skybridge 0.0.0-dev.fb0f54e → 0.0.0-dev.fb11426

package/dist/server/asset-base-url-transform-plugin.test.js

@@ -0,0 +1,134 @@
+import { describe, expect, it } from "vitest";
+import { assetBaseUrlTransform, assetBaseUrlTransformPlugin, isCssRequest, } from "./asset-base-url-transform-plugin.js";
+describe("assetBaseUrlTransform", () => {
+    it("should transform asset paths to use window.skybridge.serverUrl", () => {
+        const cases = [
+            {
+                desc: "single-quoted",
+                code: `const image = '/assets/logo.png';`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
+            },
+            {
+                desc: "double-quoted",
+                code: `const image = "/assets/logo.png";`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
+            },
+            {
+                desc: "backtick-quoted",
+                code: "const image = `/assets/logo.png`;",
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
+            },
+        ];
+        for (const { code, expected } of cases) {
+            const result = assetBaseUrlTransform(code);
+            expect(result).toBe(expected);
+        }
+    });
+    it("should transform multiple asset paths", () => {
+        const code = `
+      const logo = '/assets/logo.png';
+      const icon = '/assets/icon.svg';
+      const font = '/assets/font.woff2';
+    `;
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/icon.svg"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/font.woff2"`);
+    });
+    it("should not transform already absolute URLs", () => {
+        const code = `
+      const local = '/assets/logo.png';
+      const http = 'http://example.com/image.png';
+      const https = 'https://example.com/image.png';
+    `;
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+        expect(result).toContain("http://example.com/image.png");
+        expect(result).toContain("https://example.com/image.png");
+    });
+    it("should not transform code without asset paths", () => {
+        const code = `const text = "Hello World";`;
+        const result = assetBaseUrlTransform(code);
+        expect(result).toBe(code);
+    });
+    it("should not transform asset paths inside static `import ... from` clauses", () => {
+        // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,
+        // Vite resolves the relative path to absolute, then this transform used
+        // to rewrite the resolved string — producing invalid JS like
+        // `import * as sprite from (expr) + "..."` that crashes vite:import-analysis.
+        const cases = [
+            `import * as sprite from "/Users/me/proj/node_modules/pkg/icons.svg";`,
+            `import sprite from '/assets/icons.svg';`,
+            `import sprite from "/assets/icons.svg";`,
+            `export { default } from "/assets/icons.svg";`,
+            `export * from '/assets/sprites.svg';`,
+        ];
+        for (const code of cases) {
+            expect(assetBaseUrlTransform(code)).toBe(code);
+        }
+    });
+    it("should still transform value-position asset paths in files that also have unrelated imports", () => {
+        const code = [
+            `import { foo } from "./foo.js";`,
+            `import * as sprite from "/assets/sprite.svg";`,
+            `const logo = "/assets/logo.png";`,
+        ].join("\n");
+        const result = assetBaseUrlTransform(code);
+        // Imports untouched
+        expect(result).toContain(`from "./foo.js"`);
+        expect(result).toContain(`from "/assets/sprite.svg"`);
+        // Value-position rewritten
+        expect(result).toContain(`const logo = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`);
+    });
+});
+describe("isCssRequest", () => {
+    it("returns true for CSS-family extensions", () => {
+        expect(isCssRequest("/src/styles.css")).toBe(true);
+        expect(isCssRequest("/src/styles.module.css")).toBe(true);
+        expect(isCssRequest("/src/styles.scss")).toBe(true);
+        expect(isCssRequest("/src/styles.sass")).toBe(true);
+        expect(isCssRequest("/src/styles.less")).toBe(true);
+        expect(isCssRequest("/src/styles.styl")).toBe(true);
+    });
+    it("returns true for CSS modules with Vite query strings", () => {
+        expect(isCssRequest("/src/styles.css?direct")).toBe(true);
+        expect(isCssRequest("/src/styles.css?inline")).toBe(true);
+        expect(isCssRequest("/src/styles.css?used")).toBe(true);
+        expect(isCssRequest("/src/Foo.vue?vue&type=style&lang.css")).toBe(true);
+    });
+    it("returns false for non-CSS modules", () => {
+        expect(isCssRequest("/src/index.tsx")).toBe(false);
+        expect(isCssRequest("/src/utils.ts")).toBe(false);
+        expect(isCssRequest("/src/Logo.svg")).toBe(false);
+        expect(isCssRequest("/src/notes.cssx")).toBe(false);
+    });
+});
+describe("assetBaseUrlTransformPlugin", () => {
+    function runTransform(id, code) {
+        const plugin = assetBaseUrlTransformPlugin();
+        const hook = plugin.transform;
+        if (!hook) {
+            throw new Error("plugin.transform is not defined");
+        }
+        const handler = typeof hook === "function" ? hook : hook.handler;
+        return handler.call(
+        // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook
+        {}, code, id, { moduleType: "js" });
+    }
+    it("rewrites asset paths in JS modules", () => {
+        const result = runTransform("/src/widget.tsx", `const logo = "/assets/logo.png";`);
+        expect(result?.code).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+    });
+    // Reproducer for #697: CSS imports are served as JS modules with the
+    // stylesheet embedded as a string. Rewriting url("/foo.woff2") inside that
+    // string would produce invalid CSS once the styles are injected.
+    it("does not rewrite asset paths when transforming a CSS module", () => {
+        const cssCode = `__vite__updateStyle("style-id", "@font-face { src: url(\\"/fonts/Brand.woff2\\") format(\\"woff2\\"); }");`;
+        expect(runTransform("/src/fonts.css", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?direct", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?inline", cssCode)).toBeNull();
+        expect(runTransform("/src/styles.scss", cssCode)).toBeNull();
+        expect(runTransform("/src/Foo.vue?vue&type=style&lang.css", cssCode)).toBeNull();
+    });
+});
+//# sourceMappingURL=asset-base-url-transform-plugin.test.js.map

