skybridge 0.0.0-dev.ff50fdb → 0.0.0-dev.ffaef7a

package/dist/server/tunnel-proxy-router.test.js

@@ -0,0 +1,229 @@
+import { EventEmitter } from "node:events";
+import http from "node:http";
+import { Readable } from "node:stream";
+import express from "express";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { startTunnelControlServer } from "../cli/tunnel-control-server.js";
+import { createTunnelProxyRouter } from "./tunnel-proxy-router.js";
+function makeFakeChild() {
+    const child = new EventEmitter();
+    child.stdout = new Readable({ read() { } });
+    child.stderr = new Readable({ read() { } });
+    child.kill = vi.fn(() => true);
+    return child;
+}
+async function listen(handler) {
+    const server = http.createServer(handler);
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const port = server.address().port;
+    return { port, server };
+}
+const cleanups = [];
+afterEach(async () => {
+    while (cleanups.length > 0) {
+        const cleanup = cleanups.pop();
+        if (cleanup) {
+            await cleanup();
+        }
+    }
+});
+async function startProxy(controlPort) {
+    const app = express();
+    app.use(createTunnelProxyRouter(controlPort));
+    const { port, server } = await listen(app);
+    cleanups.push(() => new Promise((resolve) => {
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+    }));
+    return { port, server };
+}
+async function startControl() {
+    const child = makeFakeChild();
+    const control = await startTunnelControlServer(() => 3000, {
+        spawn: () => child,
+    });
+    cleanups.push(() => control.close());
+    return { control, child };
+}
+describe("createTunnelProxyRouter", () => {
+    describe("POST /__skybridge/tunnel", () => {
+        it("forwards to upstream and returns the upstream JSON", async () => {
+            const { control } = await startControl();
+            const { port } = await startProxy(control.port);
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            expect(res.status).toBe(200);
+            expect(res.headers.get("content-type")).toMatch(/application\/json/);
+            expect(await res.json()).toEqual({
+                status: "starting",
+                message: "Starting tunnel…",
+            });
+            expect(control.manager.getState().status).toBe("starting");
+        });
+        it("returns 502 when upstream is unavailable", async () => {
+            // Pick a port nothing is listening on by starting+stopping a server.
+            const probe = http.createServer();
+            await new Promise((resolve) => probe.listen(0, "127.0.0.1", resolve));
+            const deadPort = probe.address().port;
+            await new Promise((resolve) => probe.close(() => resolve()));
+            const { port } = await startProxy(deadPort);
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            expect(res.status).toBe(502);
+            const body = (await res.json());
+            expect(body.status).toBe("error");
+            expect(typeof body.message).toBe("string");
+        });
+    });
+    describe("DELETE /__skybridge/tunnel", () => {
+        it("forwards to upstream and returns the upstream JSON", async () => {
+            const { control, child } = await startControl();
+            const { port } = await startProxy(control.port);
+            // First start the tunnel so DELETE has something to stop.
+            await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "DELETE",
+            });
+            expect(res.status).toBe(200);
+            expect(await res.json()).toEqual({ status: "idle" });
+            expect(child.kill).toHaveBeenCalled();
+        });
+        it("returns 502 when upstream is unavailable", async () => {
+            const probe = http.createServer();
+            await new Promise((resolve) => probe.listen(0, "127.0.0.1", resolve));
+            const deadPort = probe.address().port;
+            await new Promise((resolve) => probe.close(() => resolve()));
+            const { port } = await startProxy(deadPort);
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "DELETE",
+            });
+            expect(res.status).toBe(502);
+        });
+    });
+    describe("GET /__skybridge/tunnel/events", () => {
+        it("pipes the upstream SSE stream through to the client", async () => {
+            const { control, child } = await startControl();
+            const { port } = await startProxy(control.port);
+            // Get the manager into a known state so the initial SSE frame is
+            // deterministic.
+            await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            child.stdout.emit("data", Buffer.from("Forwarding: https://abc.tunnel.example -> http://localhost:3000\n"));
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel/events`);
+            expect(res.status).toBe(200);
+            expect(res.headers.get("content-type")).toMatch(/text\/event-stream/);
+            expect(res.headers.get("cache-control")).toMatch(/no-cache/);
+            const body = res.body;
+            if (!body) {
+                throw new Error("expected response body");
+            }
+            const reader = body.getReader();
+            const { value } = await reader.read();
