skybridge 0.0.0-dev.f03017e → 0.0.0-dev.f0394fc

package/dist/server/events.test.js

@@ -0,0 +1,172 @@
+import { createHmac, randomBytes } from "node:crypto";
+import http from "node:http";
+import net, {} from "node:net";
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
+import { afterEach, describe, expect, it } from "vitest";
+import { z } from "zod";
+import { deliverEvent, Skybridge } from "./index.js";
+async function startReceiver() {
+    const received = [];
+    const state = { dropResponses: false };
+    const server = http.createServer((req, res) => {
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk;
+        });
+        req.on("end", () => {
+            received.push({ headers: req.headers, body });
+            if (state.dropResponses) {
+                res.writeHead(200, { "content-length": "1000" });
+                res.write("partial");
+                setTimeout(() => res.socket?.destroy(), 20);
+                return;
+            }
+            const parsed = JSON.parse(body);
+            res.setHeader("content-type", "application/json");
+            res.end(parsed.type === "verification"
+                ? JSON.stringify({ challenge: parsed.challenge })
+                : "{}");
+        });
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const { port } = server.address();
+    return { url: `http://127.0.0.1:${port}/hooks`, received, server, state };
+}
+let cleanup;
+afterEach(async () => {
+    await cleanup?.();
+    cleanup = undefined;
+});
+describe("MCP events", () => {
+    it("verifies the callback, hands the subscription to the hooks, and delivers signed events", async () => {
+        const receiver = await startReceiver();
+        const subscriptions = new Map();
+        const app = new Skybridge({
+            name: "t",
+            version: "0.0.1",
+            handler: (server) => server.registerEvent({
+                name: "comment.created",
+                inputSchema: { documentId: z.string() },
+                payloadSchema: { documentId: z.string(), excerpt: z.string() },
+            }, {
+                onSubscribe: (_args, { subscription }) => {
+                    subscriptions.set(subscription.id, subscription);
+                },
+                onUnsubscribe: (_args, { subscription }) => {
+                    subscriptions.delete(subscription.id);
+                },
+            }),
+        });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        const send = clientTransport.send.bind(clientTransport);
+        clientTransport.send = (message) => send(message, {
+            authInfo: {
+                token: "t",
+                clientId: "chatgpt",
+                scopes: [],
+                extra: { subject: "user-1" },
+            },
+        });
+        const instance = await app.createServerInstance();
+        await instance.connect(serverTransport);
+        const client = new Client({ name: "c", version: "0.0.1" });
+        await client.connect(clientTransport);
+        cleanup = async () => {
+            await client.close();
+            await instance.close();
+            receiver.server.close();
+        };
+        expect(instance.getCapabilities().events).toEqual({});
+        const list = await client.request({ method: "events/list", params: {} }, z.object({
+            events: z.array(z.object({ name: z.string(), delivery: z.array(z.string()) })),
+        }));
+        expect(list.events).toEqual([
+            expect.objectContaining({
+                name: "comment.created",
+                delivery: ["webhook"],
+            }),
+        ]);
+        const secret = `whsec_${randomBytes(32).toString("base64")}`;
+        const subscription = await client.request({
+            method: "events/subscribe",
+            params: {
+                name: "comment.created",
+                arguments: { documentId: "doc-1" },
+                delivery: { mode: "webhook", url: receiver.url, secret },
+            },
+        }, z.object({ id: z.string(), refreshBefore: z.string() }));
+        expect(receiver.received.map(({ body }) => JSON.parse(body).type)).toEqual([
+            "verification",
+        ]);
+        const stored = subscriptions.get(subscription.id);
+        expect(stored).toMatchObject({ url: receiver.url, secret });
+        if (!stored) {
+            return;
+        }
+        await expect(deliverEvent(stored, {
+            name: "comment.created",
+            id: "evt_1",
+            data: { documentId: "doc-1", excerpt: "hello" },
+        })).resolves.toEqual({ ok: true });
+        expect(receiver.received).toHaveLength(2);
+        const [, delivery] = receiver.received;
+        expect(JSON.parse(delivery?.body ?? "")).toMatchObject({
+            eventId: "evt_1",
