skybridge 0.0.0-dev.f3a1db3 → 0.0.0-dev.f3a8932

package/dist/commands/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/commands/build.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC;QACE,KAAK,EAAE,gBAAgB;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,YAAY;KACtB;IACD;QACE,KAAK,EAAE,0BAA0B;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,kBAAkB,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAC5C,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,wEAAwE;QACxE,qEAAqE;QACrE,4DAA4D;QAC5D,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;KACF;IACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,EAC/C,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,6BAA6B;QACpC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7C,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,MAAM,CAAU,WAAW,GAAG,gCAAgC,CAAC;IAC/D,MAAM,CAAU,QAAQ,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAExC,KAAK,CAAC,GAAG;QACd,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAC3C,eAAe,CAAC,YAAY,CAAC,CAAC;YAEhC,SAAS,CAAC,GAAG,EAAE;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEd,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,aACpC,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,YAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,sDAAmC,GAC/C,EAER,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBAChC,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,CAAC;wBAE5D,OAAO,CACL,KAAC,GAAG,IAAkB,YAAY,EAAE,CAAC,YACnC,MAAC,IAAI,IAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAC1D,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAC9D,IAAI,CAAC,KAAK,IACN,IAJC,IAAI,CAAC,KAAK,CAKd,CACP,CAAC;oBACJ,CAAC,CAAC,EAED,MAAM,KAAK,SAAS,IAAI,CACvB,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,2DAEjB,GACH,CACP,EAEA,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,CAC9B,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,0CAEf,EACP,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/B,KAAC,IAAI,IAAY,KAAK,EAAC,KAAK,YACzB,IAAI,IADI,IAAI,CAER,CACR,CAAC,GACE,IACF,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE;YACd,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { Command } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { useEffect } from \"react\";\nimport {\n  emitEntryWrapper,\n  emitManifestModule,\n  emitVercelBuildOutput,\n} from \"../cli/build-helpers.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { type CommandStep, useExecuteSteps } from \"../cli/use-execute-steps.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport const commandSteps: CommandStep[] = [\n  {\n    label: \"Scanning views\",\n    run: async () => {\n      const root = process.cwd();\n      const viewsDir = await resolveViewsDir(root);\n      scanAndWriteViewsDts(root, viewsDir);\n    },\n  },\n  {\n    label: \"Compiling server\",\n    run: () => rmSync(\"dist\", { recursive: true, force: true }),\n    command: \"tsc -b --force\",\n  },\n  {\n    label: \"Building views\",\n    command: \"vite build\",\n  },\n  {\n    label: \"Emitting manifest module\",\n    // Inline the Vite manifest as a JS module so the wrapper can `import` it\n    // instead of `readFileSync(process.cwd() + ...)` at runtime — required for\n    // workerd, where neither cwd nor the assets directory is readable.\n    run: () => {\n      const root = process.cwd();\n      emitManifestModule(\n        path.join(root, \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        path.join(root, \"dist\", \"vite-manifest.js\"),\n      );\n    },\n  },\n  {\n    label: \"Emitting entry wrapper\",\n    // dist/__entry.js primes the Vite manifest via __setBuildManifest, then\n    // dynamically imports user code. Deploy targets (Cloudflare, Vercel)\n    // bundle from here so the manifest is available at runtime.\n    run: () => {\n      emitEntryWrapper(path.join(process.cwd(), \"dist\"));\n    },\n  },\n  {\n    label: \"Emitting Cloudflare redirects\",\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_redirects\"),\n        \"/assets/assets/* /assets/:splat 200\\n\",\n      );\n    },\n  },\n  {\n    label: \"Emitting Cloudflare headers\",\n    run: () => {\n      const root = process.cwd();\n      writeFileSync(\n        path.join(root, \"dist\", \"assets\", \"_headers\"),\n        \"/assets/*\\n  Access-Control-Allow-Origin: *\\n\",\n      );\n    },\n  },\n  {\n    label: \"Emitting Vercel build output\",\n    run: () => emitVercelBuildOutput(process.cwd()),\n  },\n];\n\nexport default class Build extends Command {\n  static override description = \"Build the views and MCP server\";\n  static override examples = [\"skybridge build\"];\n\n  public async run(): Promise<void> {\n    const App = () => {\n      const { currentStep, status, error, execute } =\n        useExecuteSteps(commandSteps);\n\n      useEffect(() => {\n        execute();\n      }, [execute]);\n\n      return (\n        <Box flexDirection=\"column\" padding={1}>\n          <Header version={this.config.version}>\n            <Text color=\"green\"> → building for production…</Text>\n          </Header>\n\n          {commandSteps.map((step, index) => {\n            const isCurrent = index === currentStep && status === \"running\";\n            const isCompleted = index < currentStep || status === \"success\";\n            const isError = status === \"error\" && index === currentStep;\n\n            return (\n              <Box key={step.label} marginBottom={0}>\n                <Text color={isError ? \"red\" : isCompleted ? \"green\" : \"grey\"}>\n                  {isError ? \"✗\" : isCompleted ? \"✓\" : isCurrent ? \"⟳\" : \"○\"}{\" \"}\n                  {step.label}\n                </Text>\n              </Box>\n            );\n          })}\n\n          {status === \"success\" && (\n            <Box marginTop={1}>\n              <Text color=\"green\" bold>\n                ✓ Build completed successfully!