skybridge 0.0.0-dev.e12ca4a → 0.0.0-dev.e14a1e8

package/dist/cli/build-helpers.d.ts

@@ -1,3 +1,7 @@
 export declare const ENTRY_WRAPPER_CONTENT = "import { __setBuildManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\n\n__setBuildManifest(manifest);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n";
 export declare function emitEntryWrapper(distDir: string): void;
 export declare function emitManifestModule(manifestPath: string, outPath: string): void;
+export declare const VERCEL_FUNCTION_NAME = "mcp";
+export declare const VERCEL_CONFIG: unknown;
+export declare const VERCEL_VC_CONFIG: unknown;
+export declare function emitVercelBuildOutput(root: string): Promise<void>;

package/dist/cli/build-helpers.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync } from "node:fs";
+import { cpSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import path from "node:path";
 // Primes the manifest in skybridge's module scope, then dynamically imports
 // `./server.js` so user code runs *after* the side channel is set. The
@@ -20,4 +20,63 @@ export function emitManifestModule(manifestPath, outPath) {
     const manifest = readFileSync(manifestPath, "utf-8");
     writeFileSync(outPath, `export default ${manifest};\n`);
 }
+export const VERCEL_FUNCTION_NAME = "mcp";
+export const VERCEL_CONFIG = {
+    version: 3,
+    routes: [
+        {
+            src: "/assets/(.*)",
+            headers: { "Access-Control-Allow-Origin": "*" },
+            continue: true,
+        },
+        { handle: "filesystem" },
+        { src: "/(.*)", dest: `/${VERCEL_FUNCTION_NAME}` },
+    ],
+};
+export const VERCEL_VC_CONFIG = {
+    runtime: "nodejs22.x",
+    handler: "index.js",
+    launcherType: "Nodejs",
+    shouldAddHelpers: true,
+};
+// Emit a Build Output API tree under `.vercel/output/`. Bundling the server
+// with esbuild produces a self-contained function bundle, so we don't ship
+// `node_modules` and don't touch tracked paths like `api/` or `public/`.
+//
+// Entry is `dist/__entry.js` — the wrapper that primes the Vite manifest via
+// `__setBuildManifest` before importing user code. Bundling `dist/server.js`
+// directly would skip that priming and 500 on view resource reads when the
+// function falls back to `readFileSync('dist/assets/.vite/manifest.json')`
+// (Vercel functions don't ship `dist/`).
+export async function emitVercelBuildOutput(root) {
+    const outputDir = path.join(root, ".vercel", "output");
+    const funcDir = path.join(outputDir, "functions", `${VERCEL_FUNCTION_NAME}.func`);
+    const staticAssetsDir = path.join(outputDir, "static", "assets");
+    rmSync(outputDir, { recursive: true, force: true });
+    mkdirSync(funcDir, { recursive: true });
+    const { build } = await import("esbuild");
+    await build({
+        entryPoints: [path.join(root, "dist", "__entry.js")],
+        bundle: true,
+        platform: "node",
+        target: "node22",
+        format: "esm",
+        outfile: path.join(funcDir, "index.js"),
+        // Lets esbuild DCE dev-only branches that pull in vite/devtools.
+        define: { "process.env.NODE_ENV": '"production"' },
+        // Dev-only deps reachable from re-exports; safe to leave unresolved since
+        // the code paths that touch them are eliminated by the NODE_ENV define.
+        external: ["vite", "@skybridge/devtools"],
+        banner: {
+            // ESM bundles miss CJS interop globals that some deps reach for.
+            js: "import{createRequire}from'node:module';const require=createRequire(import.meta.url);",
+        },
+    });
+    writeFileSync(path.join(funcDir, ".vc-config.json"), `${JSON.stringify(VERCEL_VC_CONFIG, null, 2)}\n`);
+    writeFileSync(path.join(funcDir, "package.json"), `${JSON.stringify({ type: "module" }, null, 2)}\n`);
+    cpSync(path.join(root, "dist", "assets"), staticAssetsDir, {
+        recursive: true,
+    });
+    writeFileSync(path.join(outputDir, "config.json"), `${JSON.stringify(VERCEL_CONFIG, null, 2)}\n`);
+}
 //# sourceMappingURL=build-helpers.js.map