package/dist/server/asset-base-url-transform-plugin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,GACb,MAAM,sCAAsC,CAAC;AAE9C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAG3C,SAAS,YAAY,CAAC,EAAU,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,OAAO,CAAC,IAAI;QACjB,6EAA6E;QAC7E,EAAS,EACT,IAAI,EACJ,EAAE,EACF,EAAE,UAAU,EAAE,IAAI,EAAE,CACF,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CACzB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,4GAA4G,CAAC;QAE7H,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,CACJ,YAAY,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  assetBaseUrlTransform,\n  assetBaseUrlTransformPlugin,\n  isCssRequest,\n} from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n\ndescribe(\"isCssRequest\", () => {\n  it(\"returns true for CSS-family extensions\", () => {\n    expect(isCssRequest(\"/src/styles.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.module.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.scss\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.sass\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.less\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.styl\")).toBe(true);\n  });\n\n  it(\"returns true for CSS modules with Vite query strings\", () => {\n    expect(isCssRequest(\"/src/styles.css?direct\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?inline\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?used\")).toBe(true);\n    expect(isCssRequest(\"/src/Foo.vue?vue&type=style&lang.css\")).toBe(true);\n  });\n\n  it(\"returns false for non-CSS modules\", () => {\n    expect(isCssRequest(\"/src/index.tsx\")).toBe(false);\n    expect(isCssRequest(\"/src/utils.ts\")).toBe(false);\n    expect(isCssRequest(\"/src/Logo.svg\")).toBe(false);\n    expect(isCssRequest(\"/src/notes.cssx\")).toBe(false);\n  });\n});\n\ndescribe(\"assetBaseUrlTransformPlugin\", () => {\n  type TransformResult = { code: string; map: null } | null;\n\n  function runTransform(id: string, code: string): TransformResult {\n    const plugin = assetBaseUrlTransformPlugin();\n    const hook = plugin.transform;\n    if (!hook) {\n      throw new Error(\"plugin.transform is not defined\");\n    }\n    const handler = typeof hook === \"function\" ? hook : hook.handler;\n    return handler.call(\n      // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook\n      {} as any,\n      code,\n      id,\n      { moduleType: \"js\" },\n    ) as TransformResult;\n  }\n\n  it(\"rewrites asset paths in JS modules\", () => {\n    const result = runTransform(\n      \"/src/widget.tsx\",\n      `const logo = \"/assets/logo.png\";`,\n    );\n    expect(result?.code).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n  });\n\n  // Reproducer for #697: CSS imports are served as JS modules with the\n  // stylesheet embedded as a string. Rewriting url(\"/foo.woff2\") inside that\n  // string would produce invalid CSS once the styles are injected.\n  it(\"does not rewrite asset paths when transforming a CSS module\", () => {\n    const cssCode = `__vite__updateStyle(\"style-id\", \"@font-face { src: url(\\\\\"/fonts/Brand.woff2\\\\\") format(\\\\\"woff2\\\\\"); }\");`;\n\n    expect(runTransform(\"/src/fonts.css\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?direct\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?inline\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/styles.scss\", cssCode)).toBeNull();\n    expect(\n      runTransform(\"/src/Foo.vue?vue&type=style&lang.css\", cssCode),\n    ).toBeNull();\n  });\n});\n"]}