+            name: "comment.created",
+            data: { documentId: "doc-1", excerpt: "hello" },
+        });
+        const headers = delivery?.headers ?? {};
+        expect(headers["x-mcp-subscription-id"]).toBe(subscription.id);
+        const expected = createHmac("sha256", Buffer.from(secret.slice(6), "base64"))
+            .update(`${headers["webhook-id"]}.${headers["webhook-timestamp"]}.${delivery?.body}`)
+            .digest("base64");
+        expect(headers["webhook-signature"]).toBe(`v1,${expected}`);
+        receiver.state.dropResponses = true;
+        const delivered = deliverEvent(stored, {
+            name: "comment.created",
+            id: "evt_2",
+            data: { documentId: "doc-1", excerpt: "dropped" },
+        });
+        await expect(Promise.race([
+            delivered,
+            new Promise((resolve) => setTimeout(() => resolve("hung"), 2_000)),
+        ])).resolves.toMatchObject({ ok: false, retryable: true });
+        await client.request({
+            method: "events/unsubscribe",
+            params: {
+                name: "comment.created",
+                arguments: { documentId: "doc-1" },
+                delivery: { url: receiver.url },
+            },
+        }, z.object({}));
+        expect(subscriptions.size).toBe(0);
+        let connections = 0;
+        const privateTarget = net.createServer((socket) => {
+            connections += 1;
+            socket.destroy();
+        });
+        await new Promise((resolve) => privateTarget.listen(0, "127.0.0.1", resolve));
+        const { port: privatePort } = privateTarget.address();
+        const nodeEnv = process.env.NODE_ENV;
+        process.env.NODE_ENV = "production";
+        try {
+            await expect(client.request({
+                method: "events/subscribe",
+                params: {
+                    name: "comment.created",
+                    arguments: { documentId: "doc-1" },
+                    delivery: {
+                        url: `https://127.0.0.1:${privatePort}/hooks`,
+                        secret,
+                    },
+                },
+            }, z.object({}))).rejects.toMatchObject({ code: -32015 });
+            expect(connections).toBe(0);
+        }
+        finally {
+            process.env.NODE_ENV = nodeEnv;
+            privateTarget.close();
+        }
+    });
+});
+//# sourceMappingURL=events.test.js.map

package/dist/server/events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.test.js","sourceRoot":"","sources":["../../src/server/events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,EAAE,EAAoB,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAA0B,SAAS,EAAE,MAAM,YAAY,CAAC;AAI7E,KAAK,UAAU,aAAa;IAC1B,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACrB,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CACL,MAAM,CAAC,IAAI,KAAK,cAAc;gBAC5B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACjD,CAAC,CAAC,IAAI,CACT,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,oBAAoB,IAAI,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC5E,CAAC;AAED,IAAI,OAA0C,CAAC;AAC/C,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,EAAE,CAAC;IAClB,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,aAAa,CAClB;gBACE,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBACvC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;aAC/D,EACD;gBACE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;oBACvC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;gBACnD,CAAC;gBACD,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;oBACzC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBACxC,CAAC;aACF,CACF;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxD,eAAe,CAAC,IAAI,GAAG,CAAC,OAAuB,EAAE,EAAE,CACjD,IAAI,CAAC,OAAO,EAAE;YACZ,QAAQ,EAAE;gBACR,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;aAC7B;SACF,CAAC,CAAC;QACL,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,OAAO,GAAG,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC,CAAC;QAEF,MAAM,CACH,QAAQ,CAAC,eAAe,EAA8B,CAAC,MAAM,CAC/D,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,EACrC,CAAC,CAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAC9D;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC1B,MAAM,CAAC,gBAAgB,CAAC;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,OAAO,CACvC;YACE,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE;gBACN,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;gBAClC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE;aACzD;SACF,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CACV,YAAY,CAAC,MAAM,EAAE;YACnB,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;SAChD,CAAC,CACH,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACrD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,OAAO,GAA6B,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CACzB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CACvC;aACE,MAAM,CACL,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,QAAQ,EAAE,IAAI,EAAE,CAC7E;aACA,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;QAE5D,QAAQ,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;QACpC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE;YACrC,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC;YACX,SAAS;YACT,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;SACnE,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,CAAC,OAAO,CAClB;YACE,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE;gBACN,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;gBAClC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;aAChC;SACF,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACb,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAC9C,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,OAAO,EAAiB,CAAC;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CACV,MAAM,CAAC,OAAO,CACZ;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE;oBACN,IAAI,EAAE,iBAAiB;oBACvB,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;oBAClC,QAAQ,EAAE;wBACR,GAAG,EAAE,qBAAqB,WAAW,QAAQ;wBAC7C,MAAM;qBACP;iBACF;aACF,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACb,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC/B,aAAa,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { createHmac, randomBytes } from \"node:crypto\";\nimport http from \"node:http\";\nimport net, { type AddressInfo } from \"node:net\";\nimport { Client, InMemoryTransport } from \"@modelcontextprotocol/client\";\nimport type { JSONRPCMessage } from \"@modelcontextprotocol/server\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { z } from \"zod\";\nimport { deliverEvent, type EventSubscription, Skybridge } from \"./index.js\";\n\ntype Received = { headers: http.IncomingHttpHeaders; body: string };\n\nasync function startReceiver() {\n  const received: Received[] = [];\n  const state = { dropResponses: false };\n  const server = http.createServer((req, res) => {\n    let body = \"\";\n    req.on(\"data\", (chunk) => {\n      body += chunk;\n    });\n    req.on(\"end\", () => {\n      received.push({ headers: req.headers, body });\n      if (state.dropResponses) {\n        res.writeHead(200, { \"content-length\": \"1000\" });\n        res.write(\"partial\");\n        setTimeout(() => res.socket?.destroy(), 20);\n        return;\n      }\n      const parsed = JSON.parse(body);\n      res.setHeader(\"content-type\", \"application/json\");\n      res.end(\n        parsed.type === \"verification\"\n          ? JSON.stringify({ challenge: parsed.challenge })\n          : \"{}\",\n      );\n    });\n  });\n  await new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const { port } = server.address() as AddressInfo;\n  return { url: `http://127.0.0.1:${port}/hooks`, received, server, state };\n}\n\nlet cleanup: (() => Promise<void>) | undefined;\nafterEach(async () => {\n  await cleanup?.();\n  cleanup = undefined;\n});\n\ndescribe(\"MCP events\", () => {\n  it(\"verifies the callback, hands the subscription to the hooks, and delivers signed events\", async () => {\n    const receiver = await startReceiver();\n    const subscriptions = new Map<string, EventSubscription>();\n    const app = new Skybridge({\n      name: \"t\",\n      version: \"0.0.1\",\n      handler: (server) =>\n        server.registerEvent(\n          {\n            name: \"comment.created\",\n            inputSchema: { documentId: z.string() },\n            payloadSchema: { documentId: z.string(), excerpt: z.string() },\n          },\n          {\n            onSubscribe: (_args, { subscription }) => {\n              subscriptions.set(subscription.id, subscription);\n            },\n            onUnsubscribe: (_args, { subscription }) => {\n              subscriptions.delete(subscription.id);\n            },\n          },\n        ),\n    });\n\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    const send = clientTransport.send.bind(clientTransport);\n    clientTransport.send = (message: JSONRPCMessage) =>\n      send(message, {\n        authInfo: {\n          token: \"t\",\n          clientId: \"chatgpt\",\n          scopes: [],\n          extra: { subject: \"user-1\" },\n        },\n      });\n    const instance = await app.createServerInstance();\n    await instance.connect(serverTransport);\n    const client = new Client({ name: \"c\", version: \"0.0.1\" });\n    await client.connect(clientTransport);\n    cleanup = async () => {\n      await client.close();\n      await instance.close();\n      receiver.server.close();\n    };\n\n    expect(\n      (instance.getCapabilities() as Record<string, unknown>).events,\n    ).toEqual({});\n    const list = await client.request(\n      { method: \"events/list\", params: {} },\n      z.object({\n        events: z.array(\n          z.object({ name: z.string(), delivery: z.array(z.string()) }),\n        ),\n      }),\n    );\n    expect(list.events).toEqual([\n      expect.objectContaining({\n        name: \"comment.created\",\n        delivery: [\"webhook\"],\n      }),\n    ]);\n\n    const secret = `whsec_${randomBytes(32).toString(\"base64\")}`;\n    const subscription = await client.request(\n      {\n        method: \"events/subscribe\",\n        params: {\n          name: \"comment.created\",\n          arguments: { documentId: \"doc-1\" },\n          delivery: { mode: \"webhook\", url: receiver.url, secret },\n        },\n      },\n      z.object({ id: z.string(), refreshBefore: z.string() }),\n    );\n    expect(receiver.received.map(({ body }) => JSON.parse(body).type)).toEqual([\n      \"verification\",\n    ]);\n\n    const stored = subscriptions.get(subscription.id);\n    expect(stored).toMatchObject({ url: receiver.url, secret });\n    if (!stored) {\n      return;\n    }\n    await expect(\n      deliverEvent(stored, {\n        name: \"comment.created\",\n        id: \"evt_1\",\n        data: { documentId: \"doc-1\", excerpt: \"hello\" },\n      }),\n    ).resolves.toEqual({ ok: true });\n\n    expect(receiver.received).toHaveLength(2);\n    const [, delivery] = receiver.received;\n    expect(JSON.parse(delivery?.body ?? \"\")).toMatchObject({\n      eventId: \"evt_1\",\n      name: \"comment.created\",\n      data: { documentId: \"doc-1\", excerpt: \"hello\" },\n    });\n    const headers: http.IncomingHttpHeaders = delivery?.headers ?? {};\n    expect(headers[\"x-mcp-subscription-id\"]).toBe(subscription.id);\n    const expected = createHmac(\n      \"sha256\",\n      Buffer.from(secret.slice(6), \"base64\"),\n    )\n      .update(\n        `${headers[\"webhook-id\"]}.${headers[\"webhook-timestamp\"]}.${delivery?.body}`,\n      )\n      .digest(\"base64\");\n    expect(headers[\"webhook-signature\"]).toBe(`v1,${expected}`);\n\n    receiver.state.dropResponses = true;\n    const delivered = deliverEvent(stored, {\n      name: \"comment.created\",\n      id: \"evt_2\",\n      data: { documentId: \"doc-1\", excerpt: \"dropped\" },\n    });\n    await expect(\n      Promise.race([\n        delivered,\n        new Promise((resolve) => setTimeout(() => resolve(\"hung\"), 2_000)),\n      ]),\n    ).resolves.toMatchObject({ ok: false, retryable: true });\n\n    await client.request(\n      {\n        method: \"events/unsubscribe\",\n        params: {\n          name: \"comment.created\",\n          arguments: { documentId: \"doc-1\" },\n          delivery: { url: receiver.url },\n        },\n      },\n      z.object({}),\n    );\n    expect(subscriptions.size).toBe(0);\n\n    let connections = 0;\n    const privateTarget = net.createServer((socket) => {\n      connections += 1;\n      socket.destroy();\n    });\n    await new Promise<void>((resolve) =>\n      privateTarget.listen(0, \"127.0.0.1\", resolve),\n    );\n    const { port: privatePort } = privateTarget.address() as AddressInfo;\n    const nodeEnv = process.env.NODE_ENV;\n    process.env.NODE_ENV = \"production\";\n    try {\n      await expect(\n        client.request(\n          {\n            method: \"events/subscribe\",\n            params: {\n              name: \"comment.created\",\n              arguments: { documentId: \"doc-1\" },\n              delivery: {\n                url: `https://127.0.0.1:${privatePort}/hooks`,\n                secret,\n              },\n            },\n          },\n          z.object({}),\n        ),\n      ).rejects.toMatchObject({ code: -32015 });\n      expect(connections).toBe(0);\n    } finally {\n      process.env.NODE_ENV = nodeEnv;\n      privateTarget.close();\n    }\n  });\n});\n"]}

package/dist/server/express.d.ts

@@ -1,15 +1,32 @@
 import type http from "node:http";
+import { type McpHttpHandler } from "@modelcontextprotocol/server";
 import express from "express";
-import type { McpServer } from "./server.js";
-export declare function createApp({ mcpServer, httpServer, customMiddleware, errorMiddleware, }: {
-    mcpServer: McpServer;
+import type { Skybridge } from "./app.js";
+import type { JsonOptions } from "./server.js";
+type SkybridgeApp = Pick<Skybridge, "express" | "createServerInstance" | "ready">;
+/**
+ * The `/mcp` fetch handler for a {@link Skybridge} app: a `Request` →
+ * `Response` function that builds a fresh MCP server per request.
+ *
+ * @internal
+ */
+export declare function buildMcpHandler(skybridgeApp: SkybridgeApp, onMcpError?: (error: Error) => void): McpHttpHandler;
+/**
+ * Build the bare Express app a {@link Skybridge} instance owns: the instance
+ * plus the built-in `express.json()` body parser, tuned by the `json` config
+ * field.