package/dist/cli/build-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-helpers.js","sourceRoot":"","sources":["../../src/cli/build-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,oCAAoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;CAOpC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAe;IAEf,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,OAAO,EAAE,kBAAkB,QAAQ,KAAK,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["import { readFileSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\n\n// Primes the manifest in skybridge's module scope, then dynamically imports\n// `./server.js` so user code runs *after* the side channel is set. The\n// dynamic import is load-bearing: a static `export { default } from ...` is\n// hoisted with the rest of the static graph and would evaluate `server.js`\n// before `__setBuildManifest` runs.\nexport const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\n\n__setBuildManifest(manifest);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n`;\n\nexport function emitEntryWrapper(distDir: string): void {\n  writeFileSync(path.join(distDir, \"__entry.js\"), ENTRY_WRAPPER_CONTENT);\n}\n\nexport function emitManifestModule(\n  manifestPath: string,\n  outPath: string,\n): void {\n  const manifest = readFileSync(manifestPath, \"utf-8\");\n  writeFileSync(outPath, `export default ${manifest};\\n`);\n}\n"]}
+{"version":3,"file":"build-helpers.js","sourceRoot":"","sources":["../../src/cli/build-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,oCAAoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;CAOpC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAe;IAEf,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,OAAO,EAAE,kBAAkB,QAAQ,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,OAAO,EAAE,CAAC;IACV,MAAM,EAAE;QACN;YACE,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE;YAC/C,QAAQ,EAAE,IAAI;SACf;QACD,EAAE,MAAM,EAAE,YAAY,EAAE;QACxB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,oBAAoB,EAAE,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,UAAU;IACnB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,SAAS,EACT,WAAW,EACX,GAAG,oBAAoB,OAAO,CAC/B,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;QACvC,iEAAiE;QACjE,MAAM,EAAE,EAAE,sBAAsB,EAAE,cAAc,EAAE;QAClD,0EAA0E;QAC1E,wEAAwE;QACxE,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACzC,MAAM,EAAE;YACN,iEAAiE;YACjE,EAAE,EAAE,sFAAsF;SAC3F;KACF,CAAC,CAAC;IAEH,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC;IACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,EAAE;QACzD,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EACnC,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  cpSync,\n  mkdirSync,\n  readFileSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport path from \"node:path\";\n\n// Primes the manifest in skybridge's module scope, then dynamically imports\n// `./server.js` so user code runs *after* the side channel is set. The\n// dynamic import is load-bearing: a static `export { default } from ...` is\n// hoisted with the rest of the static graph and would evaluate `server.js`\n// before `__setBuildManifest` runs.\nexport const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\n\n__setBuildManifest(manifest);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n`;\n\nexport function emitEntryWrapper(distDir: string): void {\n  writeFileSync(path.join(distDir, \"__entry.js\"), ENTRY_WRAPPER_CONTENT);\n}\n\nexport function emitManifestModule(\n  manifestPath: string,\n  outPath: string,\n): void {\n  const manifest = readFileSync(manifestPath, \"utf-8\");\n  writeFileSync(outPath, `export default ${manifest};\\n`);\n}\n\nexport const VERCEL_FUNCTION_NAME = \"mcp\";\n\nexport const VERCEL_CONFIG: unknown = {\n  version: 3,\n  routes: [\n    {\n      src: \"/assets/(.*)\",\n      headers: { \"Access-Control-Allow-Origin\": \"*\" },\n      continue: true,\n    },\n    { handle: \"filesystem\" },\n    { src: \"/(.*)\", dest: `/${VERCEL_FUNCTION_NAME}` },\n  ],\n};\n\nexport const VERCEL_VC_CONFIG: unknown = {\n  runtime: \"nodejs22.x\",\n  handler: \"index.js\",\n  launcherType: \"Nodejs\",\n  shouldAddHelpers: true,\n};\n\n// Emit a Build Output API tree under `.vercel/output/`. Bundling the server\n// with esbuild produces a self-contained function bundle, so we don't ship\n// `node_modules` and don't touch tracked paths like `api/` or `public/`.\n//\n// Entry is `dist/__entry.js` — the wrapper that primes the Vite manifest via\n// `__setBuildManifest` before importing user code. Bundling `dist/server.js`\n// directly would skip that priming and 500 on view resource reads when the\n// function falls back to `readFileSync('dist/assets/.vite/manifest.json')`\n// (Vercel functions don't ship `dist/`).\nexport async function emitVercelBuildOutput(root: string): Promise<void> {\n  const outputDir = path.join(root, \".vercel\", \"output\");\n  const funcDir = path.join(\n    outputDir,\n    \"functions\",\n    `${VERCEL_FUNCTION_NAME}.func`,\n  );\n  const staticAssetsDir = path.join(outputDir, \"static\", \"assets\");\n\n  rmSync(outputDir, { recursive: true, force: true });\n  mkdirSync(funcDir, { recursive: true });\n\n  const { build } = await import(\"esbuild\");\n  await build({\n    entryPoints: [path.join(root, \"dist\", \"__entry.js\")],\n    bundle: true,\n    platform: \"node\",\n    target: \"node22\",\n    format: \"esm\",\n    outfile: path.join(funcDir, \"index.js\"),\n    // Lets esbuild DCE dev-only branches that pull in vite/devtools.\n    define: { \"process.env.NODE_ENV\": '\"production\"' },\n    // Dev-only deps reachable from re-exports; safe to leave unresolved since\n    // the code paths that touch them are eliminated by the NODE_ENV define.\n    external: [\"vite\", \"@skybridge/devtools\"],\n    banner: {\n      // ESM bundles miss CJS interop globals that some deps reach for.\n      js: \"import{createRequire}from'node:module';const require=createRequire(import.meta.url);\",\n    },\n  });\n\n  writeFileSync(\n    path.join(funcDir, \".vc-config.json\"),\n    `${JSON.stringify(VERCEL_VC_CONFIG, null, 2)}\\n`,\n  );\n  writeFileSync(\n    path.join(funcDir, \"package.json\"),\n    `${JSON.stringify({ type: \"module\" }, null, 2)}\\n`,\n  );\n\n  cpSync(path.join(root, \"dist\", \"assets\"), staticAssetsDir, {\n    recursive: true,\n  });\n\n  writeFileSync(\n    path.join(outputDir, \"config.json\"),\n    `${JSON.stringify(VERCEL_CONFIG, null, 2)}\\n`,\n  );\n}\n"]}