\n              </Text>\n            </Box>\n          )}\n\n          {status === \"error\" && error && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ✗ Build failed\n              </Text>\n              <Box marginTop={1} flexDirection=\"column\">\n                {error.split(\"\\n\").map((line) => (\n                  <Text key={line} color=\"red\">\n                    {line}\n                  </Text>\n                ))}\n              </Box>\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    render(<App />, {\n      exitOnCtrlC: true,\n      patchConsole: false,\n    });\n  }\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/commands/build.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,MAAM,CAAU,WAAW,GAAG,gCAAgC,CAAC;IAC/D,MAAM,CAAU,QAAQ,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAExC,KAAK,CAAC,GAAG;QACd,MAAM,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAChE,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAC3C,eAAe,CAAC,YAAY,CAAC,CAAC;YAEhC,SAAS,CAAC,GAAG,EAAE;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEd,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,aACpC,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,YAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,sDAAmC,GAC/C,EAER,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBAChC,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,IAAI,MAAM,KAAK,SAAS,CAAC;wBAChE,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,CAAC;wBAE5D,OAAO,CACL,KAAC,GAAG,IAAkB,YAAY,EAAE,CAAC,YACnC,MAAC,IAAI,IAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAC1D,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAC9D,IAAI,CAAC,KAAK,IACN,IAJC,IAAI,CAAC,KAAK,CAKd,CACP,CAAC;oBACJ,CAAC,CAAC,EAED,MAAM,KAAK,SAAS,IAAI,CACvB,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,2DAEjB,GACH,CACP,EAEA,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,CAC9B,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,0CAEf,EACP,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/B,KAAC,IAAI,IAAY,KAAK,EAAC,KAAK,YACzB,IAAI,IADI,IAAI,CAER,CACR,CAAC,GACE,IACF,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE;YACd,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC","sourcesContent":["import { Command } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { useEffect } from \"react\";\nimport { getCommandSteps } from \"../cli/build-steps.js\";\nimport { Header } from \"../cli/header.js\";\nimport { useExecuteSteps } from \"../cli/use-execute-steps.js\";\n\nexport default class Build extends Command {\n  static override description = \"Build the views and MCP server\";\n  static override examples = [\"skybridge build\"];\n\n  public async run(): Promise<void> {\n    const commandSteps = await getCommandSteps().catch((e: unknown) =>\n      this.error(e instanceof Error ? e.message : String(e)),\n    );\n\n    const App = () => {\n      const { currentStep, status, error, execute } =\n        useExecuteSteps(commandSteps);\n\n      useEffect(() => {\n        execute();\n      }, [execute]);\n\n      return (\n        <Box flexDirection=\"column\" padding={1}>\n          <Header version={this.config.version}>\n            <Text color=\"green\"> → building for production…</Text>\n          </Header>\n\n          {commandSteps.map((step, index) => {\n            const isCurrent = index === currentStep && status === \"running\";\n            const isCompleted = index < currentStep || status === \"success\";\n            const isError = status === \"error\" && index === currentStep;\n\n            return (\n              <Box key={step.label} marginBottom={0}>\n                <Text color={isError ? \"red\" : isCompleted ? \"green\" : \"grey\"}>\n                  {isError ? \"✗\" : isCompleted ? \"✓\" : isCurrent ? \"⟳\" : \"○\"}{\" \"}\n                  {step.label}\n                </Text>\n              </Box>\n            );\n          })}\n\n          {status === \"success\" && (\n            <Box marginTop={1}>\n              <Text color=\"green\" bold>\n                ✓ Build completed successfully!\n              </Text>\n            </Box>\n          )}\n\n          {status === \"error\" && error && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ✗ Build failed\n              </Text>\n              <Box marginTop={1} flexDirection=\"column\">\n                {error.split(\"\\n\").map((line) => (\n                  <Text key={line} color=\"red\">\n                    {line}\n                  </Text>\n                ))}\n              </Box>\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    render(<App />, {\n      exitOnCtrlC: true,\n      patchConsole: false,\n    });\n  }\n}\n"]}

package/dist/commands/dev.d.ts

@@ -7,6 +7,7 @@ export default class Dev extends Command {
         tunnel: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         open: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        plain: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/dev.js

@@ -3,7 +3,8 @@ import { Command, Flags } from "@oclif/core";
 import { Box, render, Text } from "ink";
 import { resolvePort } from "../cli/detect-port.js";
 import { Header } from "../cli/header.js";
-import { resolveViewsDir } from "../cli/resolve-views-dir.js";
+import { resolveSkybridgeConfig } from "../cli/resolve-skybridge-config.js";
+import { runPlain } from "../cli/run-plain.js";
 import { startTunnelControlServer } from "../cli/tunnel-control-server.js";
 import { useMessages } from "../cli/use-messages.js";
 import { useNodemon } from "../cli/use-nodemon.js";
@@ -34,6 +35,10 @@ export default class Dev extends Command {
             description: "Show tunnel logs",
             default: false,
         }),
+        plain: Flags.boolean({
+            description: "Disable the interactive UI and stream raw server logs to stdout, so you can pipe them through a formatter (e.g. `skybridge dev --plain | bunyan`).",
+            default: false,
+        }),
     };
     async run() {
         const { flags } = await this.parse(Dev);
@@ -44,7 +49,7 @@ export default class Dev extends Command {
         // and the dev UI reports phantom TS errors forever.
