skybridge 0.0.0-dev.ecfdeac → 0.0.0-dev.ed005a8

package/dist/server/app.js

@@ -0,0 +1,266 @@
+import http from "node:http";
+import { setupOAuth } from "./auth/setup.js";
+import { buildMcpHandler, createApp, createBaseApp } from "./express.js";
+import { createMiddlewareEntry } from "./metric.js";
+import { buildMiddlewareChain, getHandlerMaps } from "./middleware.js";
+import { McpServer, } from "./server.js";
+const SLOW_HANDLER_THRESHOLD_MS = 50;
+async function resolveOAuthInput(input, config) {
+    const resolved = typeof input === "function" ? input(config) : input;
+    return resolved && "resolve" in resolved
+        ? await resolved.resolve()
+        : resolved;
+}
+/**
+ * A Skybridge app: the HTTP surface (Express, OAuth metadata, the `/mcp`
+ * route) plus a handler that builds the MCP server for each request.
+ *
+ * The handler runs for every request, so tools, resources, prompts and views
+ * are always registered on the instance that serves the request. Anything in
+ * the handler body other than registration therefore runs per request too.
+ * Anything asynchronous the app needs (remote config, secrets, …) goes in
+ * `setup`, which runs once and feeds the handler's second argument.
+ *
+ * @example
+ * ```ts
+ * export const app = new Skybridge({
+ *   name: "my-app",
+ *   version: "1.0.0",
+ *   setup: async () => loadConfig(),
+ *   oauth: (config) => descopeProvider({ url: config.mcpServerUrl }),
+ *   handler: (server, config) =>
+ *     server.registerTool(
+ *       {
+ *         name: "search",
+ *         inputSchema: { query: z.string() },
+ *         view: { component: "search" },
+ *       },
+ *       async ({ query }) => ({ content: `Results for ${query}` }),
+ *     ),
+ * });
+ *
+ * export type AppType = typeof app;
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
+ */
+export class Skybridge {
+    serverInfo;
+    serverOptions;
+    skills;
+    oauthEnabled = false;
+    handler;
+    setup;
+    oauthInput;
+    config;
+    expressApp;
+    errorMiddleware = [];
+    monitoringEntry = createMiddlewareEntry();
+    resolveResourceMetadataUrl;
+    readyPromise;
+    slowHandlerWarned = false;
+    constructor({ name, title, version, description, icons, websiteUrl, json, skills, setup, oauth, handler, ...serverOptions }) {
+        this.serverInfo = { name, title, version, description, icons, websiteUrl };
+        this.serverOptions = serverOptions;
+        this.skills = skills;
+        this.setup = setup;
+        this.oauthInput = oauth;
+        this.handler = handler;
+        this.expressApp = createBaseApp(json);
+    }
+    /**
+     * Resolve `setup` and `oauth`, then wire OAuth onto the Express app. Runs
+     * once; every entry point that needs a built server awaits it, and a failed
+     * attempt is retried on the next call.
+     *
+     * @internal
+     */
+    ready() {
+        this.readyPromise ??= (async () => {
+            if (this.setup) {
+                this.config = await this.setup();
+            }
+            const oauth = await resolveOAuthInput(this.oauthInput, this.config);
+            this.oauthEnabled = Boolean(oauth);
+            const sample = this.buildServer();
+            if (oauth) {
+                this.resolveResourceMetadataUrl = setupOAuth(this.expressApp, oauth, sample.securitySchemesByTool);
+            }
+        })().catch((error) => {
+            this.readyPromise = undefined;
+            throw error;
+        });
+        return this.readyPromise;
+    }
+    /**
+     * The underlying Express app. Use this to extend the HTTP server with
+     * custom routes, middleware, or settings — e.g.
+     * `app.express.get("/health", ...)`.
+     *
+     * `express.json()` is pre-applied — tune it via the `json` config field,
+     * e.g. `new Skybridge({ name, version, json: { limit: "10mb" }, handler })`.
+     * Register your handlers before `run()`; after `run()`, dev-mode middleware,
+     * the `/mcp` route, and the default error handler are appended in that order.
+     *
+     * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work
+     * locally and on self-hosted deployments.
+     */
+    get express() {
+        return this.expressApp;
+    }
+    /**
+     * Build a fresh server for one stateless HTTP request, as
+     * `createMcpHandler`'s factory contract requires: the handler runs again so
+     * the SDK's handler closures belong to the instance whose protocol era it
+     * stamps. Sharing one instance's handler maps instead would bind them to an
+     * instance that is never marked, pinning every request to the 2025 codec and
+     * letting concurrent callers overwrite each other's negotiated version.
+     *
+     * Awaits `setup` and the `oauth` input on first use.
+     */
+    async createServerInstance() {
+        await this.ready();
+        const server = this.buildServer();
+        this.instrumentHandlers(server);
+        return server.server;
+    }
+    /**
+     * Connect a Skybridge app to an MCP transport. Use this when you're
+     * embedding Skybridge in a host that already manages its own transport
+     * (e.g. stdio for desktop apps); for HTTP, prefer {@link Skybridge.run}
+     * which sets the transport up for you.
+     */
+    async connect(transport) {
+        const instance = await this.createServerInstance();
+        await instance.connect(transport);
+    }
+    use(pathOrHandler, ...handlers) {
+        // Branching is load-bearing: Express's `app.use` overloads can't be
+        // resolved against a `string | RequestHandler` union, so we narrow.