package/dist/cli/build-helpers.test.js

@@ -1,8 +1,10 @@
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+// @vitest-environment node
+// esbuild's invariant check on TextEncoder/Uint8Array trips jsdom's polyfill.
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { ENTRY_WRAPPER_CONTENT, emitEntryWrapper, emitManifestModule, } from "./build-helpers.js";
+import { ENTRY_WRAPPER_CONTENT, emitEntryWrapper, emitManifestModule, emitVercelBuildOutput, VERCEL_CONFIG, VERCEL_VC_CONFIG, } from "./build-helpers.js";
 function mkTmp(prefix = "skybridge-build-helpers-") {
     return mkdtempSync(path.join(tmpdir(), prefix));
 }
@@ -22,15 +24,41 @@ describe("emitEntryWrapper", () => {
     });
 });
 describe("emitManifestModule", () => {
-    it("wraps the manifest JSON as an ESM default export", () => {
+    it("inlines the JSON manifest as an ESM default export", () => {
         const dir = mkTmp();
-        const manifestPath = path.join(dir, "manifest.json");
+        const inPath = path.join(dir, "manifest.json");
         const outPath = path.join(dir, "vite-manifest.js");
-        const manifest = '{\n  "index.tsx": { "file": "assets/index-abc.js" }\n}';
-        writeFileSync(manifestPath, manifest);
-        emitManifestModule(manifestPath, outPath);
+        const manifest = { "src/views/foo.tsx": { file: "assets/foo-abc.js" } };
+        writeFileSync(inPath, JSON.stringify(manifest));
+        emitManifestModule(inPath, outPath);
         const out = readFileSync(outPath, "utf-8");
-        expect(out).toBe(`export default ${manifest};\n`);
+        expect(out.startsWith("export default ")).toBe(true);
+        const literal = out
+            .slice("export default ".length)
+            .trim()
+            .replace(/;$/, "");
+        expect(JSON.parse(literal)).toEqual(manifest);
+    });
+});
+describe("emitVercelBuildOutput", () => {
+    it("emits a Build Output API tree with bundled function and static assets", async () => {
+        const root = mkTmp();
+        mkdirSync(path.join(root, "dist", "assets"), { recursive: true });
+        writeFileSync(path.join(root, "dist", "server.js"), "export default function handler(_req, res) { res.end('ok'); }\n");
+        // Minimal `dist/__entry.js` (the real wrapper imports `skybridge/server`,
+        // which isn't resolvable in this test's tmp dir — the function-bundling
+        // contract we care about here is just "bundle whatever `__entry.js`
+        // imports into a single function file").
+        writeFileSync(path.join(root, "dist", "__entry.js"), "const userMod = await import('./server.js');\nexport default userMod.default;\n");
+        writeFileSync(path.join(root, "dist", "assets", "view-abc.js"), "/* bundled view */\n");
+        await emitVercelBuildOutput(root);
+        const outputDir = path.join(root, ".vercel", "output");
+        const funcDir = path.join(outputDir, "functions", "mcp.func");
+        expect(existsSync(path.join(funcDir, "index.js"))).toBe(true);
+        expect(JSON.parse(readFileSync(path.join(funcDir, ".vc-config.json"), "utf-8"))).toEqual(VERCEL_VC_CONFIG);
+        expect(JSON.parse(readFileSync(path.join(funcDir, "package.json"), "utf-8"))).toEqual({ type: "module" });
+        expect(JSON.parse(readFileSync(path.join(outputDir, "config.json"), "utf-8"))).toEqual(VERCEL_CONFIG);
+        expect(readFileSync(path.join(outputDir, "static", "assets", "view-abc.js"), "utf-8")).toContain("bundled view");
     });
 });
 //# sourceMappingURL=build-helpers.test.js.map

package/dist/cli/build-helpers.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-helpers.test.js","sourceRoot":"","sources":["../../src/cli/build-helpers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,KAAK,CAAC,MAAM,GAAG,0BAA0B;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,uDAAuD,CACxD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,wDAAwD,CAAC;QAC1E,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEtC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,QAAQ,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { mkdtempSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { describe, expect, it } from \"vitest\";\nimport {\n  ENTRY_WRAPPER_CONTENT,\n  emitEntryWrapper,\n  emitManifestModule,\n} from \"./build-helpers.js\";\n\nfunction mkTmp(prefix = \"skybridge-build-helpers-\") {\n  return mkdtempSync(path.join(tmpdir(), prefix));\n}\n\ndescribe(\"emitEntryWrapper\", () => {\n  it(\"writes dist/__entry.js that primes the manifest before importing user code\", () => {\n    const dir = mkTmp();\n    emitEntryWrapper(dir);\n    const out = readFileSync(path.join(dir, \"__entry.js\"), \"utf-8\");\n    expect(out).toBe(ENTRY_WRAPPER_CONTENT);\n    expect(out).toContain(\n      'import { __setBuildManifest } from \"skybridge/server\"',\n    );\n    expect(out).toContain('import manifest from \"./vite-manifest.js\"');\n    expect(out).toContain(\"__setBuildManifest(manifest)\");\n    // Dynamic import is load-bearing: `server.js` must evaluate after the\n    // setter runs, so a static re-export wouldn't work.\n    expect(out).toContain('await import(\"./server.js\")');\n    expect(out).toContain(\"export default userMod.default\");\n  });\n});\n\ndescribe(\"emitManifestModule\", () => {\n  it(\"wraps the manifest JSON as an ESM default export\", () => {\n    const dir = mkTmp();\n    const manifestPath = path.join(dir, \"manifest.json\");\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    const manifest = '{\\n  \"index.tsx\": { \"file\": \"assets/index-abc.js\" }\\n}';\n    writeFileSync(manifestPath, manifest);\n\n    emitManifestModule(manifestPath, outPath);\n\n    const out = readFileSync(outPath, \"utf-8\");\n    expect(out).toBe(`export default ${manifest};\\n`);\n  });\n});\n"]}
+{"version":3,"file":"build-helpers.test.js","sourceRoot":"","sources":["../../src/cli/build-helpers.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,KAAK,CAAC,MAAM,GAAG,0BAA0B;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,uDAAuD,CACxD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACxE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;aAC/B,IAAI,EAAE;aACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EACpC,iEAAiE,CAClE,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yCAAyC;QACzC,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EACrC,iFAAiF,CAClF,CAAC;QACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAChD,sBAAsB,CACvB,CAAC;QAEF,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CACzE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzB,MAAM,CACJ,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,EACvD,OAAO,CACR,CACF,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\n// esbuild's invariant check on TextEncoder/Uint8Array trips jsdom's polyfill.\nimport {\n  existsSync,\n  mkdirSync,\n  mkdtempSync,\n  readFileSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { describe, expect, it } from \"vitest\";\nimport {\n  ENTRY_WRAPPER_CONTENT,\n  emitEntryWrapper,\n  emitManifestModule,\n  emitVercelBuildOutput,\n  VERCEL_CONFIG,\n  VERCEL_VC_CONFIG,\n} from \"./build-helpers.js\";\n\nfunction mkTmp(prefix = \"skybridge-build-helpers-\") {\n  return mkdtempSync(path.join(tmpdir(), prefix));\n}\n\ndescribe(\"emitEntryWrapper\", () => {\n  it(\"writes dist/__entry.js that primes the manifest before importing user code\", () => {\n    const dir = mkTmp();\n    emitEntryWrapper(dir);\n    const out = readFileSync(path.join(dir, \"__entry.js\"), \"utf-8\");\n    expect(out).toBe(ENTRY_WRAPPER_CONTENT);\n    expect(out).toContain(\n      'import { __setBuildManifest } from \"skybridge/server\"',\n    );\n    expect(out).toContain('import manifest from \"./vite-manifest.js\"');\n    expect(out).toContain(\"__setBuildManifest(manifest)\");\n    // Dynamic import is load-bearing: `server.js` must evaluate after the\n    // setter runs, so a static re-export wouldn't work.\n    expect(out).toContain('await import(\"./server.js\")');\n    expect(out).toContain(\"export default userMod.default\");\n  });\n});\n\ndescribe(\"emitManifestModule\", () => {\n  it(\"inlines the JSON manifest as an ESM default export\", () => {\n    const dir = mkTmp();\n    const inPath = path.join(dir, \"manifest.json\");\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    const manifest = { \"src/views/foo.tsx\": { file: \"assets/foo-abc.js\" } };\n    writeFileSync(inPath, JSON.stringify(manifest));\n    emitManifestModule(inPath, outPath);\n    const out = readFileSync(outPath, \"utf-8\");\n    expect(out.startsWith(\"export default \")).toBe(true);\n    const literal = out\n      .slice(\"export default \".length)\n      .trim()\n      .replace(/;$/, \"\");\n    expect(JSON.parse(literal)).toEqual(manifest);\n  });\n});\n\ndescribe(\"emitVercelBuildOutput\", () => {\n  it(\"emits a Build Output API tree with bundled function and static assets\", async () => {\n    const root = mkTmp();\n    mkdirSync(path.join(root, \"dist\", \"assets\"), { recursive: true });\n    writeFileSync(\n      path.join(root, \"dist\", \"server.js\"),\n      \"export default function handler(_req, res) { res.end('ok'); }\\n\",\n    );\n    // Minimal `dist/__entry.js` (the real wrapper imports `skybridge/server`,\n    // which isn't resolvable in this test's tmp dir — the function-bundling\n    // contract we care about here is just \"bundle whatever `__entry.js`\n    // imports into a single function file\").\n    writeFileSync(\n      path.join(root, \"dist\", \"__entry.js\"),\n      \"const userMod = await import('./server.js');\\nexport default userMod.default;\\n\",\n    );\n    writeFileSync(\n      path.join(root, \"dist\", \"assets\", \"view-abc.js\"),\n      \"/* bundled view */\\n\",\n    );\n\n    await emitVercelBuildOutput(root);\n\n    const outputDir = path.join(root, \".vercel\", \"output\");\n    const funcDir = path.join(outputDir, \"functions\", \"mcp.func\");\n\n    expect(existsSync(path.join(funcDir, \"index.js\"))).toBe(true);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \".vc-config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_VC_CONFIG);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \"package.json\"), \"utf-8\")),\n    ).toEqual({ type: \"module\" });\n    expect(\n      JSON.parse(readFileSync(path.join(outputDir, \"config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_CONFIG);\n    expect(\n      readFileSync(\n        path.join(outputDir, \"static\", \"assets\", \"view-abc.js\"),\n        \"utf-8\",\n      ),\n    ).toContain(\"bundled view\");\n  });\n});\n"]}