         const root = process.cwd();
         try {
-            scanAndWriteViewsDts(root, await resolveViewsDir(root));
+            scanAndWriteViewsDts(root, (await resolveSkybridgeConfig(root)).viewsDir);
         }
         catch {
             // Best-effort: if the scan fails (e.g. broken vite config, duplicate
@@ -61,6 +66,33 @@ export default class Dev extends Command {
             __PORT: String(port),
             __TUNNEL_CONTROL_PORT: String(controlPort),
         };
+        if (flags.plain) {
+            const teardown = runPlain({
+                env,
+                port,
+                fallback,
+                version: this.config.version,
+                tunnel: flags.tunnel,
+                tunnelManager,
+            });
+            // Synchronous-first shutdown: kill the alpic subprocess up front so we
+            // can't leave it orphaned even if another SIGINT listener (e.g.
+            // nodemon's) exits the process before our async cleanup completes.
+            const shutdown = (code) => () => {
+                tunnelManager.stop();
+                teardown();
+                void closeTunnelControl()
+                    .catch((err) => {
+                    console.error("Failed to close tunnel control server", err);
+                })
+                    .finally(() => {
+                    process.exit(code);
+                });
+            };
+            process.once("SIGINT", shutdown(130));
+            process.once("SIGTERM", shutdown(143));
+            return;
+        }
         const App = () => {
             const tsErrors = useTypeScriptCheck();
             const [messages, pushMessage] = useMessages();

package/dist/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, await resolveViewsDir(root));\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,WAAW,EACT,oJAAoJ;YACtJ,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC;gBACxB,GAAG;gBACH,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa;aACd,CAAC,CAAC;YAEH,uEAAuE;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;gBACtC,aAAa,CAAC,IAAI,EAAE,CAAC;gBACrB,QAAQ,EAAE,CAAC;gBACX,KAAK,kBAAkB,EAAE;qBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveSkybridgeConfig } from \"../cli/resolve-skybridge-config.js\";\nimport { runPlain } from \"../cli/run-plain.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n    plain: Flags.boolean({\n      description:\n        \"Disable the interactive UI and stream raw server logs to stdout, so you can pipe them through a formatter (e.g. `skybridge dev --plain | bunyan`).\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, (await resolveSkybridgeConfig(root)).viewsDir);\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    if (flags.plain) {\n      const teardown = runPlain({\n        env,\n        port,\n        fallback,\n        version: this.config.version,\n        tunnel: flags.tunnel,\n        tunnelManager,\n      });\n\n      // Synchronous-first shutdown: kill the alpic subprocess up front so we\n      // can't leave it orphaned even if another SIGINT listener (e.g.\n      // nodemon's) exits the process before our async cleanup completes.\n      const shutdown = (code: number) => () => {\n        tunnelManager.stop();\n        teardown();\n        void closeTunnelControl()\n          .catch((err) => {\n            console.error(\"Failed to close tunnel control server\", err);\n          })\n          .finally(() => {\n            process.exit(code);\n          });\n      };\n      process.once(\"SIGINT\", shutdown(130));\n      process.once(\"SIGTERM\", shutdown(143));\n      return;\n    }\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}

package/dist/server/auth/providers/authplane.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/** Options accepted by {@link authplaneProvider}. */
+export type AuthplaneProviderOptions = {
+    /**
+     * The authorization server's issuer identifier (RFC 8414 §2) — your
+     * Authplane deployment, e.g. `https://auth.acme.com` (or
+     * `http://localhost:9000` in local development).
+     */
+    issuer: string;
+    /**
+     * This server's resource identifier (RFC 9728 §1.2): the public URL clients
+     * reach, advertised as the `resource` field of its protected-resource
+     * metadata. Required, unlike the other providers.