+        if (typeof pathOrHandler === "string") {
+            this.expressApp.use(pathOrHandler, ...handlers);
+        }
+        else {
+            this.expressApp.use(pathOrHandler, ...handlers);
+        }
+        return this;
+    }
+    useOnError(pathOrHandler, ...handlers) {
+        if (typeof pathOrHandler === "string") {
+            this.errorMiddleware.push({ path: pathOrHandler, handlers });
+        }
+        else {
+            this.errorMiddleware.push({ handlers: [pathOrHandler, ...handlers] });
+        }
+        return this;
+    }
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, and applies any custom Express middleware
+     * registered via {@link Skybridge.use} / {@link Skybridge.useOnError}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Vercel (`VERCEL === "1"`), returns the Express app directly so the
+     * serverless function entry can call it as a `(req, res)` handler. On
+     * Node, returns `undefined` once listening. When the process was spawned
+     * with an IPC channel, the bound port is reported to the parent as
+     * `{ type: "skybridge:listening", port }`, the readiness signal test runners
+     * wait on instead of polling.
+     */
+    async run() {
+        if (process.env.VERCEL === "1") {
+            // createApp only reads httpServer inside its dev-only branch
+            // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a
+            // bare object passed to satisfy the required parameter.
+            const httpServer = http.createServer();
+            await createApp({
+                app: this,
+                httpServer,
+                errorMiddleware: this.errorMiddleware,
+            });
+            return this.expressApp;
+        }
+        const httpServer = http.createServer();
+        const mcpHandler = buildMcpHandler(this);
+        await createApp({
+            app: this,
+            httpServer,
+            mcpHandler,
+            errorMiddleware: this.errorMiddleware,
+        });
+        httpServer.on("request", this.expressApp);
+        const intendedPort = parseInt(process.env.__PORT ?? "3000", 10);
+        await new Promise((resolve, reject) => {
+            httpServer.on("error", (error) => {
+                console.error("Failed to start server:", error);
+                reject(error);
+            });
+            httpServer.listen(intendedPort, () => {
+                resolve();
+            });
+        });
+        const { port } = httpServer.address();
+        process.send?.({ type: "skybridge:listening", port });
+        // On workerd, bridge the Node http server to a Workers fetch handler.
+        // The specifier is held in a variable to sidestep tsc's module resolution
+        // (`cloudflare:node` only exists under wrangler/workerd).
+        if (typeof navigator !== "undefined" &&
+            navigator.userAgent === "Cloudflare-Workers") {
+            const cloudflareNode = "cloudflare:node";
+            const { httpServerHandler } = await import(cloudflareNode);
+            return httpServerHandler({ port });
+        }
+        const shutdown = () => {
+            // Drop both handlers so a second signal falls through to Node's default
+            // (force-quit on a second Ctrl+C while drain is hanging).
+            process.off("SIGTERM", shutdown);
+            process.off("SIGINT", shutdown);
+            mcpHandler.close().catch(() => { });
+            httpServer.close(() => process.exit(0));
+            // Force exit if connections don't drain in time so the port is still
+            // released promptly (e.g. for nodemon restarts).
+            setTimeout(() => process.exit(0), 3000).unref();
+        };
+        process.on("SIGTERM", shutdown);
+        process.on("SIGINT", shutdown);
+        return undefined;
+    }
+    buildServer() {
+        const server = new McpServer(this.serverInfo, this.serverOptions, { skills: this.skills, oauth: this.oauthEnabled });
+        if (this.resolveResourceMetadataUrl) {
+            server.setResourceMetadataUrlResolver(this.resolveResourceMetadataUrl);
+        }
+        const startedAt = performance.now();
+        const built = this.handler(server, this.config);
+        const elapsed = performance.now() - startedAt;
+        if (typeof built.then === "function") {
+            throw new Error("The Skybridge handler must be synchronous — it runs on every request. Load config or secrets in `setup` instead and read them from the handler's second argument.");
+        }
+        if (elapsed > SLOW_HANDLER_THRESHOLD_MS && !this.slowHandlerWarned) {
+            this.slowHandlerWarned = true;
+            console.warn(`The Skybridge handler took ${Math.round(elapsed)}ms — it runs on every request, so this cost is paid per request. Move expensive work into \`setup\`, whose result is passed to the handler.`);
+        }
+        return built;
+    }
+    middlewareEntries(server) {
+        return [
+            ...(this.monitoringEntry ? [this.monitoringEntry] : []),
+            ...server.protocolMiddlewareEntries(),
+        ];
+    }
+    instrumentHandlers(server) {
+        const entries = this.middlewareEntries(server);
+        const { requestHandlers, notificationHandlers } = getHandlerMaps(server.server);
+        const instrumentMap = (map, isNotification) => {
+            for (const [method, handler] of map) {
+                map.set(method, buildMiddlewareChain(method, isNotification, handler, entries));
+            }
+            const originalSet = map.set.bind(map);
+            map.set = (method, handler) => originalSet(method, buildMiddlewareChain(method, isNotification, handler, entries));
+        };
+        instrumentMap(requestHandlers, false);
+        instrumentMap(notificationHandlers, true);
+    }
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,OAAO,EAAoC,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAEL,SAAS,GAGV,MAAM,aAAa,CAAC;AAErB,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAsCrC,KAAK,UAAU,iBAAiB,CAC9B,KAAuD,EACvD,MAAe;IAEf,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,OAAO,QAAQ,IAAI,SAAS,IAAI,QAAQ;QACtC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE;QAC1B,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AA0CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,SAAS;IAMH,UAAU,CAAiB;IAC3B,aAAa,CAAgB;IAC7B,MAAM,CAAW;IAC1B,YAAY,GAAG,KAAK,CAAC;IACZ,OAAO,CAItB;IACe,KAAK,CAAiB;IACtB,UAAU,CAGzB;IACM,MAAM,CAAoB;IACjB,UAAU,CAAU;IACpB,eAAe,GAA4B,EAAE,CAAC;IAC9C,eAAe,GAC9B,qBAAqB,EAAE,CAAC;IAClB,0BAA0B,CAA+B;IACzD,YAAY,CAAiB;IAC7B,iBAAiB,GAAG,KAAK,CAAC;IAElC,YAAY,EACV,IAAI,EACJ,KAAK,EACL,OAAO,EACP,WAAW,EACX,KAAK,EACL,UAAU,EACV,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,OAAO,EACP,GAAG,aAAa,EAC6B;QAC7C,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK;QACH,