+            const chunk = new TextDecoder().decode(value);
+            expect(chunk).toContain("event: state");
+            expect(chunk).toContain('"status":"connected"');
+            expect(chunk).toContain('"url":"https://abc.tunnel.example"');
+            await reader.cancel();
+        });
+        it("forwards subsequent state changes through the SSE stream", async () => {
+            const { control, child } = await startControl();
+            const { port } = await startProxy(control.port);
+            await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel/events`);
+            const body = res.body;
+            if (!body) {
+                throw new Error("expected response body");
+            }
+            const reader = body.getReader();
+            const decoder = new TextDecoder();
+            // Drain the initial "starting" frame.
+            const first = await reader.read();
+            expect(decoder.decode(first.value)).toContain('"status":"starting"');
+            // Now drive a state change on the manager and read the next frame.
+            child.stdout.emit("data", Buffer.from("Forwarding: https://abc.tunnel.example -> http://localhost:3000\n"));
+            let combined = "";
+            // Reads may chunk arbitrarily, so accumulate until we see the connected
+            // event or hit a sane cap.
+            for (let i = 0; i < 5; i++) {
+                const { value, done } = await reader.read();
+                if (done) {
+                    break;
+                }
+                combined += decoder.decode(value);
+                if (combined.includes('"status":"connected"')) {
+                    break;
+                }
+            }
+            expect(combined).toContain('"status":"connected"');
+            expect(combined).toContain('"url":"https://abc.tunnel.example"');
+            await reader.cancel();
+        });
+        it("returns 502 when upstream is unavailable", async () => {
+            const probe = http.createServer();
+            await new Promise((resolve) => probe.listen(0, "127.0.0.1", resolve));
+            const deadPort = probe.address().port;
+            await new Promise((resolve) => probe.close(() => resolve()));
+            const { port } = await startProxy(deadPort);
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel/events`);
+            expect(res.status).toBe(502);
+            const body = (await res.json());
+            expect(body.status).toBe("error");
+        });
+        it("aborts the upstream connection when the proxy server is closed mid-stream", async () => {
+            const { control } = await startControl();
+            const { port, server } = await startProxy(control.port);
+            await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {
+                method: "POST",
+            });
+            // Snapshot the manager's listener counts before the SSE subscription so
+            // we can verify the proxy disconnected from upstream after shutdown.
+            const baseStateListeners = control.manager.listenerCount("state");
+            const baseActivityListeners = control.manager.listenerCount("activity");
+            const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel/events`);
+            const body = res.body;
+            if (!body) {
+                throw new Error("expected response body");
+            }
+            const reader = body.getReader();
+            // Drain the first frame to confirm the stream is live and the upstream
+            // SSE handler has subscribed to the manager.
+            await reader.read();
+            expect(control.manager.listenerCount("state")).toBe(baseStateListeners + 1);
+            // Close the proxy server, destroying in-flight responses. The proxy's
+            // req.on("close", ...) should fire and abort the upstream fetch.
+            server.closeAllConnections?.();
+            await new Promise((resolve) => server.close(() => resolve()));
+            // The client-side stream is dead — drain or fail, either is acceptable.
+            try {
+                while (true) {
+                    const { done } = await reader.read();
+                    if (done) {
+                        break;
+                    }
+                }
+            }
+            catch {
+                // expected: socket terminated when proxy server was destroyed
+            }
+            // Wait briefly for the upstream's req.on("close") to fire, then assert
+            // the manager listeners were detached. This is the load-bearing
+            // verification: it proves the proxy's AbortController propagated and
+            // upstream cleaned up its SSE subscription.
+            const start = Date.now();
+            while (control.manager.listenerCount("state") > baseStateListeners &&
+                Date.now() - start < 1000) {
+                await new Promise((r) => setTimeout(r, 20));
+            }
+            expect(control.manager.listenerCount("state")).toBe(baseStateListeners);
+            expect(control.manager.listenerCount("activity")).toBe(baseActivityListeners);
+        });
+    });
+});
+//# sourceMappingURL=tunnel-proxy-router.test.js.map

package/dist/server/tunnel-proxy-router.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-proxy-router.test.js","sourceRoot":"","sources":["../../src/server/tunnel-proxy-router.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,IAAI,YAAY,EAAe,CAAC;IAC9C,KAAK,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAgB,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAA6B;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAGD,MAAM,QAAQ,GAAc,EAAE,CAAC;AAE/B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,UAAU,CAAC,WAAmB;IAC3C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CACX,GAAG,EAAE,CACH,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CACL,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE;QACzD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACrE,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACrE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBAC/B,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CACtC,CAAC;YACF,MAAM,QAAQ,GAAI,KAAK,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC5D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAEnE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACrE,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhD,0DAA0D;YAC1D,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACzD,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACrE,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CACtC,CAAC;YACF,MAAM,QAAQ,GAAI,KAAK,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC5D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAEnE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACrE,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhD,iEAAiE;YACjE,iBAAiB;YACjB,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACzD,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,MAAM,EACN,MAAM,CAAC,IAAI,CACT,mEAAmE,CACpE,CACF,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oBAAoB,IAAI,4BAA4B,CACrD,CAAC;YAEF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAE9D,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhD,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACzD,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oBAAoB,IAAI,4BAA4B,CACrD,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,sCAAsC;YACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAErE,mEAAmE;YACnE,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,MAAM,EACN,MAAM,CAAC,IAAI,CACT,mEAAmE,CACpE,CACF,CAAC;YAEF,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,wEAAwE;YACxE,2BAA2B;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM;gBACR,CAAC;gBACD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC9C,MAAM;gBACR,CAAC;YACH,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAEjE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CACtC,CAAC;YACF,MAAM,QAAQ,GAAI,KAAK,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC5D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAEnE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oBAAoB,IAAI,4BAA4B,CACrD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAExD,MAAM,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,EAAE;gBACzD,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAExE,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oBAAoB,IAAI,4BAA4B,CACrD,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,uEAAuE;YACvE,6CAA6C;YAC7C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACjD,kBAAkB,GAAG,CAAC,CACvB,CAAC;YAEF,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAEpE,wEAAwE;YACxE,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACrC,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YAED,uEAAuE;YACvE,gEAAgE;YAChE,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OACE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,kBAAkB;gBAC3D,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,IAAI,EACzB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CACpD,qBAAqB,CACtB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { EventEmitter } from \"node:events\";\nimport http from \"node:http\";\nimport { Readable } from \"node:stream\";\nimport express from \"express\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { createTunnelProxyRouter } from \"./tunnel-proxy-router.js\";\n\ntype FakeChild = EventEmitter & {\n  stdout: Readable;\n  stderr: Readable;\n  kill: ReturnType<typeof vi.fn<() => boolean>>;\n};\n\nfunction makeFakeChild(): FakeChild {\n  const child = new EventEmitter() as FakeChild;\n  child.stdout = new Readable({ read() {} });\n  child.stderr = new Readable({ read() {} });\n  child.kill = vi.fn<() => boolean>(() => true);\n  return child;\n}\n\nasync function listen(handler: http.RequestListener) {\n  const server = http.createServer(handler);\n  await new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const port = (server.address() as { port: number }).port;\n  return { port, server };\n}\n\ntype Cleanup = () => Promise<void> | void;\nconst cleanups: Cleanup[] = [];\n\nafterEach(async () => {\n  while (cleanups.length > 0) {\n    const cleanup = cleanups.pop();\n    if (cleanup) {\n      await cleanup();\n    }\n  }\n});\n\nasync function startProxy(controlPort: number) {\n  const app = express();\n  app.use(createTunnelProxyRouter(controlPort));\n  const { port, server } = await listen(app);\n  cleanups.push(\n    () =>\n      new Promise<void>((resolve) => {\n        server.closeAllConnections?.();\n        server.close(() => resolve());\n      }),\n  );\n  return { port, server };\n}\n\nasync function startControl() {\n  const child = makeFakeChild();\n  const control = await startTunnelControlServer(() => 3000, {\n    spawn: () => child,\n  });\n  cleanups.push(() => control.close());\n  return { control, child };\n}\n\ndescribe(\"createTunnelProxyRouter\", () => {\n  describe(\"POST /__skybridge/tunnel\", () => {\n    it(\"forwards to upstream and returns the upstream JSON\", async () => {\n      const { control } = await startControl();\n      const { port } = await startProxy(control.port);\n\n      const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n\n      expect(res.status).toBe(200);\n      expect(res.headers.get(\"content-type\")).toMatch(/application\\/json/);\n      expect(await res.json()).toEqual({\n        status: \"starting\",\n        message: \"Starting tunnel…\",\n      });\n      expect(control.manager.getState().status).toBe(\"starting\");\n    });\n\n    it(\"returns 502 when upstream is unavailable\", async () => {\n      // Pick a port nothing is listening on by starting+stopping a server.\n      const probe = http.createServer();\n      await new Promise<void>((resolve) =>\n        probe.listen(0, \"127.0.0.1\", resolve),\n      );\n      const deadPort = (probe.address() as { port: number }).port;\n      await new Promise<void>((resolve) => probe.close(() => resolve()));\n\n      const { port } = await startProxy(deadPort);\n\n      const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n      expect(res.status).toBe(502);\n      const body = (await res.json()) as { status: string; message: string };\n      expect(body.status).toBe(\"error\");\n      expect(typeof body.message).toBe(\"string\");\n    });\n  });\n\n  describe(\"DELETE /__skybridge/tunnel\", () => {\n    it(\"forwards to upstream and returns the upstream JSON\", async () => {\n      const { control, child } = await startControl();\n      const { port } = await startProxy(control.port);\n\n      // First start the tunnel so DELETE has something to stop.