+     *
+     * Authplane binds the access token's `aud` to the RFC 8707 `resource`
+     * parameter the client sends, and the client takes that value from the
+     * advertised metadata. Setting it explicitly gives the deployment one fixed
+     * identifier, which is what the audience is checked against.
+     *
+     * Resource identifiers are compared by exact string match, so give it in the
+     * form it will be advertised and register that same string in Authplane. RFC
+     * 8707 §2 asks for the most specific URI available, e.g.
+     * `https://acme.example.com/mcp`.
+     */
+    resource: string;
+    /**
+     * Expected token `aud`. Defaults to `resource`.
+     *
+     * RFC 8707 §2 lets an authorization server use the resource identifier
+     * verbatim as the audience or map it to another value; set this only for a
+     * resource configured in Authplane with such an override, and pass that
+     * value verbatim.
+     */
+    audience?: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience" | "baseUrl">;
+/**
+ * OAuth provider for Authplane. `issuer` is the authorization server's issuer
+ * identifier and `resource` is this server's resource identifier, which also
+ * supplies the expected token audience.
+ *
+ * Dynamic Client Registration is supported natively, so no registration proxy
+ * is needed: clients register with Authplane directly and this server stays out
+ * of the authorization path. Pass `serverUrl` to advertise this server as the
+ * authorization server instead (see {@link customProvider}).
+ */
+export declare function authplaneProvider(opts: AuthplaneProviderOptions): Promise<OAuthConfig>;

package/dist/server/auth/providers/authplane.js

@@ -0,0 +1,57 @@
+import { customProvider } from "./custom.js";
+/**
+ * Rejects anything that cannot serve as an OAuth identifier: RFC 8707 §2
+ * requires an absolute URI and forbids a fragment, and the discovery and
+ * protected-resource metadata URLs are both built from the scheme and host.
+ */
+function parseIdentifier(value, option) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error(`authplaneProvider: \`${option}\` must be an absolute URL, got ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error(`authplaneProvider: \`${option}\` must use the http or https scheme, got ${JSON.stringify(value)}`);
+    }
+    if (!parsed.host) {
+        throw new Error(`authplaneProvider: \`${option}\` must include a host, got ${JSON.stringify(value)}`);
+    }
+    if (parsed.hash) {
+        throw new Error(`authplaneProvider: \`${option}\` must not include a fragment, got ${JSON.stringify(value)}`);
+    }
+    return parsed;
+}
+/**
+ * OAuth provider for Authplane. `issuer` is the authorization server's issuer
+ * identifier and `resource` is this server's resource identifier, which also
+ * supplies the expected token audience.
+ *
+ * Dynamic Client Registration is supported natively, so no registration proxy
+ * is needed: clients register with Authplane directly and this server stays out
+ * of the authorization path. Pass `serverUrl` to advertise this server as the
+ * authorization server instead (see {@link customProvider}).
+ */
+export function authplaneProvider(opts) {
+    const { issuer, resource, audience, ...rest } = opts;
+    parseIdentifier(issuer, "issuer");
+    const parsedResource = parseIdentifier(resource, "resource");
+    // The advertised resource is the URL-normalised form of this value. Where
+    // normalisation would change the string — a bare origin gaining a root path,
+    // an uppercase host, an explicit default port — the configured and advertised
+    // identifiers would differ, and the audience check compares them exactly.
+    // Require the advertised form up front so the two always match.
+    if (parsedResource.href !== resource) {
+        throw new Error(`authplaneProvider: \`resource\` must be given in the form it will be advertised. ` +
+            `${JSON.stringify(resource)} is advertised as ${JSON.stringify(parsedResource.href)}. ` +
+            `Use ${JSON.stringify(parsedResource.href)}, or a path-qualified URL such as "https://acme.example.com/mcp", and register the same value in Authplane.`);
+    }
+    return customProvider({
+        issuer,
+        audience: audience ?? resource,
+        baseUrl: resource,
+        ...rest,
+    });
+}
+//# sourceMappingURL=authplane.js.map

package/dist/server/auth/providers/authplane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authplane.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/authplane.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAqCzE;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,6CAA6C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,+BAA+B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAErD,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,cAAc,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI;YACvF,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,6GAA6G,CAC1J,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,QAAQ;QAC9B,OAAO,EAAE,QAAQ;QACjB,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/** Options accepted by {@link authplaneProvider}. */\nexport type AuthplaneProviderOptions = {\n  /**\n   * The authorization server's issuer identifier (RFC 8414 §2) — your\n   * Authplane deployment, e.g. `https://auth.acme.com` (or\n   * `http://localhost:9000` in local development).\n   */\n  issuer: string;\n  /**\n   * This server's resource identifier (RFC 9728 §1.2): the public URL clients\n   * reach, advertised as the `resource` field of its protected-resource\n   * metadata. Required, unlike the other providers.\n   *\n   * Authplane binds the access token's `aud` to the RFC 8707 `resource`\n   * parameter the client sends, and the client takes that value from the\n   * advertised metadata. Setting it explicitly gives the deployment one fixed\n   * identifier, which is what the audience is checked against.