package/dist/cli/detect-port.d.ts

@@ -8,8 +8,8 @@ export declare function resolvePort(flagPort?: number): Promise<{
     envWarning: string;
 }>;
 /**
- * Returns the given port if available, otherwise lets the OS
- * pick a free port via `listen(0)`.
+ * Returns the first available port at or after `startPort`, incrementing
+ * by one until a free port is found or `MAX_PORT_INCREMENT` is reached.
  *
  * @param host - Bind address for the check. Pass `"localhost"` for
  *   services that bind to 127.0.0.1 (e.g. Vite HMR). Omit for

package/dist/cli/detect-port.js

@@ -1,5 +1,6 @@
 import net from "node:net";
 const DEFAULT_PORT = 3000;
+const MAX_PORT_INCREMENT = 100;
 export async function resolvePort(flagPort) {
     if (flagPort && flagPort > 1) {
         return { port: flagPort, fallback: false };
@@ -20,33 +21,21 @@ export async function resolvePort(flagPort) {
     return { port, fallback: port !== DEFAULT_PORT };
 }
 /**
- * Returns the given port if available, otherwise lets the OS
- * pick a free port via `listen(0)`.
+ * Returns the first available port at or after `startPort`, incrementing
+ * by one until a free port is found or `MAX_PORT_INCREMENT` is reached.
  *
  * @param host - Bind address for the check. Pass `"localhost"` for
  *   services that bind to 127.0.0.1 (e.g. Vite HMR). Omit for
  *   services that bind to all interfaces (e.g. the HTTP server).
  */
 export async function detectAvailablePort(startPort, host) {
-    const available = await isPortAvailable(startPort, host);
-    if (available) {
-        return startPort;
+    for (let port = startPort; port < startPort + MAX_PORT_INCREMENT; port++) {
+        if (await isPortAvailable(port, host)) {
+            return port;
+        }
+        console.log(`Port ${port} is in use, trying another one...`);
     }
-    return new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.once("error", reject);
-        server.once("listening", () => {
-            const addr = server.address();
-            if (addr && typeof addr === "object") {
-                const { port } = addr;
-                server.close(() => resolve(port));
-            }
-            else {
-                server.close(() => reject(new Error("Failed to detect available port")));
-            }
-        });
-        server.listen(0, host);
-    });
+    throw new Error(`No available port found between ${startPort} and ${startPort + MAX_PORT_INCREMENT - 1}`);
 }
 function isPortAvailable(port, host) {
     return new Promise((resolve) => {