\n      await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n\n      const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"DELETE\",\n      });\n\n      expect(res.status).toBe(200);\n      expect(await res.json()).toEqual({ status: \"idle\" });\n      expect(child.kill).toHaveBeenCalled();\n    });\n\n    it(\"returns 502 when upstream is unavailable\", async () => {\n      const probe = http.createServer();\n      await new Promise<void>((resolve) =>\n        probe.listen(0, \"127.0.0.1\", resolve),\n      );\n      const deadPort = (probe.address() as { port: number }).port;\n      await new Promise<void>((resolve) => probe.close(() => resolve()));\n\n      const { port } = await startProxy(deadPort);\n\n      const res = await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"DELETE\",\n      });\n      expect(res.status).toBe(502);\n    });\n  });\n\n  describe(\"GET /__skybridge/tunnel/events\", () => {\n    it(\"pipes the upstream SSE stream through to the client\", async () => {\n      const { control, child } = await startControl();\n      const { port } = await startProxy(control.port);\n\n      // Get the manager into a known state so the initial SSE frame is\n      // deterministic.\n      await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n      child.stdout.emit(\n        \"data\",\n        Buffer.from(\n          \"Forwarding: https://abc.tunnel.example -> http://localhost:3000\\n\",\n        ),\n      );\n\n      const res = await fetch(\n        `http://127.0.0.1:${port}/__skybridge/tunnel/events`,\n      );\n\n      expect(res.status).toBe(200);\n      expect(res.headers.get(\"content-type\")).toMatch(/text\\/event-stream/);\n      expect(res.headers.get(\"cache-control\")).toMatch(/no-cache/);\n\n      const body = res.body;\n      if (!body) {\n        throw new Error(\"expected response body\");\n      }\n      const reader = body.getReader();\n      const { value } = await reader.read();\n      const chunk = new TextDecoder().decode(value);\n\n      expect(chunk).toContain(\"event: state\");\n      expect(chunk).toContain('\"status\":\"connected\"');\n      expect(chunk).toContain('\"url\":\"https://abc.tunnel.example\"');\n\n      await reader.cancel();\n    });\n\n    it(\"forwards subsequent state changes through the SSE stream\", async () => {\n      const { control, child } = await startControl();\n      const { port } = await startProxy(control.port);\n\n      await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n\n      const res = await fetch(\n        `http://127.0.0.1:${port}/__skybridge/tunnel/events`,\n      );\n      const body = res.body;\n      if (!body) {\n        throw new Error(\"expected response body\");\n      }\n      const reader = body.getReader();\n      const decoder = new TextDecoder();\n\n      // Drain the initial \"starting\" frame.\n      const first = await reader.read();\n      expect(decoder.decode(first.value)).toContain('\"status\":\"starting\"');\n\n      // Now drive a state change on the manager and read the next frame.\n      child.stdout.emit(\n        \"data\",\n        Buffer.from(\n          \"Forwarding: https://abc.tunnel.example -> http://localhost:3000\\n\",\n        ),\n      );\n\n      let combined = \"\";\n      // Reads may chunk arbitrarily, so accumulate until we see the connected\n      // event or hit a sane cap.\n      for (let i = 0; i < 5; i++) {\n        const { value, done } = await reader.read();\n        if (done) {\n          break;\n        }\n        combined += decoder.decode(value);\n        if (combined.includes('\"status\":\"connected\"')) {\n          break;\n        }\n      }\n      expect(combined).toContain('\"status\":\"connected\"');\n      expect(combined).toContain('\"url\":\"https://abc.tunnel.example\"');\n\n      await reader.cancel();\n    });\n\n    it(\"returns 502 when upstream is unavailable\", async () => {\n      const probe = http.createServer();\n      await new Promise<void>((resolve) =>\n        probe.listen(0, \"127.0.0.1\", resolve),\n      );\n      const deadPort = (probe.address() as { port: number }).port;\n      await new Promise<void>((resolve) => probe.close(() => resolve()));\n\n      const { port } = await startProxy(deadPort);\n\n      const res = await fetch(\n        `http://127.0.0.1:${port}/__skybridge/tunnel/events`,\n      );\n      expect(res.status).toBe(502);\n      const body = (await res.json()) as { status: string };\n      expect(body.status).toBe(\"error\");\n    });\n\n    it(\"aborts the upstream connection when the proxy server is closed mid-stream\", async () => {\n      const { control } = await startControl();\n      const { port, server } = await startProxy(control.port);\n\n      await fetch(`http://127.0.0.1:${port}/__skybridge/tunnel`, {\n        method: \"POST\",\n      });\n\n      // Snapshot the manager's listener counts before the SSE subscription so\n      // we can verify the proxy disconnected from upstream after shutdown.\n      const baseStateListeners = control.manager.listenerCount(\"state\");\n      const baseActivityListeners = control.manager.listenerCount(\"activity\");\n\n      const res = await fetch(\n        `http://127.0.0.1:${port}/__skybridge/tunnel/events`,\n      );\n      const body = res.body;\n      if (!body) {\n        throw new Error(\"expected response body\");\n      }\n      const reader = body.getReader();\n      // Drain the first frame to confirm the stream is live and the upstream\n      // SSE handler has subscribed to the manager.\n      await reader.read();\n      expect(control.manager.listenerCount(\"state\")).toBe(\n        baseStateListeners + 1,\n      );\n\n      // Close the proxy server, destroying in-flight responses. The proxy's\n      // req.on(\"close\", ...) should fire and abort the upstream fetch.\n      server.closeAllConnections?.();\n      await new Promise<void>((resolve) => server.close(() => resolve()));\n\n      // The client-side stream is dead — drain or fail, either is acceptable.\n      try {\n        while (true) {\n          const { done } = await reader.read();\n          if (done) {\n            break;\n          }\n        }\n      } catch {\n        // expected: socket terminated when proxy server was destroyed\n      }\n\n      // Wait briefly for the upstream's req.on(\"close\") to fire, then assert\n      // the manager listeners were detached. This is the load-bearing\n      // verification: it proves the proxy's AbortController propagated and\n      // upstream cleaned up its SSE subscription.\n      const start = Date.now();\n      while (\n        control.manager.listenerCount(\"state\") > baseStateListeners &&\n        Date.now() - start < 1000\n      ) {\n        await new Promise((r) => setTimeout(r, 20));\n      }\n      expect(control.manager.listenerCount(\"state\")).toBe(baseStateListeners);\n      expect(control.manager.listenerCount(\"activity\")).toBe(\n        baseActivityListeners,\n      );\n    });\n  });\n});\n"]}

