skybridge 0.0.0-dev.ff4b4a2 → 0.0.0-dev.ffaef7a

package/dist/server/asset-base-url-transform-plugin.test.js

@@ -1,27 +1,26 @@
 import { describe, expect, it } from "vitest";
-import { assetBaseUrlTransform } from "./asset-base-url-transform-plugin.js";
+import { assetBaseUrlTransform, assetBaseUrlTransformPlugin, isCssRequest, } from "./asset-base-url-transform-plugin.js";
 describe("assetBaseUrlTransform", () => {
-    const devServerOrigin = "http://localhost:3000";
-    it("should transform asset paths in single, double, and backtick quotes", () => {
+    it("should transform asset paths to use window.skybridge.serverUrl", () => {
         const cases = [
             {
                 desc: "single-quoted",
                 code: `const image = '/assets/logo.png';`,
-                expected: `const image = '${devServerOrigin}/assets/logo.png';`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
             {
                 desc: "double-quoted",
                 code: `const image = "/assets/logo.png";`,
-                expected: `const image = "${devServerOrigin}/assets/logo.png";`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
             {
                 desc: "backtick-quoted",
                 code: "const image = `/assets/logo.png`;",
-                expected: `const image = \`${devServerOrigin}/assets/logo.png\`;`,
+                expected: `const image = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`,
             },
         ];
         for (const { code, expected } of cases) {
-            const result = assetBaseUrlTransform(code, devServerOrigin);
+            const result = assetBaseUrlTransform(code);
             expect(result).toBe(expected);
         }
     });
@@ -31,10 +30,10 @@ describe("assetBaseUrlTransform", () => {
       const icon = '/assets/icon.svg';
       const font = '/assets/font.woff2';
     `;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
-        expect(result).toContain(`${devServerOrigin}/assets/logo.png`);
-        expect(result).toContain(`${devServerOrigin}/assets/icon.svg`);
-        expect(result).toContain(`${devServerOrigin}/assets/font.woff2`);
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/icon.svg"`);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/font.woff2"`);
     });
     it("should not transform already absolute URLs", () => {
         const code = `
@@ -42,15 +41,94 @@ describe("assetBaseUrlTransform", () => {
       const http = 'http://example.com/image.png';
       const https = 'https://example.com/image.png';
     `;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
-        expect(result).toContain(`${devServerOrigin}/assets/logo.png`);
+        const result = assetBaseUrlTransform(code);
+        expect(result).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
         expect(result).toContain("http://example.com/image.png");
         expect(result).toContain("https://example.com/image.png");
     });
     it("should not transform code without asset paths", () => {
         const code = `const text = "Hello World";`;
-        const result = assetBaseUrlTransform(code, devServerOrigin);
+        const result = assetBaseUrlTransform(code);
         expect(result).toBe(code);
     });
+    it("should not transform asset paths inside static `import ... from` clauses", () => {
+        // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,
+        // Vite resolves the relative path to absolute, then this transform used
+        // to rewrite the resolved string — producing invalid JS like
+        // `import * as sprite from (expr) + "..."` that crashes vite:import-analysis.
+        const cases = [
+            `import * as sprite from "/Users/me/proj/node_modules/pkg/icons.svg";`,