package/dist/cli/detect-port.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect-port.js","sourceRoot":"","sources":["../../src/cli/detect-port.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM,mBAAmB,CAAC,YAAY,CAAC;YAC7C,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,iBAAiB,MAAM,+BAA+B;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAAa;IAEb,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CACrD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAa;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import net from \"node:net\";\n\nconst DEFAULT_PORT = 3000;\n\nexport async function resolvePort(flagPort?: number) {\n  if (flagPort && flagPort > 1) {\n    return { port: flagPort, fallback: false };\n  }\n\n  const rawEnv = process.env.PORT;\n  if (rawEnv) {\n    const parsed = Number(rawEnv);\n    if (Number.isInteger(parsed) && parsed > 0) {\n      return { port: parsed, fallback: false };\n    }\n    return {\n      port: await detectAvailablePort(DEFAULT_PORT),\n      fallback: false,\n      envWarning: `Invalid PORT=\"${rawEnv}\", ignoring and using default`,\n    };\n  }\n\n  const port = await detectAvailablePort(DEFAULT_PORT);\n  return { port, fallback: port !== DEFAULT_PORT };\n}\n\n/**\n * Returns the given port if available, otherwise lets the OS\n * pick a free port via `listen(0)`.\n *\n * @param host - Bind address for the check. Pass `\"localhost\"` for\n *   services that bind to 127.0.0.1 (e.g. Vite HMR). Omit for\n *   services that bind to all interfaces (e.g. the HTTP server).\n */\nexport async function detectAvailablePort(\n  startPort: number,\n  host?: string,\n): Promise<number> {\n  const available = await isPortAvailable(startPort, host);\n  if (available) {\n    return startPort;\n  }\n\n  return new Promise((resolve, reject) => {\n    const server = net.createServer();\n\n    server.once(\"error\", reject);\n    server.once(\"listening\", () => {\n      const addr = server.address();\n      if (addr && typeof addr === \"object\") {\n        const { port } = addr;\n        server.close(() => resolve(port));\n      } else {\n        server.close(() =>\n          reject(new Error(\"Failed to detect available port\")),\n        );\n      }\n    });\n\n    server.listen(0, host);\n  });\n}\n\nfunction isPortAvailable(port: number, host?: string): Promise<boolean> {\n  return new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once(\"error\", () => resolve(false));\n    server.once(\"listening\", () => {\n      server.close(() => resolve(true));\n    });\n\n    server.listen(port, host);\n  });\n}\n"]}
+{"version":3,"file":"detect-port.js","sourceRoot":"","sources":["../../src/cli/detect-port.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM,mBAAmB,CAAC,YAAY,CAAC;YAC7C,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,iBAAiB,MAAM,+BAA+B;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAAa;IAEb,KAAK,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,QAAQ,SAAS,GAAG,kBAAkB,GAAG,CAAC,EAAE,CACzF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAa;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import net from \"node:net\";\n\nconst DEFAULT_PORT = 3000;\nconst MAX_PORT_INCREMENT = 100;\n\nexport async function resolvePort(flagPort?: number) {\n  if (flagPort && flagPort > 1) {\n    return { port: flagPort, fallback: false };\n  }\n\n  const rawEnv = process.env.PORT;\n  if (rawEnv) {\n    const parsed = Number(rawEnv);\n    if (Number.isInteger(parsed) && parsed > 0) {\n      return { port: parsed, fallback: false };\n    }\n    return {\n      port: await detectAvailablePort(DEFAULT_PORT),\n      fallback: false,\n      envWarning: `Invalid PORT=\"${rawEnv}\", ignoring and using default`,\n    };\n  }\n\n  const port = await detectAvailablePort(DEFAULT_PORT);\n  return { port, fallback: port !== DEFAULT_PORT };\n}\n\n/**\n * Returns the first available port at or after `startPort`, incrementing\n * by one until a free port is found or `MAX_PORT_INCREMENT` is reached.\n *\n * @param host - Bind address for the check. Pass `\"localhost\"` for\n *   services that bind to 127.0.0.1 (e.g. Vite HMR). Omit for\n *   services that bind to all interfaces (e.g. the HTTP server).\n */\nexport async function detectAvailablePort(\n  startPort: number,\n  host?: string,\n): Promise<number> {\n  for (let port = startPort; port < startPort + MAX_PORT_INCREMENT; port++) {\n    if (await isPortAvailable(port, host)) {\n      return port;\n    }\n    console.log(`Port ${port} is in use, trying another one...`);\n  }\n  throw new Error(\n    `No available port found between ${startPort} and ${startPort + MAX_PORT_INCREMENT - 1}`,\n  );\n}\n\nfunction isPortAvailable(port: number, host?: string): Promise<boolean> {\n  return new Promise((resolve) => {\n    const server = net.createServer();\n\n    server.once(\"error\", () => resolve(false));\n    server.once(\"listening\", () => {\n      server.close(() => resolve(true));\n    });\n\n    server.listen(port, host);\n  });\n}\n"]}

package/dist/commands/build.d.ts

@@ -4,6 +4,5 @@ export declare const commandSteps: CommandStep[];
 export default class Build extends Command {
     static description: string;
     static examples: string[];
-    static flags: {};
     run(): Promise<void>;
 }

package/dist/commands/build.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { Command } from "@oclif/core";
 import { Box, render, Text } from "ink";
 import { useEffect } from "react";
-import { emitEntryWrapper, emitManifestModule } from "../cli/build-helpers.js";
+import { emitEntryWrapper, emitManifestModule, emitVercelBuildOutput, } from "../cli/build-helpers.js";
 import { Header } from "../cli/header.js";
 import { resolveViewsDir } from "../cli/resolve-views-dir.js";
 import { useExecuteSteps } from "../cli/use-execute-steps.js";
@@ -39,18 +39,15 @@ export const commandSteps = [
     },
     {
         label: "Emitting entry wrapper",
-        // dist/__entry.js wires manifest + run() so the user's src/server.ts only
-        // needs to export the McpServer instance. Deploy targets point here.
+        // dist/__entry.js primes the Vite manifest via __setBuildManifest, then
+        // dynamically imports user code. Deploy targets (Cloudflare, Vercel)
+        // bundle from here so the manifest is available at runtime.
         run: () => {
             emitEntryWrapper(path.join(process.cwd(), "dist"));
         },
     },
     {
         label: "Emitting Cloudflare redirects",
-        // Cloudflare's `assets.directory` maps URL → file literally — no
-        // mount-strip like `app.use("/assets", express.static(...))`. Rewrite
-        // `/assets/assets/*` to `/assets/*` before lookup; status 200 =
-        // server-side rewrite, not HTTP redirect.
         run: () => {
             const root = process.cwd();
             writeFileSync(path.join(root, "dist", "assets", "_redirects"), "/assets/assets/* /assets/:splat 200\n");
@@ -58,19 +55,19 @@ export const commandSteps = [
     },
     {
         label: "Emitting Cloudflare headers",
-        // Cloudflare's static asset handler bypasses the worker entirely, so
-        // `app.use("/assets", cors())` never fires for asset requests. Attach
-        // CORS at the edge so cross-origin view iframes can load JS/CSS.
         run: () => {
             const root = process.cwd();
             writeFileSync(path.join(root, "dist", "assets", "_headers"), "/assets/*\n  Access-Control-Allow-Origin: *\n");
         },
     },
+    {
+        label: "Emitting Vercel build output",
+        run: () => emitVercelBuildOutput(process.cwd()),
+    },
 ];
 export default class Build extends Command {
     static description = "Build the views and MCP server";
     static examples = ["skybridge build"];
-    static flags = {};
     async run() {
         const App = () => {
             const { currentStep, status, error, execute } = useExecuteSteps(commandSteps);