package/dist/server/view-name.test-d.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/view-name.test-d.js

@@ -0,0 +1,8 @@
+import { expectTypeOf, test } from "vitest";
+test("ViewNameFor falls back to string when the registry is empty", () => {
+    expectTypeOf().toEqualTypeOf();
+});
+test("ViewNameFor narrows to the registered view names when populated", () => {
+    expectTypeOf().toEqualTypeOf();
+});
+//# sourceMappingURL=view-name.test-d.js.map

package/dist/server/view-name.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-name.test-d.js","sourceRoot":"","sources":["../../src/server/view-name.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG5C,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,YAAY,EAAqC,CAAC,aAAa,EAAU,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,YAAY,EAA4C,CAAC,aAAa,EAEnE,CAAC;AACN,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport type { ViewNameFor } from \"./server.js\";\n\ntest(\"ViewNameFor falls back to string when the registry is empty\", () => {\n  expectTypeOf<ViewNameFor<Record<never, never>>>().toEqualTypeOf<string>();\n});\n\ntest(\"ViewNameFor narrows to the registered view names when populated\", () => {\n  expectTypeOf<ViewNameFor<{ home: true; about: true }>>().toEqualTypeOf<\n    \"home\" | \"about\"\n  >();\n});\n"]}

package/dist/server/view-resource-resolution.test.d.ts

@@ -0,0 +1,6 @@
+declare module "./server.js" {
+    interface ViewNameRegistry {
+        widget: true;
+    }
+}
+export {};

package/dist/server/view-resource-resolution.test.js

@@ -0,0 +1,171 @@
+import http from "node:http";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { __setBuildManifest, McpServer } from "./index.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("./viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
+// SKY-435: a view resource must resolve no matter the `?v=` query param value.
+// The version param is a content-derived cache key for external consumers
+// (it busts host/CDN caches when the bundle changes); it is not part of the
+// resource's identity, so a stale, absent, or arbitrary param must still serve
+// the underlying asset.
+async function connect(register) {
+    const server = new McpServer({ name: "test", version: "1.0.0" });
+    register(server);
+    const client = new Client({ name: "test-client", version: "1.0.0" });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    await server.connect(serverTransport);
+    await client.connect(clientTransport);
+    return {
+        client,
+        teardown: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
+let openHttpServer;
+afterEach(() => openHttpServer?.close());
+// Connect over real HTTP so forwarded proxy headers reach the resource handler.
+async function connectHttp(register, headers) {
+    const { createApp } = await import("./express.js");
+    const server = new McpServer({ name: "test", version: "1.0.0" });
+    register(server);
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    openHttpServer = listening;
+    const port = listening.address().port;
+    const client = new Client({ name: "test-client", version: "1.0.0" });
+    const transport = new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`), { requestInit: { headers } });
+    await client.connect(transport);
+    return {
+        client,
+        teardown: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
+function registerWidget(server) {
+    server.registerTool({ name: "show", description: "show", view: { component: "widget" } }, () => ({ content: [{ type: "text", text: "ok" }] }));
+}
+/** Narrow a read-resource content entry to its text variant. */
+function textContent(contents) {
+    return contents[0];
+}
+describe("view resource resolution (cache key)", () => {
+    afterEach(() => {
+        delete process.env.NODE_ENV;
+    });
+    it("resolves regardless of the ?v= param and echoes the requested URI", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        const { resources } = await client.listResources();
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
+        // Dev build advertises no cache key.
+        expect(listed?.uri).toBe("ui://views/ext-apps/widget.html");
+        // A stale/arbitrary/absent param all resolve the same underlying asset,
+        // and the response echoes the URI the consumer asked for (never rewritten).
+        for (const uri of [
+            "ui://views/ext-apps/widget.html?v=stale123",
+            "ui://views/ext-apps/widget.html?v=whatever-else",
