skybridge 0.0.0-dev.e9705ff → 0.0.0-dev.e99ee17

package/dist/server/auth.d.ts

@@ -0,0 +1,57 @@
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/express";
+import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/server";
+import type { RequestHandler } from "express";
+export { type AuthMetadataOptions, type BearerAuthMiddlewareOptions, mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
+export { OAuthError, OAuthErrorCode } from "@modelcontextprotocol/server";
+/** Claims a verifier puts in `AuthInfo["extra"]`: any JSON-ish bag of them. */
+export type ExtraClaims = Record<string, unknown>;
+/**
+ * A validated access token, as resolved by a
+ * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to
+ * handlers on `extra.http?.authInfo`.
+ *
+ * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The
+ * claims are owned by whoever verifies the token: parameterize the verifier and
+ * the shape flows through {@link OAuthConfig} to every handler.
+ *
+ * @typeParam TExtra - Claims populated in `extra`.
+ *
+ * @example
+ * ```ts
+ * type Claims = { subject?: string; email?: string };
+ *
+ * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {
+ *   // ...
+ * }
+ * ```
+ */
+export type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<SdkAuthInfo, "extra"> & {
+    extra?: TExtra;
+};
+/**
+ * Checks a bearer token and resolves the claims it carries. The type parameter
+ * is what makes `extra.http?.authInfo.extra` typed downstream, so a verifier is the
+ * single source for the claim shape.
+ *
+ * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,
+ * or hand it to the `oauth` server option inside an {@link OAuthConfig}.
+ *
+ * @typeParam TExtra - Claims this verifier populates in `AuthInfo["extra"]`.
+ */
+export type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {
+    verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;
+};
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.http?.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;

package/dist/server/auth.js

@@ -0,0 +1,27 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/express";
+export { mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
+export { OAuthError, OAuthErrorCode } from "@modelcontextprotocol/server";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.http?.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export function optionalBearerAuth(options) {
+    const required = requireBearerAuth(options);
+    return (req, res, next) => {
+        if (!req.headers.authorization) {
+            next();
+            return;
+        }
+        return required(req, res, next);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAGL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AA2C1E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nimport type { AuthInfo as SdkAuthInfo } from \"@modelcontextprotocol/server\";\n\nimport type { RequestHandler } from \"express\";\n\nexport {\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  mcpAuthMetadataRouter,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nexport { OAuthError, OAuthErrorCode } from \"@modelcontextprotocol/server\";\n/** Claims a verifier puts in `AuthInfo[\"extra\"]`: any JSON-ish bag of them. */\nexport type ExtraClaims = Record<string, unknown>;\n\n/**\n * A validated access token, as resolved by a\n * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to\n * handlers on `extra.http?.authInfo`.\n *\n * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The\n * claims are owned by whoever verifies the token: parameterize the verifier and\n * the shape flows through {@link OAuthConfig} to every handler.\n *\n * @typeParam TExtra - Claims populated in `extra`.\n *\n * @example\n * ```ts\n * type Claims = { subject?: string; email?: string };\n *\n * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {\n *   // ...\n * }\n * ```\n */\nexport type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<\n  SdkAuthInfo,\n  \"extra\"\n> & { extra?: TExtra };\n\n/**\n * Checks a bearer token and resolves the claims it carries. The type parameter\n * is what makes `extra.http?.authInfo.extra` typed downstream, so a verifier is the\n * single source for the claim shape.\n *\n * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,\n * or hand it to the `oauth` server option inside an {@link OAuthConfig}.\n *\n * @typeParam TExtra - Claims this verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {\n  verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;\n};\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.http?.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/build-manifest.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { __setBuildManifest, McpServer } from "./index.js";
+function manifestOf(server) {
+    return server.viteManifest;
+}
+function makeServer() {
+    return new McpServer({ name: "test", version: "0.0.1" });
+}
+describe("__setBuildManifest", () => {
+    it("primes the Vite manifest for the next McpServer constructed", () => {
+        const manifest = {
+            "src/views/index.tsx": { file: "assets/index-DEADBEEF.js" },
+        };
+        __setBuildManifest(manifest);
+        // viteManifest is private; reach into it to lock the contract that the
+        // generated `dist/__entry.js` relies on.
+        expect(manifestOf(makeServer())).toEqual(manifest);
+    });
+    it("keeps priming every McpServer the app factory builds per request", () => {
+        const manifest = {
+            "src/views/index.tsx": { file: "assets/index-CAFEBABE.js" },
+        };
+        __setBuildManifest(manifest);
+        makeServer();
+        expect(manifestOf(makeServer())).toEqual(manifest);
+    });
+});
+//# sourceMappingURL=build-manifest.test.js.map