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,MAA0B,CAChC,CAAC;YACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,0BAA0B,GAAG,UAAU,CAC1C,IAAI,CAAC,UAAU,EACf,KAAK,EACL,MAAM,CAAC,qBAAqB,CAC7B,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB;QACxB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAA8C;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAYD,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,GAAG;QAGP,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,6DAA6D;YAC7D,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC;gBACd,GAAG,EAAE,IAAI;gBACT,UAAU;gBACV,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,SAAS,CAAC;YACd,GAAG,EAAE,IAAI;YACT,UAAU;YACV,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAC;QACrD,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,aAAa,EAClB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAClD,CAAC;QACF,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,MAAM,CAAC,8BAA8B,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAA0B,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC9C,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,yBAAyB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACnE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,6IAA6I,CAC/L,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CACvB,MAAqD;QAErD,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,MAAM,CAAC,yBAAyB,EAAE;SACtC,CAAC;IACJ,CAAC;IAEO,kBAAkB,CACxB,MAAqD;QAErD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import http from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport type {\n  Implementation,\n  Server as SdkServer,\n  ServerOptions,\n} from \"@modelcontextprotocol/server\";\nimport type { ErrorRequestHandler, Express, RequestHandler } from \"express\";\nimport type { OAuthConfig, OAuthProvider } from \"./auth/index.js\";\nimport { type ResourceMetadataUrlResolver, setupOAuth } from \"./auth/setup.js\";\nimport type { ExtraClaims } from \"./auth.js\";\nimport { buildMcpHandler, createApp, createBaseApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type { McpMiddlewareEntry } from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport {\n  type JsonOptions,\n  McpServer,\n  type McpServerTypes,\n  type ToolDef,\n} from \"./server.js\";\n\nconst SLOW_HANDLER_THRESHOLD_MS = 50;\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\n/**\n * The `handler` field of {@link SkybridgeConfig}: builds the app's MCP\n * surface. Runs again for **every incoming request**, on a fresh\n * {@link McpServer}, so keep it to registration: pools, clients and any other\n * one-time work belong in `setup`, whose result is the second argument. It\n * must **return** the chained server so `typeof app` carries the registered\n * tool types.\n *\n * @typeParam TConfig - What `setup` resolved to, passed as the second argument.\n */\nexport type SkybridgeHandler<\n  TTools extends Record<string, ToolDef>,\n  TConfig,\n  TAuthExtra extends ExtraClaims,\n> = (\n  server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n  config: TConfig,\n) => McpServer<TTools, TAuthExtra>;\n\n/**\n * What the `oauth` field accepts: an {@link OAuthConfig}, a provider\n * (`oauth: auth0Provider(...)`), or a function of the `setup` result returning\n * either. Providers and functions resolve once, at {@link Skybridge.run} or on\n * the first request, never at module import. Anything asynchronous belongs in\n * a provider's `resolve`.\n */\nexport type SkybridgeOAuthInput<TConfig, TExtra extends ExtraClaims> =\n  | OAuthConfig<TExtra>\n  | OAuthProvider<TExtra>\n  | ((config: TConfig) => OAuthConfig<TExtra> | OAuthProvider<TExtra>);\n\nasync function resolveOAuthInput<TConfig, TExtra extends ExtraClaims>(\n  input: SkybridgeOAuthInput<TConfig, TExtra> | undefined,\n  config: TConfig,\n): Promise<OAuthConfig<TExtra> | undefined> {\n  const resolved = typeof input === \"function\" ? input(config) : input;\n  return resolved && \"resolve\" in resolved\n    ? await resolved.resolve()\n    : resolved;\n}\n\n/**\n * Everything a Skybridge app needs in one bag: the MCP implementation info\n * (`name`, `version`, …), the SDK's {@link ServerOptions} (`capabilities`,\n * `instructions`, …), the Express and skills options, and the app's behavior\n * (`setup`, `oauth`, `handler`).\n *\n * All type parameters are inferred from the value: the config from `setup`,\n * the auth claims from `oauth`, and the tool registry from the server\n * `handler` returns.\n */\nexport type SkybridgeConfig<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n  TConfig = undefined,\n  TAuthExtra extends ExtraClaims = ExtraClaims,\n> = Implementation &\n  ServerOptions & {\n    /** Options for the built-in `express.json()` middleware, e.g. `{ limit: \"10mb\" }`. */\n    json?: JsonOptions;\n    /**\n     * @experimental Serve Agent Skills from `src/skills` over MCP (SEP-2640).\n     * API may change.\n     */\n    skills?: boolean;\n    /**\n     * Loads whatever the app needs up front (remote config, secrets, datasets,\n     * …). Runs **once** — at {@link Skybridge.run} or on the first request,\n     * never at module import — and its awaited return value is passed to an\n     * `oauth` function and to `handler` as the second argument.\n     */\n    setup?: () => TConfig;\n    /**\n     * Resource-server OAuth. When set, mounts the well-known metadata routes\n     * and bearer auth on `/mcp`, and the verifier's claims type\n     * `extra.http.authInfo.extra` in tool handlers.\n     */\n    oauth?: SkybridgeOAuthInput<Awaited<TConfig>, TAuthExtra>;\n    /** Registers the MCP surface, per request. See {@link SkybridgeHandler}. */\n    handler: SkybridgeHandler<TTools, Awaited<TConfig>, TAuthExtra>;\n  };\n\n/**\n * A Skybridge app: the HTTP surface (Express, OAuth metadata, the `/mcp`\n * route) plus a handler that builds the MCP server for each request.\n *\n * The handler runs for every request, so tools, resources, prompts and views\n * are always registered on the instance that serves the request. Anything in\n * the handler body other than registration therefore runs per request too.\n * Anything asynchronous the app needs (remote config, secrets, …) goes in\n * `setup`, which runs once and feeds the handler's second argument.