+ *
+ * @internal
+ */
+export declare function createBaseApp(json?: JsonOptions): express.Express;
+export declare function createApp({ app: skybridgeApp, httpServer, mcpHandler, onMcpError, errorMiddleware, }: {
+    app: SkybridgeApp;
     httpServer: http.Server;
-    customMiddleware?: {
-        path?: string;
-        handlers: express.RequestHandler[];
-    }[];
+    mcpHandler?: McpHttpHandler;
+    onMcpError?: (error: Error) => void;
     errorMiddleware?: {
         path?: string;
         handlers: express.ErrorRequestHandler[];
     }[];
 }): Promise<express.Express>;
+export {};

package/dist/server/express.js

@@ -1,7 +1,52 @@
 import path from "node:path";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { createMcpHandler, UnsupportedProtocolVersionError, } from "@modelcontextprotocol/server";
 import cors from "cors";
 import express from "express";
+const logMcpError = (error) => {
+    if (error instanceof UnsupportedProtocolVersionError) {
+        return;
+    }
+    console.error("Error handling MCP request:", error);
+};
+/**
+ * The `/mcp` fetch handler for a {@link Skybridge} app: a `Request` →
+ * `Response` function that builds a fresh MCP server per request.
+ *
+ * @internal
+ */
+export function buildMcpHandler(skybridgeApp, onMcpError = logMcpError) {
+    return createMcpHandler(() => skybridgeApp.createServerInstance(), {
+        onerror: onMcpError,
+    });
+}
+/**
+ * Build the bare Express app a {@link Skybridge} instance owns: the instance
+ * plus the built-in `express.json()` body parser, tuned by the `json` config
+ * field.
+ *
+ * @internal
+ */
+export function createBaseApp(json) {
+    const app = express();
+    app.disable("x-powered-by");
+    app.use((_req, res, next) => {
+        res.setHeader("X-Powered-By", "skybridge");
+        next();
+    });
+    app.use(express.json(json));
+    return app;
+}
+function parseControlPort(raw) {
+    if (raw === undefined) {
+        return null;
+    }
+    const n = Number.parseInt(raw, 10);
+    if (!Number.isFinite(n) || n <= 0 || n >= 65536) {
+        return null;
+    }
+    return n;
+}
 function applyMiddlewares(app, middlewares) {
     for (const middleware of middlewares) {
         if (middleware.path) {
@@ -22,52 +67,43 @@ function defaultErrorHandler(err, _req, res, _next) {
         });
     }
 }
-export async function createApp({ mcpServer, httpServer, customMiddleware = [], errorMiddleware = [], }) {
-    const app = express();
-    app.use(express.json());
-    const env = process.env.NODE_ENV || "development";
-    applyMiddlewares(app, customMiddleware);
-    if (env !== "production") {
+export async function createApp({ app: skybridgeApp, httpServer, mcpHandler, onMcpError, errorMiddleware = [], }) {
+    await skybridgeApp.ready();
+    const app = skybridgeApp.express;
+    // Read `process.env.NODE_ENV` inline: wrangler/esbuild only substitute the literal expression,
+    // so a local const would defeat dead-code elimination of the dev-only imports below.
+    if (process.env.NODE_ENV !== "production") {
         const { devtoolsStaticServer } = await import("@skybridge/devtools");
         app.use(await devtoolsStaticServer());
         const { viewsDevServer } = await import("./viewsDevServer.js");
         app.use(await viewsDevServer(httpServer));
+        const controlPort = parseControlPort(process.env.__TUNNEL_CONTROL_PORT);
+        if (controlPort !== null) {
+            const { createTunnelProxyRouter } = await import("./tunnel-proxy-router.js");
+            app.use(createTunnelProxyRouter(controlPort));
+        }
+        else if (process.env.__TUNNEL_CONTROL_PORT !== undefined) {
+            console.warn(`Ignoring invalid __TUNNEL_CONTROL_PORT=${process.env.__TUNNEL_CONTROL_PORT}`);
+        }
     }
-    if (env === "production") {
+    else {
         const assetsPath = path.join(process.cwd(), "dist", "assets");
         app.use("/assets", cors());
         app.use("/assets", express.static(assetsPath));
     }
-    app.use("/mcp", mcpMiddleware(mcpServer));
+    app.use("/mcp", mcpMiddleware(mcpHandler ?? buildMcpHandler(skybridgeApp, onMcpError), onMcpError));
     applyMiddlewares(app, errorMiddleware);
     app.use("/mcp", defaultErrorHandler);
     return app;
 }
-const mcpMiddleware = (server) => {
+const mcpMiddleware = (mcpHandler, onMcpError) => {
+    const handler = toNodeHandler(mcpHandler, onMcpError ? { onerror: onMcpError } : undefined);
     return async (req, res, next) => {
-        if (req.method !== "POST") {
-            res.writeHead(405).end(JSON.stringify({
-                jsonrpc: "2.0",
-                error: {
-                    code: -32000,
-                    message: "Method not allowed.",
-                },
-                id: null,
-            }));
-            return;
-        }
         try {
-            const transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: undefined,
-            });
-            res.on("close", () => {
-                transport.close();
-            });
-            await server.connectStatelessTransport(transport);
             // Express strips the mount path from req.url (e.g. "/mcp" becomes "/").