+            `import sprite from '/assets/icons.svg';`,
+            `import sprite from "/assets/icons.svg";`,
+            `export { default } from "/assets/icons.svg";`,
+            `export * from '/assets/sprites.svg';`,
+        ];
+        for (const code of cases) {
+            expect(assetBaseUrlTransform(code)).toBe(code);
+        }
+    });
+    it("should still transform value-position asset paths in files that also have unrelated imports", () => {
+        const code = [
+            `import { foo } from "./foo.js";`,
+            `import * as sprite from "/assets/sprite.svg";`,
+            `const logo = "/assets/logo.png";`,
+        ].join("\n");
+        const result = assetBaseUrlTransform(code);
+        // Imports untouched
+        expect(result).toContain(`from "./foo.js"`);
+        expect(result).toContain(`from "/assets/sprite.svg"`);
+        // Value-position rewritten
+        expect(result).toContain(`const logo = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`);
+    });
+});
+describe("isCssRequest", () => {
+    it("returns true for CSS-family extensions", () => {
+        expect(isCssRequest("/src/styles.css")).toBe(true);
+        expect(isCssRequest("/src/styles.module.css")).toBe(true);
+        expect(isCssRequest("/src/styles.scss")).toBe(true);
+        expect(isCssRequest("/src/styles.sass")).toBe(true);
+        expect(isCssRequest("/src/styles.less")).toBe(true);
+        expect(isCssRequest("/src/styles.styl")).toBe(true);
+    });
+    it("returns true for CSS modules with Vite query strings", () => {
+        expect(isCssRequest("/src/styles.css?direct")).toBe(true);
+        expect(isCssRequest("/src/styles.css?inline")).toBe(true);
+        expect(isCssRequest("/src/styles.css?used")).toBe(true);
+        expect(isCssRequest("/src/Foo.vue?vue&type=style&lang.css")).toBe(true);
+    });
+    it("returns false for non-CSS modules", () => {
+        expect(isCssRequest("/src/index.tsx")).toBe(false);
+        expect(isCssRequest("/src/utils.ts")).toBe(false);
+        expect(isCssRequest("/src/Logo.svg")).toBe(false);
+        expect(isCssRequest("/src/notes.cssx")).toBe(false);
+    });
+});
+describe("assetBaseUrlTransformPlugin", () => {
+    function runTransform(id, code) {
+        const plugin = assetBaseUrlTransformPlugin();
+        const hook = plugin.transform;
+        if (!hook) {
+            throw new Error("plugin.transform is not defined");
+        }
+        const handler = typeof hook === "function" ? hook : hook.handler;
+        return handler.call(
+        // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook
+        {}, code, id, { moduleType: "js" });
+    }
+    it("rewrites asset paths in JS modules", () => {
+        const result = runTransform("/src/widget.tsx", `const logo = "/assets/logo.png";`);
+        expect(result?.code).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+    });
+    // Reproducer for #697: CSS imports are served as JS modules with the
+    // stylesheet embedded as a string. Rewriting url("/foo.woff2") inside that
+    // string would produce invalid CSS once the styles are injected.
+    it("does not rewrite asset paths when transforming a CSS module", () => {
+        const cssCode = `__vite__updateStyle("style-id", "@font-face { src: url(\\"/fonts/Brand.woff2\\") format(\\"woff2\\"); }");`;
+        expect(runTransform("/src/fonts.css", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?direct", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?inline", cssCode)).toBeNull();
+        expect(runTransform("/src/styles.scss", cssCode)).toBeNull();
+        expect(runTransform("/src/Foo.vue?vue&type=style&lang.css", cssCode)).toBeNull();
+    });
 });
 //# sourceMappingURL=asset-base-url-transform-plugin.test.js.map