\n *\n * @example\n * ```ts\n * export const app = new Skybridge({\n *   name: \"my-app\",\n *   version: \"1.0.0\",\n *   setup: async () => loadConfig(),\n *   oauth: (config) => descopeProvider({ url: config.mcpServerUrl }),\n *   handler: (server, config) =>\n *     server.registerTool(\n *       {\n *         name: \"search\",\n *         inputSchema: { query: z.string() },\n *         view: { component: \"search\" },\n *       },\n *       async ({ query }) => ({ content: `Results for ${query}` }),\n *     ),\n * });\n *\n * export type AppType = typeof app;\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/mcp-server\n */\nexport class Skybridge<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n  TConfig = undefined,\n  TAuthExtra extends ExtraClaims = ExtraClaims,\n> {\n  declare readonly $types: McpServerTypes<TTools>;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions: ServerOptions;\n  private readonly skills?: boolean;\n  private oauthEnabled = false;\n  private readonly handler: SkybridgeHandler<\n    TTools,\n    Awaited<TConfig>,\n    TAuthExtra\n  >;\n  private readonly setup?: () => TConfig;\n  private readonly oauthInput?: SkybridgeOAuthInput<\n    Awaited<TConfig>,\n    TAuthExtra\n  >;\n  private config?: Awaited<TConfig>;\n  private readonly expressApp: Express;\n  private readonly errorMiddleware: ErrorMiddlewareConfig[] = [];\n  private readonly monitoringEntry: McpMiddlewareEntry | null =\n    createMiddlewareEntry();\n  private resolveResourceMetadataUrl?: ResourceMetadataUrlResolver;\n  private readyPromise?: Promise<void>;\n  private slowHandlerWarned = false;\n\n  constructor({\n    name,\n    title,\n    version,\n    description,\n    icons,\n    websiteUrl,\n    json,\n    skills,\n    setup,\n    oauth,\n    handler,\n    ...serverOptions\n  }: SkybridgeConfig<TTools, TConfig, TAuthExtra>) {\n    this.serverInfo = { name, title, version, description, icons, websiteUrl };\n    this.serverOptions = serverOptions;\n    this.skills = skills;\n    this.setup = setup;\n    this.oauthInput = oauth;\n    this.handler = handler;\n    this.expressApp = createBaseApp(json);\n  }\n\n  /**\n   * Resolve `setup` and `oauth`, then wire OAuth onto the Express app. Runs\n   * once; every entry point that needs a built server awaits it, and a failed\n   * attempt is retried on the next call.\n   *\n   * @internal\n   */\n  ready(): Promise<void> {\n    this.readyPromise ??= (async () => {\n      if (this.setup) {\n        this.config = await this.setup();\n      }\n      const oauth = await resolveOAuthInput(\n        this.oauthInput,\n        this.config as Awaited<TConfig>,\n      );\n      this.oauthEnabled = Boolean(oauth);\n      const sample = this.buildServer();\n      if (oauth) {\n        this.resolveResourceMetadataUrl = setupOAuth(\n          this.expressApp,\n          oauth,\n          sample.securitySchemesByTool,\n        );\n      }\n    })().catch((error) => {\n      this.readyPromise = undefined;\n      throw error;\n    });\n    return this.readyPromise;\n  }\n\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `app.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied — tune it via the `json` config field,\n   * e.g. `new Skybridge({ name, version, json: { limit: \"10mb\" }, handler })`.\n   * Register your handlers before `run()`; after `run()`, dev-mode middleware,\n   * the `/mcp` route, and the default error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  get express(): Express {\n    return this.expressApp;\n  }\n\n  /**\n   * Build a fresh server for one stateless HTTP request, as\n   * `createMcpHandler`'s factory contract requires: the handler runs again so\n   * the SDK's handler closures belong to the instance whose protocol era it\n   * stamps. Sharing one instance's handler maps instead would bind them to an\n   * instance that is never marked, pinning every request to the 2025 codec and\n   * letting concurrent callers overwrite each other's negotiated version.\n   *\n   * Awaits `setup` and the `oauth` input on first use.\n   */\n  async createServerInstance(): Promise<SdkServer> {\n    await this.ready();\n    const server = this.buildServer();\n    this.instrumentHandlers(server);\n    return server.server;\n  }\n\n  /**\n   * Connect a Skybridge app to an MCP transport. Use this when you're\n   * embedding Skybridge in a host that already manages its own transport\n   * (e.g. stdio for desktop apps); for HTTP, prefer {@link Skybridge.run}\n   * which sets the transport up for you.\n   */\n  async connect(transport: Parameters<SdkServer[\"connect\"]>[0]): Promise<void> {\n    const instance = await this.createServerInstance();\n    await instance.connect(transport);\n  }\n\n  /**\n   * Register Express middleware on the underlying app. Mirrors `app.use` —\n   * pass handlers directly or a path-prefixed handler list. Register before\n   * {@link Skybridge.run}; ordering matches Express.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work\n   * locally and on self-hosted deployments.\n   */\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.expressApp.use(pathOrHandler, ...handlers);\n    } else {\n      this.expressApp.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  /**\n   * Register Express error-handling middleware to run after the built-in\n   * `/mcp` route (or your custom route). Use this to log or transform errors\n   * thrown by tool handlers before the default error handler responds.\n   *\n   * @example\n   * ```ts\n   * app.useOnError((err, _req, _res, next) => {\n   *   logger.error(err);\n   *   next(err);\n   * });\n   * ```\n   */\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.errorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.errorMiddleware.push({ handlers: [pathOrHandler, ...handlers] });\n    }\n    return this;\n  }\n\n  /**\n   * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),\n   * mounts the `/mcp` route, and applies any custom Express middleware\n   * registered via {@link Skybridge.use} / {@link Skybridge.useOnError}.\n   *\n   * On Cloudflare Workers / workerd, returns an object exposing `fetch` so\n   * the runtime can bridge incoming requests to the Node HTTP server. On\n   * Vercel (`VERCEL === \"1\"`), returns the Express app directly so the\n   * serverless function entry can call it as a `(req, res)` handler. On\n   * Node, returns `undefined` once listening. When the process was spawned\n   * with an IPC channel, the bound port is reported to the parent as\n   * `{ type: \"skybridge:listening\", port }`, the readiness signal test runners\n   * wait on instead of polling.\n   */\n  async run(): Promise<\n    { fetch: (...args: unknown[]) => unknown } | Express | undefined\n  > {\n    if (process.env.VERCEL === \"1\") {\n      // createApp only reads httpServer inside its dev-only branch\n      // (viewsDevServer); under VERCEL=1 + NODE_ENV=production it's a\n      // bare object passed to satisfy the required parameter.\n      const httpServer = http.createServer();\n      await createApp({\n        app: this,\n        httpServer,\n        errorMiddleware: this.errorMiddleware,\n      });\n      return this.expressApp;\n    }\n\n    const httpServer = http.createServer();\n    const mcpHandler = buildMcpHandler(this);\n\n    await createApp({\n      app: this,\n      httpServer,\n      mcpHandler,\n      errorMiddleware: this.errorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.expressApp);\n    const intendedPort = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(intendedPort, () => {\n        resolve();\n      });\n    });\n\n    const { port } = httpServer.address() as AddressInfo;\n    process.send?.