package/dist/server/auth/discovery.d.ts

@@ -0,0 +1,7 @@
+import { type OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+/** Discovered metadata; `jwks_uri` is an RFC field the SDK type doesn't expose. */
+export type DiscoveredMetadata = OAuthMetadata & {
+    jwks_uri?: string;
+};
+/** Fetches and validates an authorization server's discovery document. */
+export declare function discoverAuthorizationServer(issuer: string): Promise<DiscoveredMetadata>;

package/dist/server/auth/discovery.js

@@ -0,0 +1,41 @@
+import { OAuthMetadataSchema, } from "@modelcontextprotocol/sdk/shared/auth.js";
+const WELL_KNOWN = [
+    "/.well-known/openid-configuration",
+    "/.well-known/oauth-authorization-server",
+];
+/** Fetches and validates an authorization server's discovery document. */
+export async function discoverAuthorizationServer(issuer) {
+    const base = issuer.replace(/\/$/, "");
+    const errors = [];
+    for (const path of WELL_KNOWN) {
+        const url = `${base}${path}`;
+        let res;
+        try {
+            res = await fetch(url);
+        }
+        catch (err) {
+            errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
+        if (!res.ok) {
+            errors.push(`${url}: HTTP ${res.status}`);
+            continue;
+        }
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            errors.push(`${url}: response is not valid JSON`);
+            continue;
+        }
+        const parsed = OAuthMetadataSchema.safeParse(json);
+        if (!parsed.success) {
+            errors.push(`${url}: invalid metadata (${parsed.error.message})`);
+            continue;
+        }
+        return parsed.data;
+    }
+    throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join("; ")}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/server/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAKlD,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,8BAA8B,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,OAAO,MAAM,CAAC,IAA0B,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  type OAuthMetadata,\n  OAuthMetadataSchema,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\n\n/** Discovered metadata; `jwks_uri` is an RFC field the SDK type doesn't expose. */\nexport type DiscoveredMetadata = OAuthMetadata & { jwks_uri?: string };\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    let res: Response;\n    try {\n      res = await fetch(url);\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      continue;\n    }\n    if (!res.ok) {\n      errors.push(`${url}: HTTP ${res.status}`);\n      continue;\n    }\n    let json: unknown;\n    try {\n      json = await res.json();\n    } catch {\n      errors.push(`${url}: response is not valid JSON`);\n      continue;\n    }\n    const parsed = OAuthMetadataSchema.safeParse(json);\n    if (!parsed.success) {\n      errors.push(`${url}: invalid metadata (${parsed.error.message})`);\n      continue;\n    }\n    return parsed.data as DiscoveredMetadata;\n  }\n\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/discovery.test.js