\n   *\n   * Resource identifiers are compared by exact string match, so give it in the\n   * form it will be advertised and register that same string in Authplane. RFC\n   * 8707 §2 asks for the most specific URI available, e.g.\n   * `https://acme.example.com/mcp`.\n   */\n  resource: string;\n  /**\n   * Expected token `aud`. Defaults to `resource`.\n   *\n   * RFC 8707 §2 lets an authorization server use the resource identifier\n   * verbatim as the audience or map it to another value; set this only for a\n   * resource configured in Authplane with such an override, and pass that\n   * value verbatim.\n   */\n  audience?: string;\n} & Omit<CustomProviderOptions, \"issuer\" | \"audience\" | \"baseUrl\">;\n\n/**\n * Rejects anything that cannot serve as an OAuth identifier: RFC 8707 §2\n * requires an absolute URI and forbids a fragment, and the discovery and\n * protected-resource metadata URLs are both built from the scheme and host.\n */\nfunction parseIdentifier(value: string, option: string): URL {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new Error(\n      `authplaneProvider: \\`${option}\\` must be an absolute URL, got ${JSON.stringify(value)}`,\n    );\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") {\n    throw new Error(\n      `authplaneProvider: \\`${option}\\` must use the http or https scheme, got ${JSON.stringify(value)}`,\n    );\n  }\n  if (!parsed.host) {\n    throw new Error(\n      `authplaneProvider: \\`${option}\\` must include a host, got ${JSON.stringify(value)}`,\n    );\n  }\n  if (parsed.hash) {\n    throw new Error(\n      `authplaneProvider: \\`${option}\\` must not include a fragment, got ${JSON.stringify(value)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * OAuth provider for Authplane. `issuer` is the authorization server's issuer\n * identifier and `resource` is this server's resource identifier, which also\n * supplies the expected token audience.\n *\n * Dynamic Client Registration is supported natively, so no registration proxy\n * is needed: clients register with Authplane directly and this server stays out\n * of the authorization path. Pass `serverUrl` to advertise this server as the\n * authorization server instead (see {@link customProvider}).\n */\nexport function authplaneProvider(\n  opts: AuthplaneProviderOptions,\n): Promise<OAuthConfig> {\n  const { issuer, resource, audience, ...rest } = opts;\n\n  parseIdentifier(issuer, \"issuer\");\n  const parsedResource = parseIdentifier(resource, \"resource\");\n\n  // The advertised resource is the URL-normalised form of this value. Where\n  // normalisation would change the string — a bare origin gaining a root path,\n  // an uppercase host, an explicit default port — the configured and advertised\n  // identifiers would differ, and the audience check compares them exactly.\n  // Require the advertised form up front so the two always match.\n  if (parsedResource.href !== resource) {\n    throw new Error(\n      `authplaneProvider: \\`resource\\` must be given in the form it will be advertised. ` +\n        `${JSON.stringify(resource)} is advertised as ${JSON.stringify(parsedResource.href)}. ` +\n        `Use ${JSON.stringify(parsedResource.href)}, or a path-qualified URL such as \"https://acme.example.com/mcp\", and register the same value in Authplane.`,\n    );\n  }\n\n  return customProvider({\n    issuer,\n    audience: audience ?? resource,\n    baseUrl: resource,\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/authplane.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/authplane.test.js

@@ -0,0 +1,138 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { authplaneProvider } from "./authplane.js";
+afterEach(() => vi.restoreAllMocks());
+const ISSUER = "https://auth.acme.com";
+function discoveryDoc(issuer, scopes) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: scopes,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+function mockDiscovery(docs) {
+    return vi
+        .spyOn(globalThis, "fetch")
+        .mockImplementation(async (input) => {
+        const url = String(input);
+        const entry = Object.entries(docs).find(([issuer]) => url === `${issuer}/.well-known/openid-configuration`);
+        if (entry === undefined) {
+            return new Response(null, { status: 404 });
+        }
+        return new Response(JSON.stringify(discoveryDoc(...entry)), {
+            headers: { "content-type": "application/json" },
+        });
+    });
+}
+describe("authplaneProvider", () => {
+    it("derives the audience from the resource the server advertises", async () => {
+        mockDiscovery({ [ISSUER]: ["checkout"] });
+        const config = await authplaneProvider({
+            issuer: ISSUER,
+            resource: "https://coffee.example.com/mcp",
+        });
+        expect(config.verify.audience).toBe("https://coffee.example.com/mcp");
+        expect(config.verify.issuer).toBe(ISSUER);
+        expect(config.verify.jwksUri).toBe(`${ISSUER}/.well-known/jwks.json`);
+        expect(config.baseUrl).toBe("https://coffee.example.com/mcp");
+    });
+    it.each([
+        "https://coffee.example.com/mcp",
+        "https://coffee.example.com/v2/mcp",
+        "https://coffee.example.com/",
+        "http://localhost:3000/mcp",
+        "https://coffee.example.com:8443/mcp",
+    ])("passes %s through as both resource and audience", async (resource) => {
+        mockDiscovery({ [ISSUER]: ["checkout"] });
+        const config = await authplaneProvider({ issuer: ISSUER, resource });
+        expect(config.baseUrl).toBe(resource);
+        expect(config.verify.audience).toBe(resource);
+    });
+    // The metadata router serialises the resource identifier through `URL` before
+    // advertising it. Anything that serialisation would rewrite is refused here,
+    // so the advertised identifier is always the configured one.