+            "ui://views/ext-apps/widget.html",
+        ]) {
+            const { contents } = await client.readResource({ uri });
+            expect(contents).toHaveLength(1);
+            const content = textContent(contents);
+            expect(typeof content.text).toBe("string");
+            expect(content.text.length).toBeGreaterThan(0);
+            expect(content.uri).toBe(uri);
+        }
+        await teardown();
+    });
+    it("resolves a stale cache key when the canonical URI carries ?v= (prod)", async () => {
+        process.env.NODE_ENV = "production";
+        __setBuildManifest({
+            "src/views/widget.tsx": {
+                isEntry: true,
+                name: "widget",
+                file: "assets/widget-ABC123.js",
+            },
+            "style.css": { file: "assets/style-XYZ.css" },
+        });
+        const { client, teardown } = await connect(registerWidget);
+        const { resources } = await client.listResources();
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
+        // Production advertises a content-derived cache key.
+        expect(listed?.uri).toMatch(/^ui:\/\/views\/ext-apps\/widget\.html\?v=[0-9a-f]{8}$/);
+        // A consumer holding a stale key still resolves the current asset.
+        const staleUri = "ui://views/ext-apps/widget.html?v=00000000";
+        const { contents } = await client.readResource({ uri: staleUri });
+        expect(contents).toHaveLength(1);
+        const content = textContent(contents);
+        expect(typeof content.text).toBe("string");
+        expect(content.uri).toBe(staleUri);
+        await teardown();
+    });
+    it("still throws for an unknown view path", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        await expect(client.readResource({ uri: "ui://views/ext-apps/nope.html?v=1" })).rejects.toThrow();
+        await teardown();
+    });
+    // A proxy routing the request under a path prefix sends x-forwarded-prefix;
+    // the view's asset URLs must carry that prefix (and the forwarded origin) so
+    // they resolve back through the same routing. Per-request, so one process can
+    // serve many hosts/prefixes at once.
+    it("prefixes emitted asset URLs with x-forwarded-prefix (prod)", async () => {
+        process.env.NODE_ENV = "production";
+        __setBuildManifest({
+            "src/views/widget.tsx": {
+                isEntry: true,
+                name: "widget",
+                file: "assets/widget-ABC123.js",
+            },
+            "style.css": { file: "assets/style-XYZ.css" },
+        });
+        const { client, teardown } = await connectHttp(registerWidget, {
+            "x-forwarded-host": "foo.com",
+            "x-forwarded-proto": "https",
+            "x-forwarded-prefix": "/v1/canary",
+        });
+        try {
+            const { contents } = await client.readResource({
+                uri: "ui://views/ext-apps/widget.html",
+            });
+            const { text } = textContent(contents);
+            // Forwarded origin + prefix. (`assets/assets` is the existing layout: the
+            // manifest `file` already carries `assets/` and the template prepends
+            // `/assets/`; build.tsx's `_redirects` collapses it on the asset host.)
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/widget-ABC123.js");
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/style-XYZ.css");
+            // No unprefixed asset URL leaks through.
+            expect(text).not.toContain("foo.com/assets/");
+        }
+        finally {
+            await teardown();
+        }
+    });
+    // Back-compat: older Skybridge advertised the view at `ui://views/apps-sdk/...`
+    // via openai/outputTemplate. We no longer advertise it, but apps published then
+    // have it cached, so the read must still resolve to the ext-apps content.
+    it("resolves the legacy apps-sdk URL to the ext-apps content", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        const legacyUri = "ui://views/apps-sdk/widget.html";
+        const { contents } = await client.readResource({ uri: legacyUri });
+        expect(contents).toHaveLength(1);
+        const content = contents[0];
+        expect(content.mimeType).toBe("text/html;profile=mcp-app");
+        expect(content.text.length).toBeGreaterThan(0);
+        // The response echoes the requested (legacy) URI, never the canonical one.
+        expect(content.uri).toBe(legacyUri);
+        await teardown();
+    });
+});
+//# sourceMappingURL=view-resource-resolution.test.js.map