@@ -0,0 +1,73 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { discoverAuthorizationServer } from "./discovery.js";
+let server;
+afterEach(() => server?.close());
+const DOC = {
+    issuer: "https://idp.test",
+    authorization_endpoint: "https://idp.test/authorize",
+    token_endpoint: "https://idp.test/token",
+    registration_endpoint: "https://idp.test/register",
+    response_types_supported: ["code"],
+    scopes_supported: ["openid", "email"],
+    jwks_uri: "https://idp.test/jwks",
+};
+// Serves the given bodies at their well-known paths; returns the origin URL.
+// A string body is sent raw (text/html); anything else is JSON-encoded.
+async function serve(routes) {
+    const srv = http.createServer((req, res) => {
+        const body = routes[req.url ?? ""];
+        if (body === undefined) {
+            res.writeHead(404).end();
+            return;
+        }
+        if (typeof body === "string") {
+            res.writeHead(200, { "content-type": "text/html" }).end(body);
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(body));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    const port = srv.address().port;
+    return `http://localhost:${port}`;
+}
+describe("discoverAuthorizationServer", () => {
+    it("fetches and validates openid-configuration", async () => {
+        const base = await serve({ "/.well-known/openid-configuration": DOC });
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe("https://idp.test/register");
+        expect(meta.jwks_uri).toBe("https://idp.test/jwks");
+    });
+    it("falls back to oauth-authorization-server when oidc is 404", async () => {
+        const base = await serve({
+            "/.well-known/oauth-authorization-server": DOC,
+        });
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe("https://idp.test/register");
+    });
+    it("throws when no well-known doc is reachable", async () => {
+        const base = await serve({});
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+    it("falls through to oauth-authorization-server when oidc doc is schema-invalid", async () => {
+        const invalidDoc = { ...DOC };
+        delete invalidDoc.response_types_supported;
+        const base = await serve({
+            "/.well-known/openid-configuration": invalidDoc,
+            "/.well-known/oauth-authorization-server": DOC,
+        });
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe("https://idp.test/register");
+    });
+    it("treats a 200 non-JSON body as unreachable and throws discovery failed", async () => {
+        const base = await serve({
+            "/.well-known/openid-configuration": "<html>nope</html>",
+            "/.well-known/oauth-authorization-server": "<html>nope</html>",
+        });
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+});
+//# sourceMappingURL=discovery.test.js.map