+    it.each([
+        // Pathless origin — gains a root path.
+        ["https://coffee.example.com", "https://coffee.example.com/"],
+        ["http://localhost:3000", "http://localhost:3000/"],
+        // Uppercase host — lowercased.
+        ["https://COFFEE.EXAMPLE.COM/mcp", "https://coffee.example.com/mcp"],
+        // Explicit default port — dropped.
+        ["https://coffee.example.com:443/mcp", "https://coffee.example.com/mcp"],
+    ])("rejects %s and names %s instead", async (resource, published) => {
+        const fetchSpy = mockDiscovery({ [ISSUER]: ["checkout"] });
+        expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(`is advertised as ${JSON.stringify(published)}`);
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+    it("lets an explicit audience override the default", async () => {
+        mockDiscovery({ [ISSUER]: ["checkout"] });
+        const config = await authplaneProvider({
+            issuer: ISSUER,
+            resource: "https://coffee.example.com/mcp",
+            audience: "urn:acme:coffee",
+        });
+        expect(config.verify.audience).toBe("urn:acme:coffee");
+    });
+    it.each([
+        ["coffee.example.com/mcp", /must be an absolute URL/],
+        ["ftp://coffee.example.com/mcp", /must use the http or https scheme/],
+        ["https://coffee.example.com/mcp#frag", /must not include a fragment/],
+    ])("rejects the malformed resource %s", async (resource, message) => {
+        const fetchSpy = mockDiscovery({ [ISSUER]: ["checkout"] });
+        expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(message);
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+    it("rejects a malformed issuer before any discovery", async () => {
+        const fetchSpy = mockDiscovery({ [ISSUER]: ["checkout"] });
+        expect(() => authplaneProvider({
+            issuer: "auth.acme.com",
+            resource: "https://coffee.example.com/mcp",
+        })).toThrow(/`issuer` must be an absolute URL/);
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+    it("accepts an issuer carrying a trailing slash", async () => {
+        // Discovery resolves the issuer itself; the provider passes it through
+        // rather than rewriting the operator's value.
+        mockDiscovery({ [ISSUER]: ["checkout"] });
+        const config = await authplaneProvider({
+            issuer: `${ISSUER}/`,
+            resource: "https://coffee.example.com/mcp",
+        });
+        expect(config.verify.issuer).toBe(ISSUER);
+    });
+    it("accepts a local http issuer for development", async () => {
+        const local = "http://localhost:9000";
+        mockDiscovery({ [local]: ["checkout"] });
+        const config = await authplaneProvider({
+            issuer: local,
+            resource: "http://localhost:3000/mcp",
+        });
+        expect(config.verify.issuer).toBe(local);
+        expect(config.verify.audience).toBe("http://localhost:3000/mcp");
+    });
+    it("forwards scopes and the required-scope floor", async () => {
+        mockDiscovery({ [ISSUER]: ["checkout", "profile"] });
+        const config = await authplaneProvider({
+            issuer: ISSUER,
+            resource: "https://coffee.example.com/mcp",
+            scopes: ["checkout"],
+            requiredScopes: ["checkout"],
+        });
+        expect(config.scopesSupported).toEqual(["checkout"]);
+        expect(config.requiredScopes).toEqual(["checkout"]);
+    });
+    it("advertises the registration endpoint for dynamic client registration", async () => {
+        mockDiscovery({ [ISSUER]: ["checkout"] });
+        const config = await authplaneProvider({
+            issuer: ISSUER,
+            resource: "https://coffee.example.com/mcp",
+        });
+        expect(config.oauthMetadata.issuer).toBe(ISSUER);
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${ISSUER}/register`);
+    });
+});
+//# sourceMappingURL=authplane.test.js.map

package/dist/server/auth/providers/authplane.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authplane.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/authplane.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,gCAAgC;QAChC,mCAAmC;QACnC,6BAA6B;QAC7B,2BAA2B;QAC3B,qCAAqC;KACtC,CAAC,CAAC,iDAAiD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvE,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAErE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,EAAE,CAAC,IAAI,CAAC;QACN,uCAAuC;QACvC,CAAC,4BAA4B,EAAE,6BAA6B,CAAC;QAC7D,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;QACnD,+BAA+B;QAC/B,CAAC,gCAAgC,EAAE,gCAAgC,CAAC;QACpE,mCAAmC;QACnC,CAAC,oCAAoC,EAAE,gCAAgC,CAAC;KACzE,CAAC,CAAC,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAChD,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;QACrD,CAAC,8BAA8B,EAAE,mCAAmC,CAAC;QACrE,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;KACvE,CAAC,CAAC,mCAAmC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,OAAO,CACR,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CACV,iBAAiB,CAAC;YAChB,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CACH,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,uEAAuE;QACvE,8CAA8C;QAC9C,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,GAAG,MAAM,GAAG;YACpB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACtC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,2BAA2B;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,MAAM,EAAE,CAAC,UAAU,CAAC;YACpB,cAAc,EAAE,CAAC,UAAU,CAAC;SAC7B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,MAAM,WAAW,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { authplaneProvider } from \"./authplane.