package/dist/commands/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/commands/build.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC;QACE,KAAK,EAAE,gBAAgB;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,YAAY;KACtB;IACD;QACE,KAAK,EAAE,0BAA0B;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,kBAAkB,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAC5C,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,0EAA0E;QAC1E,qEAAqE;QACrE,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;KACF;IACD;QACE,KAAK,EAAE,+BAA+B;QACtC,iEAAiE;QACjE,sEAAsE;QACtE,gEAAgE;QAChE,0CAA0C;QAC1C,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,EAC/C,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,6BAA6B;QACpC,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7C,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,MAAM,CAAU,WAAW,GAAG,gCAAgC,CAAC;IAC/D,MAAM,CAAU,QAAQ,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAU,KAAK,GAAG,EAAE,CAAC;IAEpB,KAAK,CAAC,GAAG;QACd,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAC3C,eAAe,CAAC,YAAY,CAAC,CAAC;YAEhC,SAAS,CAAC,GAAG,EAAE;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEd,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,aACpC,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,YAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,sDAAmC,GAC/C,EAER,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBAChC,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,CAAC;wBAE5D,OAAO,CACL,KAAC,GAAG,IAAkB,YAAY,EAAE,CAAC,YACnC,MAAC,IAAI,IAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAC1D,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAC9D,IAAI,CAAC,KAAK,IACN,IAJC,IAAI,CAAC,KAAK,CAKd,CACP,CAAC;oBACJ,CAAC,CAAC,EAED,MAAM,KAAK,SAAS,IAAI,CACvB,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,2DAEjB,GACH,CACP,EAEA,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,CAC9B,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,0CAEf,EACP,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/B,KAAC,IAAI,IAAY,KAAK,EAAC,KAAK,YACzB,IAAI,IADI,IAAI,CAER,CACR,CAAC,GACE,IACF,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE;YACd,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { Command } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { useEffect } from \"react\";\nimport { emitEntryWrapper, emitManifestModule } from \"../cli/build-helpers.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { type CommandStep, useExecuteSteps } from \"../cli/use-execute-steps.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport const commandSteps: CommandStep[] = [\n  {\n    label: \"Scanning views\",\n    run: async () => {\n      const root = process.cwd();\n      const viewsDir = await resolveViewsDir(root);\n      scanAndWriteViewsDts(root, viewsDir);\n    },\n  },\n  {\n    label: \"Compiling server\",\n    run: () => rmSync(\"dist\", { recursive: true, force: true }),\n    command: \"tsc -b --force\",\n  },\n  {\n    label: \"Building views\",\n    command: \"vite build\",\n  },\n  {\n    label: \"Emitting manifest module\",\n    // Inline the Vite manifest as a JS module so the wrapper can `import` it\n    // instead of `readFileSync(process.cwd() + ...)` at runtime — required for\n    // workerd, where neither cwd nor the assets directory is readable.\n    run: () => {\n      const root = process.cwd();\n      emitManifestModule(\n        path.join(root, \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        path.join(root, \"dist\", \"vite-manifest.js\"),\n      );\n    },\n  },\n  {\n    label: \"Emitting entry wrapper\",\n    // dist/__entry.js wires manifest + run() so the user's src/server.ts only\n    // needs to export the McpServer instance. Deploy targets point here.\n    run: () => {\n      emitEntryWrapper(path.join(process.cwd(), \"dist\"));\n    },\n  },\n  {\n    label: \"Emitting Cloudflare redirects\",\n    // Cloudflare's `assets.directory` maps URL → file literally — no\n    // mount-strip like `app.use(\"/assets\", express.static(...))`. Rewrite\n    // `/assets/assets/*` to `/assets/*` before lookup; status 200 =\n    // server-side rewrite, not HTTP redirect.\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_redirects\"),\n        \"/assets/assets/* /assets/:splat 200\\n\",\n      );\n    },\n  },\n  {\n    label: \"Emitting Cloudflare headers\",\n    // Cloudflare's static asset handler bypasses the worker entirely, so\n    // `app.use(\"/assets\", cors())` never fires for asset requests. Attach\n    // CORS at the edge so cross-origin view iframes can load JS/CSS.\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_headers\"),\n        \"/assets/*\\n  Access-Control-Allow-Origin: *\\n\",\n      );\n    },\n  },\n];\n\nexport default class Build extends Command {\n  static override description = \"Build the views and MCP server\";\n  static override examples = [\"skybridge build\"];\n  static override flags = {};\n\n  public async run(): Promise<void> {\n    const App = () => {\n      const { currentStep, status, error, execute } =\n        useExecuteSteps(commandSteps);\n\n      useEffect(() => {\n        execute();\n      }, [execute]);\n\n      return (\n        <Box flexDirection=\"column\" padding={1}>\n          <Header version={this.config.version}>\n            <Text color=\"green\"> → building for production…</Text>\n          </Header>\n\n          {commandSteps.map((step, index) => {\n            const isCurrent = index === currentStep && status === \"running\";\n            const isCompleted = index < currentStep || status === \"success\";\n            const isError = status === \"error\" && index === currentStep;\n\n            return (\n              <Box key={step.label} marginBottom={0}>\n                <Text color={isError ? \"red\" : isCompleted ? \"green\" : \"grey\"}>\n                  {isError ? \"✗\" : isCompleted ? \"✓\" : isCurrent ? \"⟳\" : \"○\"}{\" \"}\n                  {step.label}\n                </Text>\n              </Box>\n            );\n          })}\n\n          {status === \"success\" && (\n            <Box marginTop={1}>\n              <Text color=\"green\" bold>\n                ✓ Build completed successfully!\n              </Text>\n            </Box>\n          )}\n\n          {status === \"error\" && error && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ✗ Build failed\n              </Text>\n              <Box marginTop={1} flexDirection=\"column\">\n                {error.split(\"\\n\").map((line) => (\n                  <Text key={line} color=\"red\">\n                    {line}\n                  </Text>\n                ))}\n              </Box>\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    render(<App />, {\n      exitOnCtrlC: true,\n      patchConsole: false,\n    });\n  }\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/commands/build.