package/dist/server/view-resource-resolution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-resource-resolution.test.js","sourceRoot":"","sources":["../../src/server/view-resource-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAUJ,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,wBAAwB;AAExB,KAAK,UAAU,OAAO,CAAC,QAAqC;IAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAAuC,CAAC;AAC5C,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzC,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,QAAqC,EACrC,OAA+B;IAE/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,cAAc,GAAG,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAE5D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,EACvC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAC7B,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EACpE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,QAAgC;IAInD,OAAO,QAAQ,CAAC,CAAC,CAAkC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qCAAqC;QACrC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE5D,wEAAwE;QACxE,4EAA4E;QAC5E,KAAK,MAAM,GAAG,IAAI;YAChB,4CAA4C;YAC5C,iDAAiD;YACjD,iCAAiC;SAClC,EAAE,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qDAAqD;QACrD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CACzB,uDAAuD,CACxD,CAAC;QAEF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,MAAM,CACV,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAClE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,qCAAqC;IACrC,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,oBAAoB,EAAE,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC7C,GAAG,EAAE,iCAAiC;aACvC,CAAC,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACvC,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CACpB,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CACpB,uDAAuD,CACxD,CAAC;YACF,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,0EAA0E;IAC1E,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAIzB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport type { RequestHandler } from \"express\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"./viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\n// Mirror what the Skybridge Vite plugin generates in `.skybridge/views.d.ts`:\n// narrow `ViewName` so `component: \"widget\"` typechecks against the registry.\ndeclare module \"./server.js\" {\n  interface ViewNameRegistry {\n    widget: true;\n  }\n}\n\n// SKY-435: a view resource must resolve no matter the `?v=` query param value.\n// The version param is a content-derived cache key for external consumers\n// (it busts host/CDN caches when the bundle changes); it is not part of the\n// resource's identity, so a stale, absent, or arbitrary param must still serve\n// the underlying asset.\n\nasync function connect(register: (server: McpServer) => void) {\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const [clientTransport, serverTransport] =\n    InMemoryTransport.createLinkedPair();\n  await server.connect(serverTransport);\n  await client.connect(clientTransport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nlet openHttpServer: http.Server | undefined;\nafterEach(() => openHttpServer?.close());\n\n// Connect over real HTTP so forwarded proxy headers reach the resource handler.\nasync function connectHttp(\n  register: (server: McpServer) => void,\n  headers: Record<string, string>,\n) {\n  const { createApp } = await import(\"./express.js\");\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  openHttpServer = listening;\n  const port = (listening.address() as { port: number }).port;\n\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const transport = new StreamableHTTPClientTransport(\n    new URL(`http://localhost:${port}/mcp`),\n    { requestInit: { headers } },\n  );\n  await client.connect(transport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nfunction registerWidget(server: McpServer) {\n  server.registerTool(\n    { name: \"show\", description: \"show\", view: { component: \"widget\" } },\n    () => ({ content: [{ type: \"text\" as const, text: \"ok\" }] }),\n  );\n}\n\n/** Narrow a read-resource content entry to its text variant. */\nfunction textContent(contents: Array<{ uri: string }>): {\n  uri: string;\n  text: string;\n} {\n  return contents[0] as { uri: string; text: string };\n}\n\ndescribe(\"view resource resolution (cache key)\", () => {\n  afterEach(() => {\n    delete process.env.NODE_ENV;\n  });\n\n  it(\"resolves regardless of the ?v= param and echoes the requested URI\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/ext-apps/widget.html\"),\n    );\n    // Dev build advertises no cache key.\n    expect(listed?.uri).toBe(\"ui://views/ext-apps/widget.html\");\n\n    // A stale/arbitrary/absent param all resolve the same underlying asset,\n    // and the response echoes the URI the consumer asked for (never rewritten).\n    for (const uri of [\n      \"ui://views/ext-apps/widget.html?v=stale123\",\n      \"ui://views/ext-apps/widget.html?v=whatever-else\",\n      \"ui://views/ext-apps/widget.html\",\n    ]) {\n      const { contents } = await client.readResource({ uri });\n      expect(contents).toHaveLength(1);\n      const content = textContent(contents);\n      expect(typeof content.text).toBe(\"string\");\n      expect(content.text.length).toBeGreaterThan(0);\n      expect(content.uri).toBe(uri);\n    }\n\n    await teardown();\n  });\n\n  it(\"resolves a stale cache key when the canonical URI carries ?v= (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/ext-apps/widget.html\"),\n    );\n    // Production advertises a content-derived cache key.\n    expect(listed?.uri).toMatch(\n      /^ui:\\/\\/views\\/ext-apps\\/widget\\.html\\?v=[0-9a-f]{8}$/,\n    );\n\n    // A consumer holding a stale key still resolves the current asset.\n    const staleUri = \"ui://views/ext-apps/widget.html?v=00000000\";\n    const { contents } = await client.readResource({ uri: staleUri });\n    expect(contents).toHaveLength(1);\n    const content = textContent(contents);\n    expect(typeof content.text).toBe(\"string\");\n    expect(content.uri).toBe(staleUri);\n\n    await teardown();\n  });\n\n  it(\"still throws for an unknown view path\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    await expect(\n      client.readResource({ uri: \"ui://views/ext-apps/nope.html?v=1\" }),\n    ).rejects.toThrow();\n\n    await teardown();\n  });\n\n  // A proxy routing the request under a path prefix sends x-forwarded-prefix;\n  // the view's asset URLs must carry that prefix (and the forwarded origin) so\n  // they resolve back through the same routing. Per-request, so one process can\n  // serve many hosts/prefixes at once.\n  it(\"prefixes emitted asset URLs with x-forwarded-prefix (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connectHttp(registerWidget, {\n      \"x-forwarded-host\": \"foo.com\",\n      \"x-forwarded-proto\": \"https\",\n      \"x-forwarded-prefix\": \"/v1/canary\",\n    });\n    try {\n      const { contents } = await client.readResource({\n        uri: \"ui://views/ext-apps/widget.html\",\n      });\n      const { text } = textContent(contents);\n      // Forwarded origin + prefix. (`assets/assets` is the existing layout: the\n      // manifest `file` already carries `assets/` and the template prepends\n      // `/assets/`; build.tsx's `_redirects` collapses it on the asset host.)\n      expect(text).toContain(\n        \"https://foo.com/v1/canary/assets/assets/widget-ABC123.js\",\n      );\n      expect(text).toContain(\n        \"https://foo.com/v1/canary/assets/assets/style-XYZ.css\",\n      );\n      // No unprefixed asset URL leaks through.\n      expect(text).not.toContain(\"foo.com/assets/\");\n    } finally {\n      await teardown();\n    }\n  });\n\n  // Back-compat: older Skybridge advertised the view at `ui://views/apps-sdk/...`\n  // via openai/outputTemplate. We no longer advertise it, but apps published then\n  // have it cached, so the read must still resolve to the ext-apps content.\n  it(\"resolves the legacy apps-sdk URL to the ext-apps content\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const legacyUri = \"ui://views/apps-sdk/widget.html\";\n    const { contents } = await client.readResource({ uri: legacyUri });\n\n    expect(contents).toHaveLength(1);\n    const content = contents[0] as {\n      uri: string;\n      text: string;\n      mimeType: string;\n    };\n    expect(content.mimeType).toBe(\"text/html;profile=mcp-app\");\n    expect(content.text.length).toBeGreaterThan(0);\n    // The response echoes the requested (legacy) URI, never the canonical one.\n    expect(content.uri).toBe(legacyUri);\n\n    await teardown();\n  });\n});\n"]}