package/dist/server/auth/discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.test.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,MAAM,GAAG,GAAG;IACV,MAAM,EAAE,kBAAkB;IAC1B,sBAAsB,EAAE,4BAA4B;IACpD,cAAc,EAAE,wBAAwB;IACxC,qBAAqB,EAAE,2BAA2B;IAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;IAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IACrC,QAAQ,EAAE,uBAAuB;CAClC,CAAC;AAEF,6EAA6E;AAC7E,wEAAwE;AACxE,KAAK,UAAU,KAAK,CAAC,MAA+B;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACtD,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,EAAE,mCAAmC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;YACvB,yCAAyC,EAAE,GAAG;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,UAAU,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;QAC9B,OAAQ,UAAkC,CAAC,wBAAwB,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;YACvB,mCAAmC,EAAE,UAAU;YAC/C,yCAAyC,EAAE,GAAG;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;YACvB,mCAAmC,EAAE,mBAAmB;YACxD,yCAAyC,EAAE,mBAAmB;SAC/D,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { discoverAuthorizationServer } from \"./discovery.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nconst DOC = {\n  issuer: \"https://idp.test\",\n  authorization_endpoint: \"https://idp.test/authorize\",\n  token_endpoint: \"https://idp.test/token\",\n  registration_endpoint: \"https://idp.test/register\",\n  response_types_supported: [\"code\"],\n  scopes_supported: [\"openid\", \"email\"],\n  jwks_uri: \"https://idp.test/jwks\",\n};\n\n// Serves the given bodies at their well-known paths; returns the origin URL.\n// A string body is sent raw (text/html); anything else is JSON-encoded.\nasync function serve(routes: Record<string, unknown>) {\n  const srv = http.createServer((req, res) => {\n    const body = routes[req.url ?? \"\"];\n    if (body === undefined) {\n      res.writeHead(404).end();\n      return;\n    }\n    if (typeof body === \"string\") {\n      res.writeHead(200, { \"content-type\": \"text/html\" }).end(body);\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(body));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  const port = (srv.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"discoverAuthorizationServer\", () => {\n  it(\"fetches and validates openid-configuration\", async () => {\n    const base = await serve({ \"/.well-known/openid-configuration\": DOC });\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(\"https://idp.test/register\");\n    expect(meta.jwks_uri).toBe(\"https://idp.test/jwks\");\n  });\n\n  it(\"falls back to oauth-authorization-server when oidc is 404\", async () => {\n    const base = await serve({\n      \"/.well-known/oauth-authorization-server\": DOC,\n    });\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(\"https://idp.test/register\");\n  });\n\n  it(\"throws when no well-known doc is reachable\", async () => {\n    const base = await serve({});\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"falls through to oauth-authorization-server when oidc doc is schema-invalid\", async () => {\n    const invalidDoc = { ...DOC };\n    delete (invalidDoc as Partial<typeof DOC>).response_types_supported;\n    const base = await serve({\n      \"/.well-known/openid-configuration\": invalidDoc,\n      \"/.well-known/oauth-authorization-server\": DOC,\n    });\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(\"https://idp.test/register\");\n  });\n\n  it(\"treats a 200 non-JSON body as unreachable and throws discovery failed\", async () => {\n    const base = await serve({\n      \"/.well-known/openid-configuration\": \"<html>nope</html>\",\n      \"/.well-known/oauth-authorization-server\": \"<html>nope</html>\",\n    });\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n});\n"]}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { JwksVerifyConfig } from "./verify.js";
+/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
+export type OAuthConfig = {
+    /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */
+    baseUrl: string;
+    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
+    oauthMetadata: OAuthMetadata;
+    verify: JwksVerifyConfig;
+    /** Scopes advertised in protected-resource metadata. */
+    scopesSupported?: string[];
+    /** Server-wide required-scope floor. */
+    requiredScopes?: string[];
+    /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */
+    enforcement?: "required" | "optional";
+};

package/dist/server/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */\n  baseUrl: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */\n  enforcement?: \"required\" | \"optional\";\n};\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthConfig } from "../index.js";
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export declare function customProvider(opts: {
+    issuer: string;
+    audience: string;
+    baseUrl: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    enforcement?: "required" | "optional";
+    metadataOverrides?: Partial<OAuthMetadata>;
+}): Promise<OAuthConfig>;

package/dist/server/auth/providers/custom.js

@@ -0,0 +1,28 @@
+import { discoverAuthorizationServer, } from "../discovery.js";
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export async function customProvider(opts) {
+    const discovered = await discoverAuthorizationServer(opts.issuer);
+    const oauthMetadata = {
+        ...discovered,
+        ...opts.metadataOverrides,
+    };
+    if (!oauthMetadata.registration_endpoint) {
+        throw new Error(`${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`);
+    }
+    if (!oauthMetadata.jwks_uri) {
+        throw new Error(`${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`);
+    }
+    return {
+        baseUrl: opts.baseUrl,
+        oauthMetadata,
+        verify: {
+            issuer: oauthMetadata.issuer,
+            audience: opts.audience,
+            jwksUri: oauthMetadata.jwks_uri,
+        },
+        scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,
+        requiredScopes: opts.requiredScopes,
+        enforcement: opts.enforcement,
+    };
+}
+//# sourceMappingURL=custom.js.map