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nconst ISSUER = \"https://auth.acme.com\";\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"authplaneProvider\", () => {\n  it(\"derives the audience from the resource the server advertises\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(config.verify.audience).toBe(\"https://coffee.example.com/mcp\");\n    expect(config.verify.issuer).toBe(ISSUER);\n    expect(config.verify.jwksUri).toBe(`${ISSUER}/.well-known/jwks.json`);\n    expect(config.baseUrl).toBe(\"https://coffee.example.com/mcp\");\n  });\n\n  it.each([\n    \"https://coffee.example.com/mcp\",\n    \"https://coffee.example.com/v2/mcp\",\n    \"https://coffee.example.com/\",\n    \"http://localhost:3000/mcp\",\n    \"https://coffee.example.com:8443/mcp\",\n  ])(\"passes %s through as both resource and audience\", async (resource) => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({ issuer: ISSUER, resource });\n\n    expect(config.baseUrl).toBe(resource);\n    expect(config.verify.audience).toBe(resource);\n  });\n\n  // The metadata router serialises the resource identifier through `URL` before\n  // advertising it. Anything that serialisation would rewrite is refused here,\n  // so the advertised identifier is always the configured one.\n  it.each([\n    // Pathless origin — gains a root path.\n    [\"https://coffee.example.com\", \"https://coffee.example.com/\"],\n    [\"http://localhost:3000\", \"http://localhost:3000/\"],\n    // Uppercase host — lowercased.\n    [\"https://COFFEE.EXAMPLE.COM/mcp\", \"https://coffee.example.com/mcp\"],\n    // Explicit default port — dropped.\n    [\"https://coffee.example.com:443/mcp\", \"https://coffee.example.com/mcp\"],\n  ])(\"rejects %s and names %s instead\", async (resource, published) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      `is advertised as ${JSON.stringify(published)}`,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"lets an explicit audience override the default\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      audience: \"urn:acme:coffee\",\n    });\n\n    expect(config.verify.audience).toBe(\"urn:acme:coffee\");\n  });\n\n  it.each([\n    [\"coffee.example.com/mcp\", /must be an absolute URL/],\n    [\"ftp://coffee.example.com/mcp\", /must use the http or https scheme/],\n    [\"https://coffee.example.com/mcp#frag\", /must not include a fragment/],\n  ])(\"rejects the malformed resource %s\", async (resource, message) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      message,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"rejects a malformed issuer before any discovery\", async () => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() =>\n      authplaneProvider({\n        issuer: \"auth.acme.com\",\n        resource: \"https://coffee.example.com/mcp\",\n      }),\n    ).toThrow(/`issuer` must be an absolute URL/);\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"accepts an issuer carrying a trailing slash\", async () => {\n    // Discovery resolves the issuer itself; the provider passes it through\n    // rather than rewriting the operator's value.\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: `${ISSUER}/`,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(config.verify.issuer).toBe(ISSUER);\n  });\n\n  it(\"accepts a local http issuer for development\", async () => {\n    const local = \"http://localhost:9000\";\n    mockDiscovery({ [local]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: local,\n      resource: \"http://localhost:3000/mcp\",\n    });\n\n    expect(config.verify.issuer).toBe(local);\n    expect(config.verify.audience).toBe(\"http://localhost:3000/mcp\");\n  });\n\n  it(\"forwards scopes and the required-scope floor\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\", \"profile\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      scopes: [\"checkout\"],\n      requiredScopes: [\"checkout\"],\n    });\n\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(config.requiredScopes).toEqual([\"checkout\"]);\n  });\n\n  it(\"advertises the registration endpoint for dynamic client registration\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(ISSUER);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${ISSUER}/register`,\n    );\n  });\n});\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -16,6 +16,14 @@ export type CustomProviderOptions = {
      * injects the registration endpoint). Use the static public URL; `verify.issuer`
      * stays the IdP (the token's real `iss`). */
     serverUrl?: string;
+    /** Advertise this URL as the authorization server (served AS metadata `issuer`
+     * and PRM `authorization_servers`). Its own discovery document supplies the
+     * advertised endpoints, DCR registration, scopes and the `iss` tokens are
+     * verified against; only `jwks_uri` still comes from `issuer`'s document. Use
+     * when DCR/authorize/token live at a different URL than the discovery issuer
+     * (e.g. Descope's agentic URL vs. its base-project URL). `serverUrl` wins if
+     * both are set. */
+    authorizationServer?: string;
     scopes?: string[];
     requiredScopes?: string[];
     metadataOverrides?: Omit<Partial<OAuthMetadata>, "issuer">;

package/dist/server/auth/providers/custom.js

@@ -11,14 +11,26 @@ export async function customProvider(opts) {
     // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)
     // always comes from validated discovery.