package/dist/server/asset-base-url-transform-plugin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,eAAe,GAAG,uBAAuB,CAAC;IAEhD,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,kBAAkB,eAAe,oBAAoB;aAChE;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,kBAAkB,eAAe,oBAAoB;aAChE;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,mBAAmB,eAAe,qBAAqB;aAClE;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAE5D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,eAAe,kBAAkB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,eAAe,kBAAkB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,eAAe,oBAAoB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAE5D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,eAAe,kBAAkB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAE5D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,GACb,MAAM,sCAAsC,CAAC;AAE9C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAG3C,SAAS,YAAY,CAAC,EAAU,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,OAAO,CAAC,IAAI;QACjB,6EAA6E;QAC7E,EAAS,EACT,IAAI,EACJ,EAAE,EACF,EAAE,UAAU,EAAE,IAAI,EAAE,CACF,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CACzB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,4GAA4G,CAAC;QAE7H,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,CACJ,YAAY,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  assetBaseUrlTransform,\n  assetBaseUrlTransformPlugin,\n  isCssRequest,\n} from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n\ndescribe(\"isCssRequest\", () => {\n  it(\"returns true for CSS-family extensions\", () => {\n    expect(isCssRequest(\"/src/styles.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.module.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.scss\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.sass\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.less\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.styl\")).toBe(true);\n  });\n\n  it(\"returns true for CSS modules with Vite query strings\", () => {\n    expect(isCssRequest(\"/src/styles.css?direct\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?inline\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?used\")).toBe(true);\n    expect(isCssRequest(\"/src/Foo.vue?vue&type=style&lang.css\")).toBe(true);\n  });\n\n  it(\"returns false for non-CSS modules\", () => {\n    expect(isCssRequest(\"/src/index.tsx\")).toBe(false);\n    expect(isCssRequest(\"/src/utils.ts\")).toBe(false);\n    expect(isCssRequest(\"/src/Logo.svg\")).toBe(false);\n    expect(isCssRequest(\"/src/notes.cssx\")).toBe(false);\n  });\n});\n\ndescribe(\"assetBaseUrlTransformPlugin\", () => {\n  type TransformResult = { code: string; map: null } | null;\n\n  function runTransform(id: string, code: string): TransformResult {\n    const plugin = assetBaseUrlTransformPlugin();\n    const hook = plugin.transform;\n    if (!hook) {\n      throw new Error(\"plugin.transform is not defined\");\n    }\n    const handler = typeof hook === \"function\" ? hook : hook.handler;\n    return handler.call(\n      // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook\n      {} as any,\n      code,\n      id,\n      { moduleType: \"js\" },\n    ) as TransformResult;\n  }\n\n  it(\"rewrites asset paths in JS modules\", () => {\n    const result = runTransform(\n      \"/src/widget.tsx\",\n      `const logo = \"/assets/logo.png\";`,\n    );\n    expect(result?.code).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n  });\n\n  // Reproducer for #697: CSS imports are served as JS modules with the\n  // stylesheet embedded as a string. Rewriting url(\"/foo.woff2\") inside that\n  // string would produce invalid CSS once the styles are injected.\n  it(\"does not rewrite asset paths when transforming a CSS module\", () => {\n    const cssCode = `__vite__updateStyle(\"style-id\", \"@font-face { src: url(\\\\\"/fonts/Brand.woff2\\\\\") format(\\\\\"woff2\\\\\"); }\");`;\n\n    expect(runTransform(\"/src/fonts.css\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?direct\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?inline\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/styles.scss\", cssCode)).toBeNull();\n    expect(\n      runTransform(\"/src/Foo.vue?vue&type=style&lang.css\", cssCode),\n    ).toBeNull();\n  });\n});\n"]}