({ type: \"skybridge:listening\", port });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      mcpHandler.close().catch(() => {});\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private buildServer(): McpServer<TTools, TAuthExtra> {\n    const server = new McpServer<Record<never, ToolDef>, TAuthExtra>(\n      this.serverInfo,\n      this.serverOptions,\n      { skills: this.skills, oauth: this.oauthEnabled },\n    );\n    if (this.resolveResourceMetadataUrl) {\n      server.setResourceMetadataUrlResolver(this.resolveResourceMetadataUrl);\n    }\n    const startedAt = performance.now();\n    const built = this.handler(server, this.config as Awaited<TConfig>);\n    const elapsed = performance.now() - startedAt;\n    if (typeof (built as { then?: unknown }).then === \"function\") {\n      throw new Error(\n        \"The Skybridge handler must be synchronous — it runs on every request. Load config or secrets in `setup` instead and read them from the handler's second argument.\",\n      );\n    }\n    if (elapsed > SLOW_HANDLER_THRESHOLD_MS && !this.slowHandlerWarned) {\n      this.slowHandlerWarned = true;\n      console.warn(\n        `The Skybridge handler took ${Math.round(elapsed)}ms — it runs on every request, so this cost is paid per request. Move expensive work into \\`setup\\`, whose result is passed to the handler.`,\n      );\n    }\n    return built;\n  }\n\n  private middlewareEntries(\n    server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n  ): McpMiddlewareEntry[] {\n    return [\n      ...(this.monitoringEntry ? [this.monitoringEntry] : []),\n      ...server.protocolMiddlewareEntries(),\n    ];\n  }\n\n  private instrumentHandlers(\n    server: McpServer<Record<never, ToolDef>, TAuthExtra>,\n  ): void {\n    const entries = this.middlewareEntries(server);\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      server.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n}\n"]}

package/dist/server/app.test.js

@@ -0,0 +1,97 @@
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { describe, expect, it } from "vitest";
+import { Skybridge } from "./app.js";
+const oauthConfig = {
+    oauthMetadata: {
+        issuer: "https://issuer.example.com",
+        authorization_endpoint: "https://issuer.example.com/authorize",
+        token_endpoint: "https://issuer.example.com/token",
+        response_types_supported: ["code"],
+    },
+    verifier: {
+        verifyAccessToken: async () => ({
+            token: "t",
+            clientId: "c",
+            scopes: [],
+            extra: {},
+        }),
+    },
+};
+describe("Skybridge setup and handler", () => {
+    it("resolves setup once and passes the context to the per-request handler", async () => {
+        let loads = 0;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: async () => {
+                loads++;
+                return { greeting: await Promise.resolve("hello") };
+            },
+            handler: (server, { greeting }) => server.registerTool({ name: "greet", description: "greet" }, async () => ({ content: [{ type: "text", text: greeting }] })),
+        });
+        expect(loads).toBe(0);
+        const call = async () => {
+            const client = new Client({ name: "client", version: "1.0.0" });
+            const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+            await app.connect(serverTransport);
+            await client.connect(clientTransport);
+            const result = await client.callTool({ name: "greet" });
+            await client.close();
+            return result;
+        };
+        expect(await call()).toMatchObject({
+            content: [{ type: "text", text: "hello" }],
+        });
+        expect(await call()).toMatchObject({
+            content: [{ type: "text", text: "hello" }],
+        });
+        expect(loads).toBe(1);
+    });
+    it("retries setup after a failed first resolution", async () => {
+        let attempts = 0;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: async () => {
+                attempts++;
+                if (attempts === 1) {
+                    throw new Error("transient");
+                }
+            },
+            handler: (server) => server,
+        });
+        const [, first] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(first)).rejects.toThrow("transient");
+        const [, second] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(second)).resolves.toBeUndefined();
+        expect(attempts).toBe(2);
+    });
+    it("rejects a handler that returns a promise", async () => {
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            // @ts-expect-error the handler runs per request and must stay synchronous
+            handler: async (server) => server,
+        });
+        const [, serverTransport] = InMemoryTransport.createLinkedPair();
+        await expect(app.connect(serverTransport)).rejects.toThrow(/must be synchronous/);
+    });
+    it("resolves an oauth function with the setup config before wiring the routes", async () => {
+        let seen;
+        const app = new Skybridge({
+            name: "test",
+            version: "1.0.0",
+            setup: () => ({ issuer: "https://issuer.example.com" }),
+            oauth: (config) => {
+                seen = config;
+                return oauthConfig;
+            },
+            handler: (server) => server,
+        });
+        expect(seen).toBeUndefined();
+        const [, serverTransport] = InMemoryTransport.createLinkedPair();
+        await app.connect(serverTransport);
+        expect(seen).toEqual({ issuer: "https://issuer.example.com" });
+    });
+});
+//# sourceMappingURL=app.test.js.map