package/dist/server/build-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-manifest.test.js","sourceRoot":"","sources":["../../src/server/build-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,SAAS,UAAU,CACjB,MAAiB;IAEjB,OACE,MAGD,CAAC,YAAY,CAAC;AACjB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG;YACf,qBAAqB,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D,CAAC;QACF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7B,UAAU,EAAE,CAAC;QACb,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nfunction manifestOf(\n  server: McpServer,\n): Record<string, { file: string }> | null {\n  return (\n    server as unknown as {\n      viteManifest: Record<string, { file: string }> | null;\n    }\n  ).viteManifest;\n}\n\nfunction makeServer(): McpServer {\n  return new McpServer({ name: \"test\", version: \"0.0.1\" });\n}\n\ndescribe(\"__setBuildManifest\", () => {\n  it(\"primes the Vite manifest for the next McpServer constructed\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-DEADBEEF.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    // viteManifest is private; reach into it to lock the contract that the\n    // generated `dist/__entry.js` relies on.\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n\n  it(\"keeps priming every McpServer the app factory builds per request\", () => {\n    const manifest = {\n      \"src/views/index.tsx\": { file: \"assets/index-CAFEBABE.js\" },\n    };\n    __setBuildManifest(manifest);\n\n    makeServer();\n    expect(manifestOf(makeServer())).toEqual(manifest);\n  });\n});\n"]}

package/dist/server/content-helpers.d.ts

@@ -0,0 +1,67 @@
+import type { AudioContent, EmbeddedResource, ImageContent, ResourceLink, TextContent } from "@modelcontextprotocol/server";
+/**
+ * MCP content annotations applied to any returned block.
+ *
+ * - `audience` — who is meant to see the content (`"user"`, `"assistant"`, or both).
+ * - `priority` — relative importance hint for the host.
+ * - `lastModified` — ISO timestamp for when the content was produced.
+ */
+type ContentAnnotations = {
+    audience?: ("user" | "assistant")[];
+    priority?: number;
+    lastModified?: string;
+};
+/**
+ * Build an MCP text content block.
+ *
+ * @example
+ * ```ts
+ * return { content: [text("Found 3 results.")] };
+ * ```
+ */
+export declare function text(value: string, annotations?: ContentAnnotations): TextContent;
+/**
+ * Build an MCP image content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**. Passing a raw byte-string will produce invalid
+ * content.
+ */
+export declare function image(data: string | Uint8Array, mimeType: string, annotations?: ContentAnnotations): ImageContent;
+/**
+ * Build an MCP audio content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**.
+ */
+export declare function audio(data: string | Uint8Array, mimeType: string, annotations?: ContentAnnotations): AudioContent;
+/**
+ * Build an MCP embedded resource — the full content travels inline. Use this
+ * when the client needs the bytes themselves rather than a link.
+ *
+ * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).
+ */
+export declare function embeddedResource(resource: {
+    uri: string;
+    mimeType?: string;
+    text: string;
+} | {
+    uri: string;
+    mimeType?: string;
+    blob: string;
+}, annotations?: ContentAnnotations): EmbeddedResource;
+/**
+ * Build an MCP resource link — a `type: "resource_link"` block carrying a URI
+ * the client can fetch (or subscribe to) on demand. Use a link when the
+ * client should retrieve the bytes itself; use {@link embeddedResource} when
+ * the content must travel inline with the response.
+ */
+export declare function resourceLink(link: {
+    uri: string;
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+    size?: number;
+}, annotations?: ContentAnnotations): ResourceLink;
+export {};