package/dist/server/auth/discovery.d.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+/**
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
+ */
+declare const DiscoverySchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodURL;
+    token_endpoint: z.ZodURL;
+    registration_endpoint: z.ZodOptional<z.ZodURL>;
+    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service_documentation: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint: z.ZodOptional<z.ZodURL>;
+    revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint: z.ZodOptional<z.ZodString>;
+    introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;
+/** Fetches and validates an authorization server's discovery document. */
+export declare function discoverAuthorizationServer(issuer: string): Promise<DiscoveredMetadata>;
+export {};

package/dist/server/auth/discovery.js

@@ -0,0 +1,56 @@
+import { OAuthMetadataSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod";
+/**
+ * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's
+ * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but
+ * we need it for JWKS token verification, so we extend the schema to keep it.
+ */
+const DiscoverySchema = OAuthMetadataSchema.extend({
+    jwks_uri: z.string().optional(),
+});
+const WELL_KNOWN = [
+    "/.well-known/openid-configuration",
+    "/.well-known/oauth-authorization-server",
+];
+const DISCOVERY_TIMEOUT_MS = 5000;
+/** Fetches and validates an authorization server's discovery document. */
+export async function discoverAuthorizationServer(issuer) {
+    const base = issuer.replace(/\/$/, "");
+    const errors = [];
+    // First valid doc lacking a registration_endpoint, kept as a fallback so a
+    // genuinely non-DCR IdP still resolves (and is rejected later by the caller).
+    let fallback;
+    for (const path of WELL_KNOWN) {
+        const url = `${base}${path}`;
+        // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer
+        // mismatch) records a per-URL reason and falls through to the next path.
+        try {
+            const res = await fetch(url, {
+                signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+            });
+            if (!res.ok) {
+                throw new Error(`HTTP ${res.status}`);
+            }
+            const meta = DiscoverySchema.parse(await res.json());
+            // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).
+            if (meta.issuer.replace(/\/$/, "") !== base) {
+                throw new Error(`issuer mismatch: ${meta.issuer}`);
+            }
+            // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a
+            // valid openid-configuration without `registration_endpoint` yet expose
+            // it at oauth-authorization-server. Keep looking past a doc that omits it.
+            if (meta.registration_endpoint) {
+                return meta;
+            }
+            fallback ??= meta;
+        }
+        catch (err) {
+            errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (fallback) {
+        return fallback;
+    }
+    throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join("; ")}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/server/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,QAAwC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,yEAAyE;YACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { OAuthMetadataSchema } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { z } from \"zod\";\n\n/**\n * Discovery doc validated as OAuth AS metadata + `jwks_uri`. The SDK's\n * `OAuthMetadataSchema` omits `jwks_uri` (its client never verifies tokens), but\n * we need it for JWKS token verification, so we extend the schema to keep it.\n */\nconst DiscoverySchema = OAuthMetadataSchema.extend({\n  jwks_uri: z.string().optional(),\n});\nexport type DiscoveredMetadata = z.infer<typeof DiscoverySchema>;\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n  // First valid doc lacking a registration_endpoint, kept as a fallback so a\n  // genuinely non-DCR IdP still resolves (and is rejected later by the caller).\n  let fallback: DiscoveredMetadata | undefined;\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    // Any failure (network/timeout, non-2xx, non-JSON, invalid metadata, issuer\n    // mismatch) records a per-URL reason and falls through to the next path.\n    try {\n      const res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n      if (!res.ok) {\n        throw new Error(`HTTP ${res.status}`);\n      }\n      const meta = DiscoverySchema.parse(await res.json());\n      // RFC 8414 §3.3: issuer must match the fetch origin (slash-insensitive).\n      if (meta.issuer.replace(/\\/$/, \"\") !== base) {\n        throw new Error(`issuer mismatch: ${meta.issuer}`);\n      }\n      // Prefer the document that advertises DCR: some IdPs (e.g. Clerk) serve a\n      // valid openid-configuration without `registration_endpoint` yet expose\n      // it at oauth-authorization-server. Keep looking past a doc that omits it.\n      if (meta.registration_endpoint) {\n        return meta;\n      }\n      fallback ??= meta;\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  if (fallback) {\n    return fallback;\n  }\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/discovery.test.js

@@ -0,0 +1,93 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { discoverAuthorizationServer } from "./discovery.js";
+let server;
+afterEach(() => server?.close());
+function doc(origin, extra = {}) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/authorize`,
+        token_endpoint: `${origin}/token`,
+        registration_endpoint: `${origin}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email"],
+        jwks_uri: `${origin}/jwks`,
+        ...extra,
+    };
+}
+// Serves JSON bodies built from the live origin at their well-known paths;
+// returns the origin URL.
+async function serve(build) {
+    let origin = "";
+    const srv = http.createServer((req, res) => {
+        const body = build(origin)[req.url ?? ""];
+        if (body === undefined) {
+            res.writeHead(404).end();
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(body));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    origin = `http://localhost:${srv.address().port}`;
+    return origin;
+}
+describe("discoverAuthorizationServer", () => {
+    it("fetches and validates openid-configuration", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+        expect(meta.jwks_uri).toBe(`${base}/jwks`);
+    });
+    it("accepts a canonically slash-terminated issuer", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, { issuer: `${o}/` }),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("falls back to oauth-authorization-server when oidc is 404", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("throws when no well-known doc is reachable", async () => {
+        const base = await serve(() => ({}));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+    it("falls through to oauth-authorization-server when oidc doc is schema-invalid", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, {
+                response_types_supported: undefined,
+            }),
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("prefers the doc advertising DCR when oidc omits registration_endpoint", async () => {
+        // Clerk-shaped: valid openid-configuration without a registration_endpoint,
+        // DCR exposed only at oauth-authorization-server.
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, {
+                registration_endpoint: undefined,
+            }),
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("rejects a doc whose issuer does not match the fetch origin", async () => {
+        const base = await serve(() => ({
+            "/.well-known/openid-configuration": doc("https://evil.test"),
+        }));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+});
+//# sourceMappingURL=discovery.test.js.map