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC;QACE,KAAK,EAAE,gBAAgB;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,YAAY;KACtB;IACD;QACE,KAAK,EAAE,0BAA0B;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,kBAAkB,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAC5C,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,wEAAwE;QACxE,qEAAqE;QACrE,4DAA4D;QAC5D,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;KACF;IACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,EAC/C,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,6BAA6B;QACpC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7C,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,MAAM,CAAU,WAAW,GAAG,gCAAgC,CAAC;IAC/D,MAAM,CAAU,QAAQ,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAExC,KAAK,CAAC,GAAG;QACd,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAC3C,eAAe,CAAC,YAAY,CAAC,CAAC;YAEhC,SAAS,CAAC,GAAG,EAAE;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEd,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,aACpC,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,YAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,sDAAmC,GAC/C,EAER,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBAChC,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,CAAC;wBAE5D,OAAO,CACL,KAAC,GAAG,IAAkB,YAAY,EAAE,CAAC,YACnC,MAAC,IAAI,IAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAC1D,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAC9D,IAAI,CAAC,KAAK,IACN,IAJC,IAAI,CAAC,KAAK,CAKd,CACP,CAAC;oBACJ,CAAC,CAAC,EAED,MAAM,KAAK,SAAS,IAAI,CACvB,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,2DAEjB,GACH,CACP,EAEA,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,CAC9B,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,0CAEf,EACP,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/B,KAAC,IAAI,IAAY,KAAK,EAAC,KAAK,YACzB,IAAI,IADI,IAAI,CAER,CACR,CAAC,GACE,IACF,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE;YACd,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { Command } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { useEffect } from \"react\";\nimport {\n  emitEntryWrapper,\n  emitManifestModule,\n  emitVercelBuildOutput,\n} from \"../cli/build-helpers.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { type CommandStep, useExecuteSteps } from \"../cli/use-execute-steps.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport const commandSteps: CommandStep[] = [\n  {\n    label: \"Scanning views\",\n    run: async () => {\n      const root = process.cwd();\n      const viewsDir = await resolveViewsDir(root);\n      scanAndWriteViewsDts(root, viewsDir);\n    },\n  },\n  {\n    label: \"Compiling server\",\n    run: () => rmSync(\"dist\", { recursive: true, force: true }),\n    command: \"tsc -b --force\",\n  },\n  {\n    label: \"Building views\",\n    command: \"vite build\",\n  },\n  {\n    label: \"Emitting manifest module\",\n    // Inline the Vite manifest as a JS module so the wrapper can `import` it\n    // instead of `readFileSync(process.cwd() + ...)` at runtime — required for\n    // workerd, where neither cwd nor the assets directory is readable.\n    run: () => {\n      const root = process.cwd();\n      emitManifestModule(\n        path.join(root, \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        path.join(root, \"dist\", \"vite-manifest.js\"),\n      );\n    },\n  },\n  {\n    label: \"Emitting entry wrapper\",\n    // dist/__entry.js primes the Vite manifest via __setBuildManifest, then\n    // dynamically imports user code. Deploy targets (Cloudflare, Vercel)\n    // bundle from here so the manifest is available at runtime.\n    run: () => {\n      emitEntryWrapper(path.join(process.cwd(), \"dist\"));\n    },\n  },\n  {\n    label: \"Emitting Cloudflare redirects\",\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_redirects\"),\n        \"/assets/assets/* /assets/:splat 200\\n\",\n      );\n    },\n  },\n  {\n    label: \"Emitting Cloudflare headers\",\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_headers\"),\n        \"/assets/*\\n  Access-Control-Allow-Origin: *\\n\",\n      );\n    },\n  },\n  {\n    label: \"Emitting Vercel build output\",\n    run: () => emitVercelBuildOutput(process.cwd()),\n  },\n];\n\nexport default class Build extends Command {\n  static override description = \"Build the views and MCP server\";\n  static override examples = [\"skybridge build\"];\n\n  public async run(): Promise<void> {\n    const App = () => {\n      const { currentStep, status, error, execute } =\n        useExecuteSteps(commandSteps);\n\n      useEffect(() => {\n        execute();\n      }, [execute]);\n\n      return (\n        <Box flexDirection=\"column\" padding={1}>\n          <Header version={this.config.version}>\n            <Text color=\"green\"> → building for production…</Text>\n          </Header>\n\n          {commandSteps.map((step, index) => {\n            const isCurrent = index === currentStep && status === \"running\";\n            const isCompleted = index < currentStep || status === \"success\";\n            const isError = status === \"error\" && index === currentStep;\n\n            return (\n              <Box key={step.label} marginBottom={0}>\n                <Text color={isError ? \"red\" : isCompleted ? \"green\" : \"grey\"}>\n                  {isError ? \"✗\" : isCompleted ? \"✓\" : isCurrent ? \"⟳\" : \"○\"}{\" \"}\n                  {step.label}\n                </Text>\n              </Box>\n            );\n          })}\n\n          {status === \"success\" && (\n            <Box marginTop={1}>\n              <Text color=\"green\" bold>\n                ✓ Build completed successfully!\n              </Text>\n            </Box>\n          )}\n\n          {status === \"error\" && error && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ✗ Build failed\n              </Text>\n              <Box marginTop={1} flexDirection=\"column\">\n                {error.split(\"\\n\").map((line) => (\n                  <Text key={line} color=\"red\">\n                    {line}\n                  </Text>\n                ))}\n              </Box>\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    render(<App />, {\n      exitOnCtrlC: true,\n      patchConsole: false,\n    });\n  }\n}\n"]}