package/dist/server/content-helpers.js

@@ -0,0 +1,79 @@
+/**
+ * Returns a base64-encoded string.
+ * - `Uint8Array` input is encoded via `Buffer.toString("base64")`.
+ * - `string` input is assumed to be **already base64-encoded** and is returned
+ *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.
+ */
+function toBase64(data) {
+    if (typeof data === "string") {
+        return data;
+    }
+    return Buffer.from(data).toString("base64");
+}
+/**
+ * Build an MCP text content block.
+ *
+ * @example
+ * ```ts
+ * return { content: [text("Found 3 results.")] };
+ * ```
+ */
+export function text(value, annotations) {
+    return { type: "text", text: value, ...(annotations && { annotations }) };
+}
+/**
+ * Build an MCP image content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**. Passing a raw byte-string will produce invalid
+ * content.
+ */
+export function image(data, mimeType, annotations) {
+    return {
+        type: "image",
+        data: toBase64(data),
+        mimeType,
+        ...(annotations && { annotations }),
+    };
+}
+/**
+ * Build an MCP audio content block.
+ *
+ * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is
+ * **already base64-encoded**.
+ */
+export function audio(data, mimeType, annotations) {
+    return {
+        type: "audio",
+        data: toBase64(data),
+        mimeType,
+        ...(annotations && { annotations }),
+    };
+}
+/**
+ * Build an MCP embedded resource — the full content travels inline. Use this
+ * when the client needs the bytes themselves rather than a link.
+ *
+ * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).
+ */
+export function embeddedResource(resource, annotations) {
+    return {
+        type: "resource",
+        resource,
+        ...(annotations && { annotations }),
+    };
+}
+/**
+ * Build an MCP resource link — a `type: "resource_link"` block carrying a URI
+ * the client can fetch (or subscribe to) on demand. Use a link when the
+ * client should retrieve the bytes itself; use {@link embeddedResource} when
+ * the content must travel inline with the response.
+ */
+export function resourceLink(link, annotations) {
+    return {
+        type: "resource_link",
+        ...link,
+        ...(annotations && { annotations }),
+    };
+}
+//# sourceMappingURL=content-helpers.js.map