package/dist/server/auth/discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.test.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,KAAK,UAAU,KAAK,CAAC,KAAkD;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SACjE,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,wBAAwB,EAAE,SAAS;aACpC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,qBAAqB,EAAE,SAAS;aACjC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,mCAAmC,EAAE,GAAG,CAAC,mBAAmB,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { discoverAuthorizationServer } from \"./discovery.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves JSON bodies built from the live origin at their well-known paths;\n// returns the origin URL.\nasync function serve(build: (origin: string) => Record<string, unknown>) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    const body = build(origin)[req.url ?? \"\"];\n    if (body === undefined) {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(body));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"discoverAuthorizationServer\", () => {\n  it(\"fetches and validates openid-configuration\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n    expect(meta.jwks_uri).toBe(`${base}/jwks`);\n  });\n\n  it(\"accepts a canonically slash-terminated issuer\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, { issuer: `${o}/` }),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"falls back to oauth-authorization-server when oidc is 404\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"throws when no well-known doc is reachable\", async () => {\n    const base = await serve(() => ({}));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"falls through to oauth-authorization-server when oidc doc is schema-invalid\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        response_types_supported: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"prefers the doc advertising DCR when oidc omits registration_endpoint\", async () => {\n    // Clerk-shaped: valid openid-configuration without a registration_endpoint,\n    // DCR exposed only at oauth-authorization-server.\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        registration_endpoint: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"rejects a doc whose issuer does not match the fetch origin\", async () => {\n    const base = await serve(() => ({\n      \"/.well-known/openid-configuration\": doc(\"https://evil.test\"),\n    }));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n});\n"]}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { JwksVerifyConfig } from "./verify.js";
+/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
+export type OAuthConfig = {
+    /**
+     * Public URL of this server; sets `resourceServerUrl` and the
+     * `resource_metadata` URL. When omitted, it is inferred per request from
+     * `x-forwarded-host`/`origin`/`host` headers.
+     */
+    baseUrl?: string;
+    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
+    oauthMetadata: OAuthMetadata;
+    verify: JwksVerifyConfig;
+    /** Scopes advertised in protected-resource metadata. */
+    scopesSupported?: string[];
+    /** Server-wide required-scope floor. */
+    requiredScopes?: string[];
+};

package/dist/server/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n};\n"]}

package/dist/server/auth/providers/auth0.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
+ * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this
+ * server's public URL. Requires DCR enabled on the tenant.
+ *
+ * Auth0 can't use the client's resource indicator — `audience` must be *in* the
+ * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see
+ * {@link customProvider}) and bakes `?audience=<id>` into the advertised
+ * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
+ * Auth0 (the token's real `iss`).
+ */
+export declare function auth0Provider(opts: {
+    domain: string;
+    audience: string;
+    serverUrl: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience" | "baseUrl" | "serverUrl">): Promise<OAuthConfig>;

package/dist/server/auth/providers/auth0.js

@@ -0,0 +1,31 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
+ * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this
+ * server's public URL. Requires DCR enabled on the tenant.
+ *
+ * Auth0 can't use the client's resource indicator — `audience` must be *in* the
+ * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see
+ * {@link customProvider}) and bakes `?audience=<id>` into the advertised
+ * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays
+ * Auth0 (the token's real `iss`).
+ */
+export async function auth0Provider(opts) {
+    const { domain, audience, ...rest } = opts;
+    const config = await customProvider({
+        issuer: toIssuerUrl(domain),
+        audience,
+        ...rest,
+    });
+    const authUrl = new URL(config.oauthMetadata.authorization_endpoint);
+    authUrl.searchParams.set("audience", audience);
+    return {
+        ...config,
+        oauthMetadata: {
+            ...config.oauthMetadata,
+            authorization_endpoint: authUrl.href,
+        },
+    };
+}
+//# sourceMappingURL=auth0.js.map