package/dist/server/auth/providers/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAQpC;IACC,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,aAAa,GAAuB;QACxC,GAAG,UAAU;QACb,GAAG,IAAI,CAAC,iBAAiB;KAC1B,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,2FAA2F,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,aAAa,CAAC,QAAQ;SAChC;QACD,eAAe,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,gBAAgB;QAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */\nexport async function customProvider(opts: {\n  issuer: string;\n  audience: string;\n  baseUrl: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  enforcement?: \"required\" | \"optional\";\n  metadataOverrides?: Partial<OAuthMetadata>;\n}): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n  const oauthMetadata: DiscoveredMetadata = {\n    ...discovered,\n    ...opts.metadataOverrides,\n  };\n\n  if (!oauthMetadata.registration_endpoint) {\n    throw new Error(\n      `${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`,\n    );\n  }\n  if (!oauthMetadata.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: oauthMetadata.issuer,\n      audience: opts.audience,\n      jwksUri: oauthMetadata.jwks_uri,\n    },\n    scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,\n    requiredScopes: opts.requiredScopes,\n    enforcement: opts.enforcement,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/custom.test.js

@@ -0,0 +1,82 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { customProvider } from "./custom.js";
+let server;
+afterEach(() => server?.close());
+async function serveDiscovery(doc) {
+    const srv = http.createServer((req, res) => {
+        if (req.url !== "/.well-known/openid-configuration") {
+            res.writeHead(404).end();
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(doc));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    const port = srv.address().port;
+    return `http://localhost:${port}`;
+}
+const ISSUER = "https://idp.test";
+function doc(extra = {}) {
+    return {
+        issuer: ISSUER,
+        authorization_endpoint: `${ISSUER}/authorize`,
+        token_endpoint: `${ISSUER}/token`,
+        registration_endpoint: `${ISSUER}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email", "profile"],
+        jwks_uri: `${ISSUER}/jwks`,
+        ...extra,
+    };
+}
+describe("customProvider", () => {
+    it("builds an OAuthConfig from discovery", async () => {
+        const base = await serveDiscovery(doc());
+        const config = await customProvider({
+            issuer: base,
+            audience: "my-api",
+            baseUrl: "https://app.example.test",
+            scopes: ["openid"],
+            enforcement: "optional",
+        });
+        expect(config.baseUrl).toBe("https://app.example.test");
+        expect(config.verify).toEqual({
+            issuer: ISSUER,
+            audience: "my-api",
+            jwksUri: `${ISSUER}/jwks`,
+        });
+        expect(config.scopesSupported).toEqual(["openid"]);
+        expect(config.enforcement).toBe("optional");
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${ISSUER}/register`);
+    });
+    it("defaults scopesSupported to the discovered scopes", async () => {
+        const base = await serveDiscovery(doc());
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+        });
+        expect(config.scopesSupported).toEqual(["openid", "email", "profile"]);
+    });
+    it("rejects a non-DCR IdP (no registration_endpoint)", async () => {
+        const base = await serveDiscovery(doc({ registration_endpoint: undefined }));
+        await expect(customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+        })).rejects.toThrow(/not DCR-compatible/);
+    });
+    it("applies metadataOverrides over discovered values", async () => {
+        const base = await serveDiscovery(doc());
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+            metadataOverrides: { token_endpoint: "https://override/token" },
+        });
+        expect(config.oauthMetadata.token_endpoint).toBe("https://override/token");
+    });
+});
+//# sourceMappingURL=custom.test.js.map