package/dist/server/content-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-helpers.js","sourceRoot":"","sources":["../../src/server/content-helpers.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAyB;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,WAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAEoD,EACpD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAOC,EACD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AudioContent,\n  EmbeddedResource,\n  ImageContent,\n  ResourceLink,\n  TextContent,\n} from \"@modelcontextprotocol/server\";\n\n/**\n * MCP content annotations applied to any returned block.\n *\n * - `audience` — who is meant to see the content (`\"user\"`, `\"assistant\"`, or both).\n * - `priority` — relative importance hint for the host.\n * - `lastModified` — ISO timestamp for when the content was produced.\n */\ntype ContentAnnotations = {\n  audience?: (\"user\" | \"assistant\")[];\n  priority?: number;\n  lastModified?: string;\n};\n\n/**\n * Returns a base64-encoded string.\n * - `Uint8Array` input is encoded via `Buffer.toString(\"base64\")`.\n * - `string` input is assumed to be **already base64-encoded** and is returned\n *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.\n */\nfunction toBase64(data: string | Uint8Array): string {\n  if (typeof data === \"string\") {\n    return data;\n  }\n  return Buffer.from(data).toString(\"base64\");\n}\n\n/**\n * Build an MCP text content block.\n *\n * @example\n * ```ts\n * return { content: [text(\"Found 3 results.\")] };\n * ```\n */\nexport function text(\n  value: string,\n  annotations?: ContentAnnotations,\n): TextContent {\n  return { type: \"text\", text: value, ...(annotations && { annotations }) };\n}\n\n/**\n * Build an MCP image content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**. Passing a raw byte-string will produce invalid\n * content.\n */\nexport function image(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): ImageContent {\n  return {\n    type: \"image\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP audio content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**.\n */\nexport function audio(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): AudioContent {\n  return {\n    type: \"audio\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP embedded resource — the full content travels inline. Use this\n * when the client needs the bytes themselves rather than a link.\n *\n * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).\n */\nexport function embeddedResource(\n  resource:\n    | { uri: string; mimeType?: string; text: string }\n    | { uri: string; mimeType?: string; blob: string },\n  annotations?: ContentAnnotations,\n): EmbeddedResource {\n  return {\n    type: \"resource\",\n    resource,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP resource link — a `type: \"resource_link\"` block carrying a URI\n * the client can fetch (or subscribe to) on demand. Use a link when the\n * client should retrieve the bytes itself; use {@link embeddedResource} when\n * the content must travel inline with the response.\n */\nexport function resourceLink(\n  link: {\n    uri: string;\n    name: string;\n    title?: string;\n    description?: string;\n    mimeType?: string;\n    size?: number;\n  },\n  annotations?: ContentAnnotations,\n): ResourceLink {\n  return {\n    type: \"resource_link\",\n    ...link,\n    ...(annotations && { annotations }),\n  };\n}\n"]}

package/dist/server/content-helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/content-helpers.test.js

@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
+describe("text", () => {
+    it("returns a TextContent without annotations when none given", () => {
+        expect(text("hello")).toEqual({ type: "text", text: "hello" });
+    });
+    it("includes annotations when provided", () => {
+        expect(text("hi", { priority: 1 })).toEqual({
+            type: "text",
+            text: "hi",
+            annotations: { priority: 1 },
+        });
+    });
+});
+describe("image", () => {
+    it("base64-encodes Uint8Array data", () => {
+        const bytes = new Uint8Array([104, 105]);
+        expect(image(bytes, "image/png")).toEqual({
+            type: "image",
+            data: "aGk=",
+            mimeType: "image/png",
+        });
+    });
+    it("passes string data through unchanged (caller is responsible for base64)", () => {
+        expect(image("YWxyZWFkeS1iNjQ=", "image/png")).toEqual({
+            type: "image",
+            data: "YWxyZWFkeS1iNjQ=",
+            mimeType: "image/png",
+        });
+    });
+});
+describe("audio", () => {
+    it("base64-encodes Uint8Array data", () => {
+        const bytes = new Uint8Array([104, 105]);
+        expect(audio(bytes, "audio/mpeg")).toMatchObject({
+            type: "audio",
+            data: "aGk=",
+            mimeType: "audio/mpeg",
+        });
+    });
+});
+describe("embeddedResource", () => {
+    it("wraps a text resource with a type tag", () => {
+        expect(embeddedResource({
+            uri: "file:///a.txt",
+            mimeType: "text/plain",
+            text: "x",
+        })).toEqual({
+            type: "resource",
+            resource: { uri: "file:///a.txt", mimeType: "text/plain", text: "x" },
+        });
+    });
+    it("wraps a blob resource with a type tag", () => {
+        expect(embeddedResource({ uri: "file:///a.bin", blob: "YmFy" })).toEqual({
+            type: "resource",
+            resource: { uri: "file:///a.bin", blob: "YmFy" },
+        });
+    });
+});
+describe("resourceLink", () => {
+    it("spreads link fields alongside the type tag", () => {
+        expect(resourceLink({ uri: "file:///a", name: "a", title: "A" })).toEqual({
+            type: "resource_link",
+            uri: "file:///a",
+            name: "a",
+            title: "A",
+        });
+    });
+});
+//# sourceMappingURL=content-helpers.test.js.map