package/dist/server/auth/providers/auth0.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,QAAQ;QACR,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE;YACb,GAAG,MAAM,CAAC,aAAa;YACvB,sBAAsB,EAAE,OAAO,CAAC,IAAI;SACrC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`); `audience` is the API Identifier; `serverUrl` is this\n * server's public URL. Requires DCR enabled on the tenant.\n *\n * Auth0 can't use the client's resource indicator — `audience` must be *in* the\n * authorize request. So it runs as skybridge-as-AS (`serverUrl`, see\n * {@link customProvider}) and bakes `?audience=<id>` into the advertised\n * `authorization_endpoint`. The token's `aud` is the API; `verify.issuer` stays\n * Auth0 (the token's real `iss`).\n */\nexport async function auth0Provider(\n  opts: { domain: string; audience: string; serverUrl: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\" | \"baseUrl\" | \"serverUrl\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, audience, ...rest } = opts;\n  const config = await customProvider({\n    issuer: toIssuerUrl(domain),\n    audience,\n    ...rest,\n  });\n  const authUrl = new URL(config.oauthMetadata.authorization_endpoint);\n  authUrl.searchParams.set(\"audience\", audience);\n  return {\n    ...config,\n    oauthMetadata: {\n      ...config.oauthMetadata,\n      authorization_endpoint: authUrl.href,\n    },\n  };\n}\n"]}

package/dist/server/auth/providers/auth0.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/auth0.test.js

@@ -0,0 +1,48 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { auth0Provider } from "./auth0.js";
+afterEach(() => vi.restoreAllMocks());
+function doc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/oauth/token`,
+        registration_endpoint: `${issuer}/oidc/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "profile", "email"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+describe("auth0Provider", () => {
+    it("advertises skybridge as the AS (static issuer) and bakes audience; verifies against Auth0", async () => {
+        const issuer = "https://acme.us.auth0.com";
+        vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
+            headers: { "content-type": "application/json" },
+        }));
+        const config = await auth0Provider({
+            domain: "acme.us.auth0.com",
+            audience: "https://api.example.com/",
+            serverUrl: "https://app.example.com/",
+            scopes: ["openid", "profile", "email"],
+        });
+        // skybridge is the advertised AS: static issuer = serverUrl (trailing slash stripped).
+        expect(config.oauthMetadata.issuer).toBe("https://app.example.com");
+        // AS metadata scopes match the advertised set (clients read scopes from here).
+        expect(config.oauthMetadata.scopes_supported).toEqual([
+            "openid",
+            "profile",
+            "email",
+        ]);
+        expect(config.scopesSupported).toEqual(["openid", "profile", "email"]);
+        // audience baked into the advertised authorize endpoint (still pointing at Auth0).
+        const url = new URL(config.oauthMetadata.authorization_endpoint);
+        expect(url.origin + url.pathname).toBe(`${issuer}/authorize`);
+        expect(url.searchParams.get("audience")).toBe("https://api.example.com/");
+        // baseUrl left unset so the PRM resource resolves per request (Alpic-safe).
+        expect(config.baseUrl).toBeUndefined();
+        // token verification still uses Auth0 as issuer + the API audience.
+        expect(config.verify.issuer).toBe(issuer);
+        expect(config.verify.audience).toBe("https://api.example.com/");
+    });
+});
+//# sourceMappingURL=auth0.test.js.map