-            // Restore it so the SDK builds the correct requestInfo.url.
+            // Restore it so the SDK builds the correct request URL.
             req.url = req.originalUrl;
-            await transport.handleRequest(req, res, req.body);
+            await handler(req, res, req.body);
         }
         catch (error) {
             next(error);

package/dist/server/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/server/express.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,SAAS,gBAAgB,CACvB,GAAoB,EACpB,WAGE;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAY,EACZ,IAAqB,EACrB,GAAqB,EACrB,KAA2B;IAE3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;YACzD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,SAAS,EACT,UAAU,EACV,gBAAgB,GAAG,EAAE,EACrB,eAAe,GAAG,EAAE,GASrB;IACC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAElD,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAExC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE9D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1C,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAEvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,MAAiB,EAA0B,EAAE;IAClE,OAAO,KAAK,EACV,GAAoB,EACpB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CACpB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,qBAAqB;iBAC/B;gBACD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;aAC9B,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,SAAS,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAClD,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/server/express.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAEhB,+BAA+B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,SAAS,CAAC;AAS9B,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,EAAE;IACnC,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,aAAqC,WAAW;IAEhD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE;QACjE,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoB,EACpB,WAGE;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAY,EACZ,IAAqB,EACrB,GAAqB,EACrB,KAA2B;IAE3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;YACzD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,GAAG,EAAE,YAAY,EACjB,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAAG,EAAE,GAUrB;IACC,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC;IAEjC,+FAA+F;IAC/F,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACxE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC9C,0BAA0B,CAC3B,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CACV,0CAA0C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE9D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,GAAG,CACL,MAAM,EACN,aAAa,CACX,UAAU,IAAI,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,EACvD,UAAU,CACX,CACF,CAAC;IAEF,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAEvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CACpB,UAA0B,EAC1B,UAAmC,EACX,EAAE;IAC1B,MAAM,OAAO,GAAG,aAAa,CAC3B,UAAU,EACV,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;IAEF,OAAO,KAAK,EACV,GAAoB,EACpB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,CAAC;YACH,wEAAwE;YACxE,wDAAwD;YACxD,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport { toNodeHandler } from \"@modelcontextprotocol/node\";\nimport {\n  createMcpHandler,\n  type McpHttpHandler,\n  UnsupportedProtocolVersionError,\n} from \"@modelcontextprotocol/server\";\nimport cors from \"cors\";\nimport express from \"express\";\nimport type { Skybridge } from \"./app.js\";\nimport type { JsonOptions } from \"./server.js\";\n\ntype SkybridgeApp = Pick<\n  Skybridge,\n  \"express\" | \"createServerInstance\" | \"ready\"\n>;\n\nconst logMcpError = (error: Error) => {\n  if (error instanceof UnsupportedProtocolVersionError) {\n    return;\n  }\n  console.error(\"Error handling MCP request:\", error);\n};\n\n/**\n * The `/mcp` fetch handler for a {@link Skybridge} app: a `Request` →\n * `Response` function that builds a fresh MCP server per request.