package/dist/server/content-helpers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-helpers.test.js","sourceRoot":"","sources":["../../src/server/content-helpers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;IACpB,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YAC/C,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CACJ,gBAAgB,CAAC;YACf,GAAG,EAAE,eAAe;YACpB,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CACH,CAAC,OAAO,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE;SACtE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACvE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACxE,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,WAAW;YAChB,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\n\ndescribe(\"text\", () => {\n  it(\"returns a TextContent without annotations when none given\", () => {\n    expect(text(\"hello\")).toEqual({ type: \"text\", text: \"hello\" });\n  });\n\n  it(\"includes annotations when provided\", () => {\n    expect(text(\"hi\", { priority: 1 })).toEqual({\n      type: \"text\",\n      text: \"hi\",\n      annotations: { priority: 1 },\n    });\n  });\n});\n\ndescribe(\"image\", () => {\n  it(\"base64-encodes Uint8Array data\", () => {\n    const bytes = new Uint8Array([104, 105]);\n    expect(image(bytes, \"image/png\")).toEqual({\n      type: \"image\",\n      data: \"aGk=\",\n      mimeType: \"image/png\",\n    });\n  });\n\n  it(\"passes string data through unchanged (caller is responsible for base64)\", () => {\n    expect(image(\"YWxyZWFkeS1iNjQ=\", \"image/png\")).toEqual({\n      type: \"image\",\n      data: \"YWxyZWFkeS1iNjQ=\",\n      mimeType: \"image/png\",\n    });\n  });\n});\n\ndescribe(\"audio\", () => {\n  it(\"base64-encodes Uint8Array data\", () => {\n    const bytes = new Uint8Array([104, 105]);\n    expect(audio(bytes, \"audio/mpeg\")).toMatchObject({\n      type: \"audio\",\n      data: \"aGk=\",\n      mimeType: \"audio/mpeg\",\n    });\n  });\n});\n\ndescribe(\"embeddedResource\", () => {\n  it(\"wraps a text resource with a type tag\", () => {\n    expect(\n      embeddedResource({\n        uri: \"file:///a.txt\",\n        mimeType: \"text/plain\",\n        text: \"x\",\n      }),\n    ).toEqual({\n      type: \"resource\",\n      resource: { uri: \"file:///a.txt\", mimeType: \"text/plain\", text: \"x\" },\n    });\n  });\n\n  it(\"wraps a blob resource with a type tag\", () => {\n    expect(embeddedResource({ uri: \"file:///a.bin\", blob: \"YmFy\" })).toEqual({\n      type: \"resource\",\n      resource: { uri: \"file:///a.bin\", blob: \"YmFy\" },\n    });\n  });\n});\n\ndescribe(\"resourceLink\", () => {\n  it(\"spreads link fields alongside the type tag\", () => {\n    expect(resourceLink({ uri: \"file:///a\", name: \"a\", title: \"A\" })).toEqual({\n      type: \"resource_link\",\n      uri: \"file:///a\",\n      name: \"a\",\n      title: \"A\",\n    });\n  });\n});\n"]}