package/dist/server/app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.test.js","sourceRoot":"","sources":["../../src/server/app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,WAAW,GAAG;IAClB,aAAa,EAAE;QACb,MAAM,EAAE,4BAA4B;QACpC,sBAAsB,EAAE,sCAAsC;QAC9D,cAAc,EAAE,kCAAkC;QAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC;IACD,QAAQ,EAAE;QACR,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9B,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE;SACV,CAAC;KACH;CACF,CAAC;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EACvC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAC9D;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;YACvC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,QAAQ,EAAE,CAAC;gBACX,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,0EAA0E;YAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxD,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,IAAI,IAAa,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACvD,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBAChB,IAAI,GAAG,MAAM,CAAC;gBACd,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client, InMemoryTransport } from \"@modelcontextprotocol/client\";\nimport { describe, expect, it } from \"vitest\";\nimport { Skybridge } from \"./app.js\";\n\nconst oauthConfig = {\n  oauthMetadata: {\n    issuer: \"https://issuer.example.com\",\n    authorization_endpoint: \"https://issuer.example.com/authorize\",\n    token_endpoint: \"https://issuer.example.com/token\",\n    response_types_supported: [\"code\"],\n  },\n  verifier: {\n    verifyAccessToken: async () => ({\n      token: \"t\",\n      clientId: \"c\",\n      scopes: [],\n      extra: {},\n    }),\n  },\n};\n\ndescribe(\"Skybridge setup and handler\", () => {\n  it(\"resolves setup once and passes the context to the per-request handler\", async () => {\n    let loads = 0;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: async () => {\n        loads++;\n        return { greeting: await Promise.resolve(\"hello\") };\n      },\n      handler: (server, { greeting }) =>\n        server.registerTool(\n          { name: \"greet\", description: \"greet\" },\n          async () => ({ content: [{ type: \"text\", text: greeting }] }),\n        ),\n    });\n\n    expect(loads).toBe(0);\n\n    const call = async () => {\n      const client = new Client({ name: \"client\", version: \"1.0.0\" });\n      const [clientTransport, serverTransport] =\n        InMemoryTransport.createLinkedPair();\n      await app.connect(serverTransport);\n      await client.connect(clientTransport);\n      const result = await client.callTool({ name: \"greet\" });\n      await client.close();\n      return result;\n    };\n\n    expect(await call()).toMatchObject({\n      content: [{ type: \"text\", text: \"hello\" }],\n    });\n    expect(await call()).toMatchObject({\n      content: [{ type: \"text\", text: \"hello\" }],\n    });\n    expect(loads).toBe(1);\n  });\n\n  it(\"retries setup after a failed first resolution\", async () => {\n    let attempts = 0;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: async () => {\n        attempts++;\n        if (attempts === 1) {\n          throw new Error(\"transient\");\n        }\n      },\n      handler: (server) => server,\n    });\n\n    const [, first] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(first)).rejects.toThrow(\"transient\");\n\n    const [, second] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(second)).resolves.toBeUndefined();\n    expect(attempts).toBe(2);\n  });\n\n  it(\"rejects a handler that returns a promise\", async () => {\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      // @ts-expect-error the handler runs per request and must stay synchronous\n      handler: async (server) => server,\n    });\n    const [, serverTransport] = InMemoryTransport.createLinkedPair();\n    await expect(app.connect(serverTransport)).rejects.toThrow(\n      /must be synchronous/,\n    );\n  });\n\n  it(\"resolves an oauth function with the setup config before wiring the routes\", async () => {\n    let seen: unknown;\n    const app = new Skybridge({\n      name: \"test\",\n      version: \"1.0.0\",\n      setup: () => ({ issuer: \"https://issuer.example.com\" }),\n      oauth: (config) => {\n        seen = config;\n        return oauthConfig;\n      },\n      handler: (server) => server,\n    });\n\n    expect(seen).toBeUndefined();\n    const [, serverTransport] = InMemoryTransport.createLinkedPair();\n    await app.connect(serverTransport);\n    expect(seen).toEqual({ issuer: \"https://issuer.example.com\" });\n  });\n});\n"]}

package/dist/server/auth/discovery.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 /**
  * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
  * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
@@ -24,6 +24,7 @@ declare const DiscoverySchema: z.ZodObject<{
     introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
     code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
     client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;

package/dist/server/auth/discovery.js

@@ -1,5 +1,5 @@
-import { OAuthMetadataSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
-import { z } from "zod";
+import { OAuthMetadataSchema } from "@modelcontextprotocol/core";
+import { z } from "zod/v4";
 /**
  * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
  * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but

package/dist/server/auth/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { OAuthMetadataSchema } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { z } from \"zod\";\n\n/**\n * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's\n * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but\n * we need it for JWKS token verification, so we extend the schema to keep it.\n */\nconst DiscoverySchema = OAuthMetadataSchema.extend({\n  jwks_uri: z.string().optional(),\n});\nexport type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const meta = DiscoverySchema.parse(await res.json());\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (meta.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${meta.issuer}`);\n      }\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (meta.registration_endpoint) {\n        return meta;\n      }\n      fallback ??= meta;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B;;;;GAIG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { OAuthMetadataSchema } from \"@modelcontextprotocol/core\";\nimport { z } from \"zod/v4\";\n\n/**\n * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's\n * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but\n * we need it for JWKS token verification, so we extend the schema to keep it.\n */\nconst DiscoverySchema = OAuthMetadataSchema.extend({\n  jwks_uri: z.string().optional(),\n});\nexport type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const meta = DiscoverySchema.parse(await res.json());\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (meta.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${meta.issuer}`);\n      }\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (meta.registration_endpoint) {\n        return meta;\n      }\n      fallback ??= meta;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,15 @@
-import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
-import type { JwksVerifyConfig } from "./verify.js";
-/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
-export type OAuthConfig = {
+import type { OAuthMetadata } from "@modelcontextprotocol/server";
+import type { ExtraClaims, TokenVerifier } from "../auth.js";
+/**
+ * Resource-server OAuth config for the `oauth` field of `SkybridgeConfig`.