\n *\n * @internal\n */\nexport function buildMcpHandler(\n  skybridgeApp: SkybridgeApp,\n  onMcpError: (error: Error) => void = logMcpError,\n): McpHttpHandler {\n  return createMcpHandler(() => skybridgeApp.createServerInstance(), {\n    onerror: onMcpError,\n  });\n}\n\n/**\n * Build the bare Express app a {@link Skybridge} instance owns: the instance\n * plus the built-in `express.json()` body parser, tuned by the `json` config\n * field.\n *\n * @internal\n */\nexport function createBaseApp(json?: JsonOptions): express.Express {\n  const app = express();\n  app.disable(\"x-powered-by\");\n  app.use((_req, res, next) => {\n    res.setHeader(\"X-Powered-By\", \"skybridge\");\n    next();\n  });\n  app.use(express.json(json));\n  return app;\n}\n\nfunction parseControlPort(raw: string | undefined): number | null {\n  if (raw === undefined) {\n    return null;\n  }\n  const n = Number.parseInt(raw, 10);\n  if (!Number.isFinite(n) || n <= 0 || n >= 65536) {\n    return null;\n  }\n  return n;\n}\n\nfunction applyMiddlewares(\n  app: express.Express,\n  middlewares: Array<{\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }>,\n): void {\n  for (const middleware of middlewares) {\n    if (middleware.path) {\n      app.use(middleware.path, ...middleware.handlers);\n    } else {\n      app.use(...middleware.handlers);\n    }\n  }\n}\n\nfunction defaultErrorHandler(\n  err: unknown,\n  _req: express.Request,\n  res: express.Response,\n  _next: express.NextFunction,\n) {\n  console.error(\"Error handling MCP request:\", err);\n  if (!res.headersSent) {\n    res.status(500).json({\n      jsonrpc: \"2.0\",\n      error: { code: -32603, message: \"Internal server error\" },\n      id: null,\n    });\n  }\n}\n\nexport async function createApp({\n  app: skybridgeApp,\n  httpServer,\n  mcpHandler,\n  onMcpError,\n  errorMiddleware = [],\n}: {\n  app: SkybridgeApp;\n  httpServer: http.Server;\n  mcpHandler?: McpHttpHandler;\n  onMcpError?: (error: Error) => void;\n  errorMiddleware?: {\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }[];\n}): Promise<express.Express> {\n  await skybridgeApp.ready();\n  const app = skybridgeApp.express;\n\n  // Read `process.env.NODE_ENV` inline: wrangler/esbuild only substitute the literal expression,\n  // so a local const would defeat dead-code elimination of the dev-only imports below.\n  if (process.env.NODE_ENV !== \"production\") {\n    const { devtoolsStaticServer } = await import(\"@skybridge/devtools\");\n    app.use(await devtoolsStaticServer());\n    const { viewsDevServer } = await import(\"./viewsDevServer.js\");\n    app.use(await viewsDevServer(httpServer));\n\n    const controlPort = parseControlPort(process.env.__TUNNEL_CONTROL_PORT);\n    if (controlPort !== null) {\n      const { createTunnelProxyRouter } = await import(\n        \"./tunnel-proxy-router.js\"\n      );\n      app.use(createTunnelProxyRouter(controlPort));\n    } else if (process.env.__TUNNEL_CONTROL_PORT !== undefined) {\n      console.warn(\n        `Ignoring invalid __TUNNEL_CONTROL_PORT=${process.env.__TUNNEL_CONTROL_PORT}`,\n      );\n    }\n  } else {\n    const assetsPath = path.join(process.cwd(), \"dist\", \"assets\");\n\n    app.use(\"/assets\", cors());\n    app.use(\"/assets\", express.static(assetsPath));\n  }\n\n  app.use(\n    \"/mcp\",\n    mcpMiddleware(\n      mcpHandler ?? buildMcpHandler(skybridgeApp, onMcpError),\n      onMcpError,\n    ),\n  );\n\n  applyMiddlewares(app, errorMiddleware);\n\n  app.use(\"/mcp\", defaultErrorHandler);\n\n  return app;\n}\n\nconst mcpMiddleware = (\n  mcpHandler: McpHttpHandler,\n  onMcpError?: (error: Error) => void,\n): express.RequestHandler => {\n  const handler = toNodeHandler(\n    mcpHandler,\n    onMcpError ? { onerror: onMcpError } : undefined,\n  );\n\n  return async (\n    req: express.Request,\n    res: express.Response,\n    next: express.NextFunction,\n  ) => {\n    try {\n      // Express strips the mount path from req.url (e.g. \"/mcp\" becomes \"/\").\n      // Restore it so the SDK builds the correct request URL.\n      req.url = req.originalUrl;\n      await handler(req, res, req.body);\n    } catch (error) {\n      next(error);\n    }\n  };\n};\n"]}