package/dist/server/events.d.ts

@@ -0,0 +1,113 @@
+import { type McpServer as SdkMcpServer, type StandardSchemaV1, type StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+/**
+ * A webhook subscription, as passed to `onSubscribe`. Whatever delivers the
+ * events POSTs them to `url`, signed with `secret`, until `expiresAt`.
+ */
+export interface EventSubscription {
+    /** Stable across refreshes: the same user subscribing to the same event with the same arguments and callback gets the same `id`. */
+    id: string;
+    /** Callback URL deliveries are POSTed to. */
+    url: string;
+    /** Standard Webhooks signing secret (`whsec_…`). A refresh may carry a new one. */
+    secret: string;
+    /** When the subscription lapses unless the host refreshes it. */
+    expiresAt: Date;
+}
+/** An event occurrence, as passed to {@link deliverEvent}. */
+export interface EventOccurrence {
+    /** Event type name, as registered with `registerEvent`. */
+    name: string;
+    /** Stable identifier the host uses to drop duplicates, ideally the upstream's. Reuse it when retrying. */
+    id: string;
+    /** When the event happened. Defaults to now. */
+    timestamp?: Date;
+    /** Payload matching the event's `payloadSchema`. */
+    data: unknown;
+}
+/** Outcome of {@link deliverEvent}. Retry with the same event `id` when `retryable`. */
+export type DeliveryResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    retryable: boolean;
+    status?: number;
+};
+type EventSchema = Record<string, StandardSchemaWithJSON> | StandardSchemaWithJSON;
+export type InferEventSchema<T extends EventSchema> = T extends StandardSchemaWithJSON ? StandardSchemaV1.InferOutput<T> : T extends Record<string, StandardSchemaWithJSON> ? {
+    [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]> ? never : K]: StandardSchemaV1.InferOutput<T[K]>;
+} & {
+    [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]> ? K : never]?: StandardSchemaV1.InferOutput<T[K]>;
+} : never;
+/** The `registerEvent` config: how the event type is described in `events/list`. */
+export interface EventConfig<TInput extends EventSchema> {
+    /** Stable, specific name such as `comment.created`. */
+    name: string;
+    /** What the event is and when it fires. */
+    description?: string;
+    /** Subscription arguments (filters): a Zod shape or a Standard Schema object. */
+    inputSchema?: TInput;
+    /** Shape of the delivered `data`: a Zod shape or a Standard Schema object. */
+    payloadSchema: EventSchema;
+    _meta?: Record<string, unknown>;
+}
+/** What `registerEvent` does when the host subscribes and unsubscribes. */
+export interface EventHooks<TArguments, TExtra> {
+    /**
+     * Runs on every `events/subscribe`, including the host's refreshes, once
+     * the callback URL is verified. Hand the subscription to whatever delivers
+     * the events, keyed by `subscription.id`. Throw (e.g. a `ProtocolError`) to
+     * reject it, for instance when the user may not access what the arguments
+     * point to.
+     */
+    onSubscribe(args: TArguments, context: {
+        subscription: EventSubscription;
+        extra: TExtra;
+    }): void | Promise<void>;
+    /** Runs on `events/unsubscribe`. Stop delivering to `subscription.id`. */
+    onUnsubscribe(args: TArguments, context: {
+        subscription: Pick<EventSubscription, "id">;
+        extra: TExtra;
+    }): void | Promise<void>;
+}
+/**
+ * @experimental POST one event to a subscription handed out by `onSubscribe`,
+ * as MCP Events expects: the event envelope, Standard Webhooks signature
+ * headers, a 10 second deadline and, outside development, no requests to
+ * private addresses. Pass the old and new secrets during a rotation so both
+ * sign the delivery. A subscription past `expiresAt` is not posted to.
+ * Retrying is up to the caller. API may change.
+ *
+ * @example
+ * ```ts
+ * const result = await deliverEvent(subscription, {
+ *   name: "comment.created",
+ *   id: comment.id,
+ *   data: { documentId: comment.documentId, excerpt: comment.text.slice(0, 280) },
+ * });
+ * if (!result.ok && result.retryable) {
+ *   await queue.retryLater(subscription, comment);
+ * }
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/register-event
+ */
+export declare function deliverEvent(subscription: Pick<EventSubscription, "id" | "url"> & {
+    secret: string | string[];
+    expiresAt: Date | string;
+}, event: EventOccurrence): Promise<DeliveryResult>;
+/**
+ * The event types registered on one server, and the `events/*` handlers that
+ * serve them.
+ *
+ * @internal
+ */
+export declare class EventRegistry {
+    private readonly server;
+    private readonly events;
+    constructor(server: Pick<SdkMcpServer["server"], "setRequestHandler">);
+    add(config: EventConfig<EventSchema>, hooks: EventHooks<never, never>): void;
+    private install;
+    private resolve;
+}
+export {};