package/dist/server/auth/providers/auth0.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,gBAAgB;QAChD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,0BAA0B;YACpC,SAAS,EAAE,0BAA0B;YACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;SACvC,CAAC,CAAC;QAEH,uFAAuF;QACvF,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,+EAA+E;QAC/E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;YACpD,QAAQ;YACR,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,mFAAmF;QACnF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1E,4EAA4E;QAC5E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,oEAAoE;QACpE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { auth0Provider } from \"./auth0.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction doc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/oauth/token`,\n    registration_endpoint: `${issuer}/oidc/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"profile\", \"email\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\ndescribe(\"auth0Provider\", () => {\n  it(\"advertises skybridge as the AS (static issuer) and bakes audience; verifies against Auth0\", async () => {\n    const issuer = \"https://acme.us.auth0.com\";\n    vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n      new Response(JSON.stringify(doc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n    );\n\n    const config = await auth0Provider({\n      domain: \"acme.us.auth0.com\",\n      audience: \"https://api.example.com/\",\n      serverUrl: \"https://app.example.com/\",\n      scopes: [\"openid\", \"profile\", \"email\"],\n    });\n\n    // skybridge is the advertised AS: static issuer = serverUrl (trailing slash stripped).\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.com\");\n    // AS metadata scopes match the advertised set (clients read scopes from here).\n    expect(config.oauthMetadata.scopes_supported).toEqual([\n      \"openid\",\n      \"profile\",\n      \"email\",\n    ]);\n    expect(config.scopesSupported).toEqual([\"openid\", \"profile\", \"email\"]);\n    // audience baked into the advertised authorize endpoint (still pointing at Auth0).\n    const url = new URL(config.oauthMetadata.authorization_endpoint);\n    expect(url.origin + url.pathname).toBe(`${issuer}/authorize`);\n    expect(url.searchParams.get(\"audience\")).toBe(\"https://api.example.com/\");\n    // baseUrl left unset so the PRM resource resolves per request (Alpic-safe).\n    expect(config.baseUrl).toBeUndefined();\n    // token verification still uses Auth0 as issuer + the API audience.\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBe(\"https://api.example.com/\");\n  });\n});\n"]}

package/dist/server/auth/providers/clerk.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.
+ * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic
+ * Client Registration enabled on the instance, and the OAuth application set to
+ * issue JWT access tokens (opaque tokens can't be JWKS-verified).
+ *
+ * Clerk access tokens carry no `aud` claim, so there is no `audience` option —
+ * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).
+ */
+export declare function clerkProvider(opts: {
+    domain: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/clerk.js

@@ -0,0 +1,16 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.
+ * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic
+ * Client Registration enabled on the instance, and the OAuth application set to
+ * issue JWT access tokens (opaque tokens can't be JWKS-verified).
+ *
+ * Clerk access tokens carry no `aud` claim, so there is no `audience` option —
+ * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).
+ */
+export function clerkProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=clerk.js.map

package/dist/server/auth/providers/clerk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA6E;IAE7E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.\n * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic\n * Client Registration enabled on the instance, and the OAuth application set to\n * issue JWT access tokens (opaque tokens can't be JWKS-verified).\n *\n * Clerk access tokens carry no `aud` claim, so there is no `audience` option —\n * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).\n */\nexport function clerkProvider(\n  opts: { domain: string } & Omit<CustomProviderOptions, \"issuer\" | \"audience\">,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}

package/dist/server/auth/providers/clerk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/clerk.test.js

@@ -0,0 +1,28 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { clerkProvider } from "./clerk.js";
+afterEach(() => vi.restoreAllMocks());
+function doc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/oauth/authorize`,
+        token_endpoint: `${issuer}/oauth/token`,
+        registration_endpoint: `${issuer}/oauth/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["profile", "email"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+describe("clerkProvider", () => {
+    it("verifies issuer + JWKS with no audience (Clerk tokens carry no aud)", async () => {
+        const issuer = "https://acme.clerk.accounts.dev";
+        const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
+            headers: { "content-type": "application/json" },
+        }));
+        const config = await clerkProvider({ domain: "acme.clerk.accounts.dev" });
+        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toBe(issuer);
+        expect(config.verify.audience).toBeUndefined();
+    });
+});
+//# sourceMappingURL=clerk.test.js.map