express app directly so the
407
- * serverless function entry can call it as a `(req, res)` handler. On
408
- * Node, returns `undefined` once listening. When the process was spawned
409
- * with an IPC channel, the bound port is reported to the parent as
410
- * `{ type: "skybridge:listening", port }`, the readiness signal test runners
411
- * wait on instead of polling.
412
- */
413
- async run() {
414
- this.applyMcpMiddleware();
415
- if (process.env.VERCEL === "1") {
416
- // createApp only reads httpServer inside its dev-only branch
417
- // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a
418
- // bare object passed to satisfy the required parameter.
419
- const httpServer = http.createServer();
420
- await createApp({
421
- mcpServer: this,
422
- httpServer,
423
- errorMiddleware: this.customErrorMiddleware,
424
- });
425
- return this.express;
426
- }
427
- const httpServer = http.createServer();
428
- await createApp({
429
- mcpServer: this,
430
- httpServer,
431
- errorMiddleware: this.customErrorMiddleware,
432
- });
433
- httpServer.on("request", this.express);
434
- const port = parseInt(process.env.__PORT ?? "3000", 10);
435
- await new Promise((resolve, reject) => {
436
- httpServer.on("error", (error) => {
437
- console.error("Failed to start server:", error);
438
- reject(error);
439
- });
440
- httpServer.listen(port, () => {
441
- resolve();
442
- });
443
- });
444
- const { port: boundPort } = httpServer.address();
445
- process.send?.({ type: "skybridge:listening", port: boundPort });
446
- // On workerd, bridge the Node http server to a Workers fetch handler.
447
- // The specifier is held in a variable to sidestep tsc's module resolution
448
- // (`cloudflare:node` only exists under wrangler/workerd).
449
- if (typeof navigator !== "undefined" &&
450
- navigator.userAgent === "Cloudflare-Workers") {
451
- const cloudflareNode = "cloudflare:node";
452
- const { httpServerHandler } = await import(cloudflareNode);
453
- return httpServerHandler({ port: boundPort });
454
- }
455
- const shutdown = () => {
456
- // Drop both handlers so a second signal falls through to Node's default
457
- // (force-quit on a second Ctrl+C while drain is hanging).
458
- process.off("SIGTERM", shutdown);
459
- process.off("SIGINT", shutdown);
460
- httpServer.close(() => process.exit(0));
461
- // Force exit if connections don't drain in time so the port is still
462
- // released promptly (e.g. for nodemon restarts).
463
- setTimeout(() => process.exit(0), 3000).unref();
464
- };
465
- process.on("SIGTERM", shutdown);
466
- process.on("SIGINT", shutdown);
467
- return undefined;
468
294
  }
469
295
  enforceOneToolPerView(component, toolName) {
470
296
  const existingTool = this.claimedViews.get(component);
@@ -473,13 +299,9 @@ export class McpServer extends McpServerBaseOmitted {
473
299
  }
474
300
  this.claimedViews.set(component, toolName);
475
301
  }
476
- resolveViewRequestContext(extra) {
302
+ resolveViewRequestContext(ctx) {
477
303
  const isProduction = process.env.NODE_ENV === "production";
478
- const headers = extra?.requestInfo?.headers || {};
479
- const header = (key) => {
480
- const val = headers[key];
481
- return Array.isArray(val) ? val[0] : val;
482
- };
304
+ const header = (key) => ctx?.http?.req?.headers.get(key) ?? undefined;
483
305
  const isClaude = hostFromUserAgent(header("user-agent")) === "claude";
484
306
  const serverUrl = resolveServerOrigin(header);
485
307
  // Path prefix the proxy routed this request under (e.g. `foo.com/v1`). Read
@@ -495,7 +317,7 @@ export class McpServer extends McpServerBaseOmitted {
495
317
  }
496
318
  let contentMetaOverrides = {};
497
319
  if (isClaude) {
498
- const pathname = extra?.requestInfo?.url?.pathname ?? "";
320
+ const pathname = ctx?.http?.req ? new URL(ctx.http.req.url).pathname : "";
499
321
  const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
500
322
  // Strip a lone trailing slash so the hash matches the connector URL
501
323
  // as registered with Claude (which has no trailing slash on bare origins).
@@ -515,46 +337,26 @@ export class McpServer extends McpServerBaseOmitted {
515
337
  // `tools/list` calls when the bundle hasn't changed.