+ *
+ * `TExtra` comes from the `verifier` and flows on to tool handlers and
+ * `mcpMiddleware`, so the claim shape is declared once by whoever checks the
+ * token. The branded providers set it from the claims their IdP documents.
+ *
+ * @typeParam TExtra - Claims the verifier populates in `AuthInfo["extra"]`.
+ */
+export type OAuthConfig<TExtra extends ExtraClaims = ExtraClaims> = {
     /**
      * Public URL of this server; sets `resourceServerUrl` and the
      * `resource_metadata` URL. When omitted, it is inferred per request from
@@ -10,9 +18,31 @@ export type OAuthConfig = {
     baseUrl?: string;
     /** AS metadata served at `/.well-known/oauth-authorization-server`. */
     oauthMetadata: OAuthMetadata;
-    verify: JwksVerifyConfig;
     /** Scopes advertised in protected-resource metadata. */
     scopesSupported?: string[];
     /** Server-wide required-scope floor. */
     requiredScopes?: string[];
+    /**
+     * Checks each bearer token. Build one with `createJwksVerifier` for a
+     * JWT-issuing IdP, or supply your own for opaque tokens.
+     */
+    verifier: TokenVerifier<TExtra>;
+};
+/**
+ * What the branded providers return: a deferred {@link OAuthConfig}. Discovery
+ * runs in `resolve`, so `oauth: auth0Provider(...)` at module scope performs
+ * no network access until `Skybridge.run`. Call `resolve` yourself
+ * (`await customProvider(...).resolve()`) when wiring the middleware by hand.
+ *
+ * This is an object rather than a bare `() => Promise<OAuthConfig>` on
+ * purpose. TypeScript defers, during the first inference pass, any argument
+ * that is a call to a generic function returning a function type. The
+ * providers are generic (`workosProvider<TCustom>`), so a function-shaped
+ * return written inline in `new Skybridge({ oauth: workosProvider(...) })`
+ * would be skipped and `TAuthExtra` would fall back to `ExtraClaims`, losing
+ * the claims typing in tool handlers. A non-function shape is inferred
+ * eagerly.
+ */
+export type OAuthProvider<TExtra extends ExtraClaims = ExtraClaims> = {
+    resolve: () => Promise<OAuthConfig<TExtra>>;
 };

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/server\";\nimport type { ExtraClaims, TokenVerifier } from \"../auth.js\";\n\n/**\n * Resource-server OAuth config for the `oauth` field of `SkybridgeConfig`.\n *\n * `TExtra` comes from the `verifier` and flows on to tool handlers and\n * `mcpMiddleware`, so the claim shape is declared once by whoever checks the\n * token. The branded providers set it from the claims their IdP documents.\n *\n * @typeParam TExtra - Claims the verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type OAuthConfig<TExtra extends ExtraClaims = ExtraClaims> = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /**\n   * Checks each bearer token. Build one with `createJwksVerifier` for a\n   * JWT-issuing IdP, or supply your own for opaque tokens.\n   */\n  verifier: TokenVerifier<TExtra>;\n};\n\n/**\n * What the branded providers return: a deferred {@link OAuthConfig}. Discovery\n * runs in `resolve`, so `oauth: auth0Provider(...)` at module scope performs\n * no network access until `Skybridge.run`. Call `resolve` yourself\n * (`await customProvider(...).resolve()`) when wiring the middleware by hand.\n *\n * This is an object rather than a bare `() => Promise<OAuthConfig>` on\n * purpose. TypeScript defers, during the first inference pass, any argument\n * that is a call to a generic function returning a function type. The\n * providers are generic (`workosProvider<TCustom>`), so a function-shaped\n * return written inline in `new Skybridge({ oauth: workosProvider(...) })`\n * would be skipped and `TAuthExtra` would fall back to `ExtraClaims`, losing\n * the claims typing in tool handlers. A non-function shape is inferred\n * eagerly.\n */\nexport type OAuthProvider<TExtra extends ExtraClaims = ExtraClaims> = {\n  resolve: () => Promise<OAuthConfig<TExtra>>;\n};\n"]}

package/dist/server/auth/providers/auth0.d.ts

@@ -1,5 +1,27 @@
-import type { OAuthConfig } from "../index.js";
+import type { ExtraClaims } from "../../auth.js";
+import type { OAuthProvider } from "../index.js";
+import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
+/**
+ * Claims an Auth0 access token carries for a custom API audience. Auth0 puts no
+ * user attributes beyond the id in the token, so there is no `email`: call
+ * `/userinfo` for the profile. Custom claims must be namespaced (a bare `email`
+ * key is silently dropped), so add them through the type parameter under their
+ * full URI.