package/dist/server/auth/providers/custom.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,KAAK,UAAU,cAAc,CAAC,GAA4B;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACtD,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAClC,SAAS,GAAG,CAAC,QAAiC,EAAE;IAC9C,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,MAAM,OAAO;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,MAAM,WAAW,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,GAAG,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAC1C,CAAC;QACF,MAAM,MAAM,CACV,cAAc,CAAC;YACb,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;SACpC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nasync function serveDiscovery(doc: Record<string, unknown>) {\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  const port = (srv.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\nconst ISSUER = \"https://idp.test\";\nfunction doc(extra: Record<string, unknown> = {}) {\n  return {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    registration_endpoint: `${ISSUER}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${ISSUER}/jwks`,\n    ...extra,\n  };\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery(doc());\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n      enforcement: \"optional\",\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: ISSUER,\n      audience: \"my-api\",\n      jwksUri: `${ISSUER}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.enforcement).toBe(\"optional\");\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${ISSUER}/register`,\n    );\n  });\n\n  it(\"defaults scopesSupported to the discovered scopes\", async () => {\n    const base = await serveDiscovery(doc());\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n    });\n    expect(config.scopesSupported).toEqual([\"openid\", \"email\", \"profile\"]);\n  });\n\n  it(\"rejects a non-DCR IdP (no registration_endpoint)\", async () => {\n    const base = await serveDiscovery(\n      doc({ registration_endpoint: undefined }),\n    );\n    await expect(\n      customProvider({\n        issuer: base,\n        audience: \"a\",\n        baseUrl: \"https://app.example.test\",\n      }),\n    ).rejects.toThrow(/not DCR-compatible/);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery(doc());\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/setup.d.ts

@@ -0,0 +1,4 @@
+import type { Express } from "express";
+import type { OAuthConfig } from "./index.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export declare function setupOAuth(app: Express, config: OAuthConfig): void;

package/dist/server/auth/setup.js

@@ -0,0 +1,28 @@
+import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
+import { createJwksVerifier } from "./verify.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export function setupOAuth(app, config) {
+    let baseUrl;
+    try {
+        baseUrl = new URL(config.baseUrl);
+    }
+    catch {
+        throw new Error(`oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(config.baseUrl)}`);
+    }
+    if (!config.verify?.issuer || !config.verify?.audience) {
+        throw new Error("oauth.verify requires both `issuer` and `audience`");
+    }
+    app.use(mcpAuthMetadataRouter({
+        oauthMetadata: config.oauthMetadata,
+        resourceServerUrl: baseUrl,
+        scopesSupported: config.scopesSupported,
+    }));
+    const bearer = config.enforcement === "optional" ? optionalBearerAuth : requireBearerAuth;
+    app.use("/mcp", bearer({
+        verifier: createJwksVerifier(config.verify),
+        requiredScopes: config.requiredScopes,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
+    }));
+}
+//# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,OAAO;QAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GACV,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,MAAM,EACN,MAAM,CAAC;QACL,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;KACnE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport type { Express } from \"express\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  let baseUrl: URL;\n  try {\n    baseUrl = new URL(config.baseUrl);\n  } catch {\n    throw new Error(\n      `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n        config.baseUrl,\n      )}`,\n    );\n  }\n  if (!config.verify?.issuer || !config.verify?.audience) {\n    throw new Error(\"oauth.verify requires both `issuer` and `audience`\");\n  }\n\n  app.use(\n    mcpAuthMetadataRouter({\n      oauthMetadata: config.oauthMetadata,\n      resourceServerUrl: baseUrl,\n      scopesSupported: config.scopesSupported,\n    }),\n  );\n\n  const bearer =\n    config.enforcement === \"optional\" ? optionalBearerAuth : requireBearerAuth;\n  app.use(\n    \"/mcp\",\n    bearer({\n      verifier: createJwksVerifier(config.verify),\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n    }),\n  );\n}\n"]}

package/dist/server/auth/setup.test.d.ts

@@ -0,0 +1 @@
+export {};