516
338
  const versionParam = this.computeViewVersionParam(view.component);
517
339
  const viewResource = {
518
- hostType: "mcp-app",
519
340
  uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,
520
341
  mimeType: "text/html;profile=mcp-app",
521
342
  buildContentMeta: ({ resourceDomains, connectDomains, domain, baseUriDomains }, overrides) => {
522
- const defaults = {
523
- ui: {
524
- csp: {
525
- resourceDomains,
526
- connectDomains,
527
- baseUriDomains,
528
- },
529
- domain,
530
- },
531
- };
532
- const fromView = {
343
+ const ui = {
533
344
  ui: {
534
345
  ...(view.description && { description: view.description }),
535
346
  ...(view.prefersBorder !== undefined && {
536
347
  prefersBorder: view.prefersBorder,
537
348
  }),
538
- ...(view.domain && { domain: view.domain }),
349
+ domain: overrides.domain ?? view.domain ?? domain,
539
350
  csp: {
540
- ...(view.csp?.resourceDomains && {
541
- resourceDomains: view.csp.resourceDomains,
542
- }),
543
- ...(view.csp?.connectDomains && {
544
- connectDomains: view.csp.connectDomains,
545
- }),
351
+ resourceDomains: unionOf(resourceDomains, view.csp?.resourceDomains),
352
+ connectDomains: unionOf(connectDomains, view.csp?.connectDomains),
353
+ baseUriDomains: unionOf(baseUriDomains, view.csp?.baseUriDomains),
546
354
  ...(view.csp?.frameDomains && {
547
355
  frameDomains: view.csp.frameDomains,
548
356
  }),
549
- ...(view.csp?.baseUriDomains && {
550
- baseUriDomains: view.csp.baseUriDomains,
551
- }),
552
357
  },
553
358
  },
554
359
  };
555
- const ui = mergeWithUnion(mergeWithUnion(defaults, fromView), {
556
- ui: overrides,
557
- });
558
360
  const base = {
559
361
  ...ui,
560
362
  ...(view.description && {
@@ -580,7 +382,7 @@ export class McpServer extends McpServerBaseOmitted {
580
382
  toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };
581
383
  }
582
384
  registerViewResource({ name, viewResource, view, }) {
583
- const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;
385
+ const { uri: viewUri, mimeType, buildContentMeta } = viewResource;
584
386
  const buildMeta = (extra) => {
585
387
  const { serverUrl, connectDomains, contentMetaOverrides } = this.resolveViewRequestContext(extra);
586
388
  return buildContentMeta({
@@ -602,13 +404,11 @@ export class McpServer extends McpServerBaseOmitted {
602
404
  const viewBase = `${serverUrl}${assetsBasePath}`;
603
405
  const html = isProduction
604
406
  ? templateHelper.renderProduction({
605
- hostType,
606
407
  serverUrl: viewBase,
607
408
  viewFile: this.lookupViewFile(view.component),
608
409
  styleFile: this.lookupDistFile("style.css") ?? "",
609
410
  })
610
411
  : templateHelper.renderDevelopment({
611
- hostType,
612
412
  serverUrl: viewBase,
613
413
  viewName: view.component,
614
414
  });
@@ -626,15 +426,10 @@ export class McpServer extends McpServerBaseOmitted {
626
426
  }
627
427
  decorateToolHandler(cb, { attachViewUUID, securitySchemes, toolName, }) {
628
428
  return async (args, extra) => {
629
- const toolExtra = extra ?? args;
630
429
  if (this.oauthEnabled) {
631
- const failure = evaluateSecuritySchemes(securitySchemes, toolExtra?.authInfo);
430
+ const failure = evaluateSecuritySchemes(securitySchemes, extra.http?.authInfo);
632
431
  if (failure) {
633
- const headers = toolExtra?.requestInfo?.headers ?? {};
634
- const header = (key) => {
635
- const value = headers[key];
636
- return Array.isArray(value) ? value[0] : value;
637
- };
432
+ const header = (key) => extra.http?.req?.headers.get(key) ?? undefined;
638
433
  return inBandChallengeResult(failure, this.resolveResourceMetadataUrl?.(header));
639
434
  }
640
435
  }
@@ -643,7 +438,7 @@ export class McpServer extends McpServerBaseOmitted {
643
438
  result = await cb(args, extra);
644
439
  }
645
440
  catch (error) {
646
- captureToolError(toolExtra, error);
441
+ captureToolError(extra, error);
647
442
  throw error;
648
443
  }
649
444
  warnOnLargeToolOutput(result, toolName);
@@ -706,11 +501,13 @@ export class McpServer extends McpServerBaseOmitted {
706
501
  if (this.viteManifest) {
707
502
  return this.viteManifest;
708
503
  }
709
- return JSON.parse(readFileSync(path.join(process.cwd(), "dist", "assets", ".vite", "manifest.json"), "utf-8"));
504
+ cachedDiskManifest ??= JSON.parse(readFileSync(path.join(process.cwd(), "dist", "assets", ".vite", "manifest.json"), "utf-8"));
505
+ return cachedDiskManifest ?? {};
710
506
  }
711
- registerTool(...args) {
507
+ registerTool(rawConfig, rawCb) {
712
508
  const baseFn = McpServerBase.prototype.registerTool;
713
- const { config, cb } = normalizeRegisterToolArgs(args);
509
+ const config = rawConfig;
510
+ const cb = rawCb;
714
511
  const { name, view, auth, securitySchemes: rawSecuritySchemes, _meta: userToolMeta, ...toolFields } = config;
715
512
  const authNeedsProvider = auth !== undefined &&
716
513
  (!auth.allowsAnonymous || Boolean(auth.scopes?.length));
@@ -722,7 +519,7 @@ export class McpServer extends McpServerBaseOmitted {
722
519
  const securitySchemes = rawSecuritySchemes ??
723
520
  (auth && this.oauthEnabled ? authToSecuritySchemes(auth) : undefined);
724
521
  const toolMeta = { ...userToolMeta };
725
- this.securitySchemesByTool.set(name, securitySchemes);
522
+ this.toolSecuritySchemes.set(name, securitySchemes);
726
523
  if (securitySchemes) {
727
524
  // SEP-1488 puts `securitySchemes` at the top level of the tool
728
525
  // descriptor, but the SDK's `registerTool` drops unknown top-level
@@ -740,7 +537,9 @@ export class McpServer extends McpServerBaseOmitted {
740
537
  securitySchemes,
741
538
  toolName: name,
742
539
  });
743
- baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);
540
+ baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, toolFields.inputSchema === undefined
541
+ ? (extra) => wrappedCb({}, extra)
542
+ : wrappedCb);
744
543
  return this;
745
544
  }
746
545
  }