     const { issuer: _issuer, jwks_uri: _jwks, ...overrides } = opts.metadataOverrides ?? {};
-    const base = { ...discovered, ...overrides };
+    let advertised = discovered;
+    if (opts.authorizationServer) {
+        try {
+            advertised = await discoverAuthorizationServer(opts.authorizationServer);
+        }
+        catch (err) {
+            console.warn(`OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const base = { ...advertised, ...overrides };
     const scopesSupported = opts.scopes ?? base.scopes_supported;
-    // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and
-    // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.
-    const oauthMetadata = opts.serverUrl
+    // serverUrl (skybridge-as-AS) overrides the advertised issuer, keeping the
+    // IdP as the token issuer. authorizationServer re-asserts its own URL so a
+    // failed AS discovery still points clients at the AS. serverUrl wins.
+    const advertisedIssuer = opts.serverUrl?.replace(/\/$/, "") ??
+        opts.authorizationServer?.replace(/\/$/, "");
+    const oauthMetadata = advertisedIssuer
         ? {
             ...base,
-            issuer: opts.serverUrl.replace(/\/$/, ""),
+            issuer: advertisedIssuer,
             scopes_supported: scopesSupported,
         }
         : base;
@@ -26,9 +38,9 @@ export async function customProvider(opts) {
         baseUrl: opts.baseUrl,
         oauthMetadata,
         verify: {
-            issuer: discovered.issuer,
+            issuer: advertised.issuer,
             audience: opts.audience,
-            jwksUri: discovered.jwks_uri,
+            jwksUri: advertised.jwks_uri ?? discovered.jwks_uri,
         },
         scopesSupported,
         requiredScopes: opts.requiredScopes,

package/dist/server/auth/providers/custom.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAwBzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,aAAa,GAAuB,IAAI,CAAC,SAAS;QACtD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  const base: DiscoveredMetadata = { ...discovered, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and\n  // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.\n  const oauthMetadata: DiscoveredMetadata = opts.serverUrl\n    ? {\n        ...base,\n        issuer: opts.serverUrl.replace(/\\/$/, \"\"),\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: discovered.issuer,\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAgCzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,GAAG,UAAU,CAAC;IAC5B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,IAAI,CAAC,mBAAmB,iBAAiB,IAAI,CAAC,MAAM,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/K,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAuB,gBAAgB;QACxD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;SACpD;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  /** Advertise this URL as the authorization server (served AS metadata `issuer`\n   * and PRM `authorization_servers`). Its own discovery document supplies the\n   * advertised endpoints, DCR registration, scopes and the `iss` tokens are\n   * verified against; only `jwks_uri` still comes from `issuer`'s document. Use\n   * when DCR/authorize/token live at a different URL than the discovery issuer\n   * (e.g. Descope's agentic URL vs. its base-project URL). `serverUrl` wins if\n   * both are set. */\n  authorizationServer?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  let advertised = discovered;\n  if (opts.authorizationServer) {\n    try {\n      advertised = await discoverAuthorizationServer(opts.authorizationServer);\n    } catch (err) {\n      console.warn(\n        `OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n  const base: DiscoveredMetadata = { ...advertised, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl (skybridge-as-AS) overrides the advertised issuer, keeping the\n  // IdP as the token issuer. authorizationServer re-asserts its own URL so a\n  // failed AS discovery still points clients at the AS. serverUrl wins.\n  const advertisedIssuer =\n    opts.serverUrl?.replace(/\\/$/, \"\") ??\n    opts.authorizationServer?.replace(/\\/$/, \"\");\n  const oauthMetadata: DiscoveredMetadata = advertisedIssuer\n    ? {\n        ...base,\n        issuer: advertisedIssuer,\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: advertised.issuer,\n      audience: opts.audience,\n      jwksUri: advertised.jwks_uri ?? discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}