package/dist/server/auth/discovery.d.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+/**
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
+ */
+declare const DiscoverySchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint: z.ZodOptional<z.ZodString>;
+    introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;
+/** Fetches and validates an authorization server's discovery document. */
+export declare function discoverAuthorizationServer(issuer: string): Promise<DiscoveredMetadata>;
+export {};

package/dist/server/auth/discovery.js

@@ -0,0 +1,56 @@
+import { OAuthMetadataSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod";
+/**
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
+ */
+const DiscoverySchema = OAuthMetadataSchema.extend({
+    jwks_uri: z.string().optional(),
+});
+const WELL_KNOWN = [
+    "/.well-known/openid-configuration",
+    "/.well-known/oauth-authorization-server",
+];
+const DISCOVERY_TIMEOUT_MS = 5000;
+/** Fetches and validates an authorization server's discovery document. */
+export async function discoverAuthorizationServer(issuer) {
+    const base = issuer.replace(/\/$/, "");
+    const errors = [];
+    // First valid doc lacking a registration_endpoint, kept as a fallback so a
+    // genuinely non-DCR IdP still resolves (and is rejected later by the caller).
+    let fallback;
+    for (const path of WELL_KNOWN) {
+        const url = `${base}${path}`;
+        // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer
+        // mismatch) records a per-URL reason and falls through to the next path.
+        try {
+            const res = await fetch(url, {
+                signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+            });
+            if (!res.ok) {
+                throw new Error(`HTTP ${res.status}`);
+            }
+            const meta = DiscoverySchema.parse(await res.json());
+            // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).
+            if (meta.issuer.replace(/\/$/, "") !== base) {
+                throw new Error(`issuer mismatch: ${meta.issuer}`);
+            }
+            // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a
+            // valid openid-configuration without `registration_endpoint` yet expose
+            // it at oauth-authorization-server. Keep looking past a doc that omits it.
+            if (meta.registration_endpoint) {
+                return meta;
+            }
+            fallback ??= meta;
+        }
+        catch (err) {
+            errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (fallback) {
+        return fallback;
+    }
+    throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join("; ")}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/server/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { OAuthMetadataSchema } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { z } from \"zod\";\n\n/**\n * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's\n * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but\n * we need it for JWKS token verification, so we extend the schema to keep it.\n */\nconst DiscoverySchema = OAuthMetadataSchema.extend({\n  jwks_uri: z.string().optional(),\n});\nexport type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const meta = DiscoverySchema.parse(await res.json());\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (meta.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${meta.issuer}`);\n      }\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (meta.registration_endpoint) {\n        return meta;\n      }\n      fallback ??= meta;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/discovery.test.js

@@ -0,0 +1,93 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { discoverAuthorizationServer } from "./discovery.js";
+let server;
+afterEach(() => server?.close());
+function doc(origin, extra = {}) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/authorize`,
+        token_endpoint: `${origin}/token`,
+        registration_endpoint: `${origin}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email"],
+        jwks_uri: `${origin}/jwks`,
+        ...extra,
+    };
+}
+// Serves JSON bodies built from the live origin at their well-known paths;
+// returns the origin URL.
+async function serve(build) {
+    let origin = "";
+    const srv = http.createServer((req, res) => {
+        const body = build(origin)[req.url ?? ""];
+        if (body === undefined) {
+            res.writeHead(404).end();
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(body));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    origin = `http://localhost:${srv.address().port}`;
+    return origin;
+}
+describe("discoverAuthorizationServer", () => {
+    it("fetches and validates openid-configuration", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+        expect(meta.jwks_uri).toBe(`${base}/jwks`);
+    });
+    it("accepts a canonically slash-terminated issuer", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, { issuer: `${o}/` }),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("falls back to oauth-authorization-server when oidc is 404", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("throws when no well-known doc is reachable", async () => {
+        const base = await serve(() => ({}));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+    it("falls through to oauth-authorization-server when oidc doc is schema-invalid", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, {
+                response_types_supported: undefined,
+            }),
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("prefers the doc advertising DCR when oidc omits registration_endpoint", async () => {
+        // Clerk-shaped: valid openid-configuration without a registration_endpoint,
+        // DCR exposed only at oauth-authorization-server.
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, {
+                registration_endpoint: undefined,
+            }),
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("rejects a doc whose issuer does not match the fetch origin", async () => {
+        const base = await serve(() => ({
+            "/.well-known/openid-configuration": doc("https://evil.test"),
+        }));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+});
+//# sourceMappingURL=discovery.test.js.map

package/dist/server/auth/discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.test.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,KAAK,UAAU,KAAK,CAAC,KAAkD;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SACjE,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,wBAAwB,EAAE,SAAS;aACpC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,qBAAqB,EAAE,SAAS;aACjC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,mCAAmC,EAAE,GAAG,CAAC,mBAAmB,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { discoverAuthorizationServer } from \"./discovery.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves JSON bodies built from the live origin at their well-known paths;\n// returns the origin URL.\nasync function serve(build: (origin: string) => Record<string, unknown>) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    const body = build(origin)[req.url ?? \"\"];\n    if (body === undefined) {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(body));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"discoverAuthorizationServer\", () => {\n  it(\"fetches and validates openid-configuration\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n    expect(meta.jwks_uri).toBe(`${base}/jwks`);\n  });\n\n  it(\"accepts a canonically slash-terminated issuer\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, { issuer: `${o}/` }),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"falls back to oauth-authorization-server when oidc is 404\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"throws when no well-known doc is reachable\", async () => {\n    const base = await serve(() => ({}));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"falls through to oauth-authorization-server when oidc doc is schema-invalid\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        response_types_supported: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"prefers the doc advertising DCR when oidc omits registration_endpoint\", async () => {\n    // Clerk-shaped: valid openid-configuration without a registration_endpoint,\n    // DCR exposed only at oauth-authorization-server.\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        registration_endpoint: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"rejects a doc whose issuer does not match the fetch origin\", async () => {\n    const base = await serve(() => ({\n      \"/.well-known/openid-configuration\": doc(\"https://evil.test\"),\n    }));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n});\n"]}