+ *
+ * @see https://auth0.com/docs/secure/tokens/access-tokens
+ * @see https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims
+ */
+export type Auth0Claims = {
+    /** Authorized party: the client id the token was issued to. */
+    azp?: string;
+    /** Only when the API has RBAC and "Add Permissions in the Access Token" on. */
+    permissions?: string[];
+    /** Organization id, when the tenant uses Organizations. */
+    org_id?: string;
+    /** Organization name, when the tenant uses Organizations. */
+    org_name?: string;
+};
 /**
  * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
  * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this
@@ -11,8 +33,8 @@ import { type CustomProviderOptions } from "./custom.js";
  * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
  * Auth0 (the token's real `iss`).
  */
-export declare function auth0Provider(opts: {
+export declare function auth0Provider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     domain: string;
     audience: string;
     serverUrl: string;
-} & Omit<CustomProviderOptions, "issuer" | "audience" | "baseUrl" | "serverUrl">): Promise<OAuthConfig>;
+} & Omit<CustomProviderOptions, "issuer" | "audience" | "baseUrl" | "serverUrl">): OAuthProvider<Auth0Claims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/auth0.js

@@ -11,20 +11,25 @@ import { toIssuerUrl } from "./shared.js";
  * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
  * Auth0 (the token's real `iss`).
  */
-export async function auth0Provider(opts) {
+export function auth0Provider(opts) {
     const { domain, audience, ...rest } = opts;
-    const config = await customProvider({
+    const provider = customProvider({
         issuer: toIssuerUrl(domain),
         audience,
         ...rest,
     });
-    const authUrl = new URL(config.oauthMetadata.authorization_endpoint);
-    authUrl.searchParams.set("audience", audience);
     return {
-        ...config,
-        oauthMetadata: {
-            ...config.oauthMetadata,
-            authorization_endpoint: authUrl.href,
+        resolve: async () => {
+            const config = await provider.resolve();
+            const authUrl = new URL(config.oauthMetadata.authorization_endpoint);
+            authUrl.searchParams.set("audience", audience);
+            return {
+                ...config,
+                oauthMetadata: {
+                    ...config.oauthMetadata,
+                    authorization_endpoint: authUrl.href,
+                },
+            };
         },
     };
 }

package/dist/server/auth/providers/auth0.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,QAAQ;QACR,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE;YACb,GAAG,MAAM,CAAC,aAAa;YACvB,sBAAsB,EAAE,OAAO,CAAC,IAAI;SACrC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this\n * server's public URL. Requires DCR enabled on the tenant.\n *\n * Auth0 can't use the client's resource indicator — `audience` must be *in* the\n * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see\n * {@link customProvider}) and bakes `?audience=<id>` into the advertised\n * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays\n * Auth0 (the token's real `iss`).\n */\nexport async function auth0Provider(\n  opts: { domain: string; audience: string; serverUrl: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\" | \"baseUrl\" | \"serverUrl\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, audience, ...rest } = opts;\n  const config = await customProvider({\n    issuer: toIssuerUrl(domain),\n    audience,\n    ...rest,\n  });\n  const authUrl = new URL(config.oauthMetadata.authorization_endpoint);\n  authUrl.searchParams.set(\"audience\", audience);\n  return {\n    ...config,\n    oauthMetadata: {\n      ...config.oauthMetadata,\n      authorization_endpoint: authUrl.href,\n    },\n  };\n}\n"]}
+{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAG3B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAwB;QACrD,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,QAAQ;QACR,GAAG,IAAI;KACR,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;YACrE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO;gBACL,GAAG,MAAM;gBACT,aAAa,EAAE;oBACb,GAAG,MAAM,CAAC,aAAa;oBACvB,sBAAsB,EAAE,OAAO,CAAC,IAAI;iBACrC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims an Auth0 access token carries for a custom API audience. Auth0 puts no\n * user attributes beyond the id in the token, so there is no `email`: call\n * `/userinfo` for the profile. Custom claims must be namespaced (a bare `email`\n * key is silently dropped), so add them through the type parameter under their\n * full URI.\n *\n * @see https://auth0.com/docs/secure/tokens/access-tokens\n * @see https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims\n */\nexport type Auth0Claims = {\n  /** Authorized party: the client id the token was issued to. */\n  azp?: string;\n  /** Only when the API has RBAC and \"Add Permissions in the Access Token\" on. */\n  permissions?: string[];\n  /** Organization id, when the tenant uses Organizations. */\n  org_id?: string;\n  /** Organization name, when the tenant uses Organizations. */\n  org_name?: string;\n};\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this\n * server's public URL. Requires DCR enabled on the tenant.\n *\n * Auth0 can't use the client's resource indicator — `audience` must be *in* the\n * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see\n * {@link customProvider}) and bakes `?audience=<id>` into the advertised\n * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays\n * Auth0 (the token's real `iss`).\n */\nexport function auth0Provider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string; serverUrl: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\" | \"baseUrl\" | \"serverUrl\"\n  >,\n): OAuthProvider<Auth0Claims & TCustom & RegisteredClaims> {\n  const { domain, audience, ...rest } = opts;\n  const provider = customProvider<Auth0Claims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    audience,\n    ...rest,\n  });\n  return {\n    resolve: async () => {\n      const config = await provider.resolve();\n      const authUrl = new URL(config.oauthMetadata.authorization_endpoint);\n      authUrl.searchParams.set(\"audience\", audience);\n      return {\n        ...config,\n        oauthMetadata: {\n          ...config.oauthMetadata,\n          authorization_endpoint: authUrl.href,\n        },\n      };\n    },\n  };\n}\n"]}