package/dist/server/viewsDevServer.d.ts

@@ -0,0 +1,14 @@
+import type http from "node:http";
+import { type Router } from "express";
+/**
+ * Vite dev-server middleware for view assets.
+ *
+ * MUST be mounted at the Express app root so Vite can intercept
+ * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:
+ *
+ *   const app = express();
+ *   if (env.NODE_ENV !== "production") {
+ *     app.use(await viewsDevServer(httpServer));
+ *   }
+ */
+export declare const viewsDevServer: (httpServer: http.Server) => Promise<Router>;

package/dist/server/viewsDevServer.js

@@ -0,0 +1,45 @@
+import path from "node:path";
+import cors from "cors";
+import express, {} from "express";
+import { assetBaseUrlTransformPlugin } from "./asset-base-url-transform-plugin.js";
+/**
+ * Vite dev-server middleware for view assets.
+ *
+ * MUST be mounted at the Express app root so Vite can intercept
+ * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:
+ *
+ *   const app = express();
+ *   if (env.NODE_ENV !== "production") {
+ *     app.use(await viewsDevServer(httpServer));
+ *   }
+ */
+export const viewsDevServer = async (httpServer) => {
+    const router = express.Router();
+    const { createServer, loadConfigFromFile } = await import("vite");
+    const root = process.cwd();
+    const configFile = path.join(root, "vite.config.ts");
+    const configResult = await loadConfigFromFile({ command: "serve", mode: "development" }, configFile, root);
+    const { build, preview, plugins: userPlugins = [], ...devConfig } = configResult?.config || {};
+    const vite = await createServer({
+        ...devConfig,
+        // Pass `false` so Vite skips re-resolving a config file — we already
+        // loaded and spread the user's config above.
+        configFile: false,
+        appType: "custom",
+        server: {
+            allowedHosts: true,
+            middlewareMode: true,
+            hmr: {
+                server: httpServer,
+            },
+        },
+        root,
+        // optimizeDeps is set by the skybridge Vite plugin (entries + include)
+        // so it can derive the view glob from `viewsDir`.
+        plugins: [...userPlugins, assetBaseUrlTransformPlugin()],
+    });
+    router.use(cors());
+    router.use("/", vite.middlewares);
+    return router;
+};
+//# sourceMappingURL=viewsDevServer.js.map

package/dist/server/viewsDevServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewsDevServer.js","sourceRoot":"","sources":["../../src/server/viewsDevServer.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAuB,EACN,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,UAAU,EACV,IAAI,CACL,CAAC;IAEF,MAAM,EACJ,KAAK,EACL,OAAO,EACP,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,GAAG,SAAS,EACb,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,qEAAqE;QACrE,6CAA6C;QAC7C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,GAAG,EAAE;gBACH,MAAM,EAAE,UAAU;aACnB;SACF;QACD,IAAI;QACJ,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport cors from \"cors\";\nimport express, { type Router } from \"express\";\nimport { assetBaseUrlTransformPlugin } from \"./asset-base-url-transform-plugin.js\";\n\n/**\n * Vite dev-server middleware for view assets.\n *\n * MUST be mounted at the Express app root so Vite can intercept\n * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:\n *\n *   const app = express();\n *   if (env.NODE_ENV !== \"production\") {\n *     app.use(await viewsDevServer(httpServer));\n *   }\n */\nexport const viewsDevServer = async (\n  httpServer: http.Server,\n): Promise<Router> => {\n  const router = express.Router();\n\n  const { createServer, loadConfigFromFile } = await import(\"vite\");\n\n  const root = process.cwd();\n  const configFile = path.join(root, \"vite.config.ts\");\n\n  const configResult = await loadConfigFromFile(\n    { command: \"serve\", mode: \"development\" },\n    configFile,\n    root,\n  );\n\n  const {\n    build,\n    preview,\n    plugins: userPlugins = [],\n    ...devConfig\n  } = configResult?.config || {};\n\n  const vite = await createServer({\n    ...devConfig,\n    // Pass `false` so Vite skips re-resolving a config file — we already\n    // loaded and spread the user's config above.\n    configFile: false,\n    appType: \"custom\",\n    server: {\n      allowedHosts: true,\n      middlewareMode: true,\n      hmr: {\n        server: httpServer,\n      },\n    },\n    root,\n    // optimizeDeps is set by the skybridge Vite plugin (entries + include)\n    // so it can derive the view glob from `viewsDir`.\n    plugins: [...userPlugins, assetBaseUrlTransformPlugin()],\n  });\n\n  router.use(cors());\n  router.use(\"/\", vite.middlewares);\n\n  return router;\n};\n"]}