skybridge 1.0.0 → 1.0.2

package/README.md

@@ -1,153 +1,152 @@
-<div align="center">
-
-<img alt="Skybridge" src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/github-banner.png" width="100%">
-
-<br />
-
-**Build ChatGPT & MCP Apps. The Modern TypeScript Way.**
-
-The fullstack TypeScript framework for AI-embedded views.<br />
-**Type-safe. React-powered. Platform-agnostic.**
-
-<br />
-
-[![NPM Version](https://img.shields.io/npm/v/skybridge?color=e90060&style=for-the-badge)](https://www.npmjs.com/package/skybridge)
-[![NPM Downloads](https://img.shields.io/npm/dm/skybridge?color=e90060&style=for-the-badge)](https://www.npmjs.com/package/skybridge)
-[![GitHub License](https://img.shields.io/github/license/alpic-ai/skybridge?color=e90060&style=for-the-badge)](https://github.com/alpic-ai/skybridge/blob/main/LICENSE)
-
-<br />
-
-[Documentation](https://docs.skybridge.tech) · [Quick Start](https://docs.skybridge.tech/quickstart/create-new-app) · [Showcase](https://docs.skybridge.tech/showcase)
-
-</div>
-
-<br />
-
-## ✨ Why Skybridge?
-
-ChatGPT Apps and MCP Apps let you embed **rich, interactive UIs** directly in AI conversations. But the raw SDKs are low-level—no hooks, no type safety, no dev tools, and no HMR.
-
-**Skybridge fixes that.**
-
-| | |
-|:--|:--|
-| 🌐 **Write once, run everywhere** — Skybridge works seamlessly with ChatGPT (Apps SDK) and MCP-compatible clients. | ✅ **End-to-End Type Safety** — tRPC-style inference from server to view. Autocomplete everywhere. |
-| 🔄 **View-to-Model Sync** — Keep the model aware of UI state with `data-llm`. Dual surfaces, one source of truth. | ⚒️ **React Query-style Hooks** — `isPending`, `isError`, callbacks. State management you already know. |
-| 👨‍💻 **Full dev environment** — HMR, debug traces, and local devtools. | 📦 **Showcase Examples** — Production-ready examples to learn from and build upon. |
-
-<br />
-
-## 🚀 Get Started
-
-**Create a new app:**
-
+# Skybridge - the MCP Apps framework
+
+<p align="center">
+  <a href="https://docs.skybridge.tech">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/skybridge-readme-banner-dark.png" />
+      <img alt="Skybridge, the full-stack React framework for MCP apps and MCP servers" src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/skybridge-readme-banner-light.png" width="100%" />
+    </picture>
+  </a>
+</p>
+
+<p align="center">
+  <strong>The full-stack React framework for MCP Apps and MCP Servers.</strong>
+</p>
+
+<p align="center">
+  <a href="https://docs.skybridge.tech">Documentation</a> ·
+  <a href="https://docs.skybridge.tech/quickstart/create-new-app">Quickstart</a> ·
+  <a href="https://github.com/alpic-ai/skybridge/tree/main/examples">Examples</a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/skybridge"><picture><source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/npm/v/skybridge?color=77F5EE&amp;labelColor=161B22&amp;style=for-the-badge"><img alt="npm version" src="https://img.shields.io/npm/v/skybridge?color=E3FAF7&amp;labelColor=F6F8FA&amp;style=for-the-badge"></picture></a>
+  <a href="https://www.npmjs.com/package/skybridge"><picture><source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/npm/dm/skybridge?color=D7FFC8&amp;labelColor=161B22&amp;style=for-the-badge"><img alt="npm downloads" src="https://img.shields.io/npm/dm/skybridge?color=E8FBD9&amp;labelColor=F6F8FA&amp;style=for-the-badge"></picture></a>
+  <a href="https://discord.com/invite/gNAazGueab"><picture><source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/badge/Discord-community-77F5EE?style=for-the-badge&amp;logo=discord&amp;logoColor=77F5EE&amp;labelColor=161B22"><img alt="Discord community" src="https://img.shields.io/badge/Discord-community-E3FAF7?style=for-the-badge&amp;logo=discord&amp;logoColor=5865F2&amp;labelColor=F6F8FA"></picture></a>
+  <a href="https://github.com/alpic-ai/skybridge/blob/main/LICENSE"><picture><source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/github/license/alpic-ai/skybridge?color=D7FFC8&amp;labelColor=161B22&amp;style=for-the-badge"><img alt="License: MIT" src="https://img.shields.io/github/license/alpic-ai/skybridge?color=E8FBD9&amp;labelColor=F6F8FA&amp;style=for-the-badge"></picture></a>
+</p>
+
+## About Skybridge
+
+Skybridge helps developers build type-safe MCP apps for Claude, ChatGPT and other UI-enabled MCP clients, with a complete set of tooling designed for both humans and agents.
+
+Why? MCP apps extend the [Model Context Protocol](https://modelcontextprotocol.io/docs/getting-started/intro) with **rich, interactive UI views** rendered from MCP servers. Conversational apps need seamless interaction between the user, the UI, and the model. This means new UX patterns, developer tooling, and abstractions. 
+Plus, the raw SDKs are low-level: no hooks, type safety, HMR, etc.
+
+That's why we built *Skybridge*.
+
+Features include:
+
+- **Delightful dev environment**: Skybridge provides a dev server with a local emulator, hot module reload, and a permanent tunnel to connect your local app to Claude and ChatGPT.
+- **Write once, run everywhere**: the framework abstracts implementation differences between MCP clients, so your app runs seamlessly in Claude, ChatGPT, VSCode, and any other MCP apps compatible client.
+- **Agent-ready**: powerful skills, CLI, and programmatic dev tool APIs, everything your coding agent needs to build MCP apps end-to-end.
+- **Type-safe end-to-end**: tRPC-style inference from MCP server tool definition to React view for type safety from server to frontend.
+- **React-first**: Intuitive React Query-style hooks, with advanced state management. 
+- **Example library**: get started quickly with ChatGPT- and Claude-ready app examples for ecommerce, travel, SaaS, and more.
+
+They chose to build their MCP apps with Skybridge: 
+
+<p align="center">
+  <a href="https://www.datadoghq.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/datadog-dark.svg"><img src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/datadog-light.svg" alt="Datadog" height="24"></picture></a>
+  &nbsp;&nbsp;
+  <a href="https://bitmovin.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/bitmovin-dark.svg"><img src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/bitmovin-light.svg" alt="Bitmovin" height="22"></picture></a>
+  &nbsp;&nbsp;
+  <a href="https://www.evaneos.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/evaneos-dark.svg"><img src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/evaneos-light.svg" alt="Evaneos" height="18"></picture></a>
+  &nbsp;&nbsp;
+  <a href="https://www.touchstream.media"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/touchstream-dark.svg"><img src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/touchstream-light.svg" alt="Touchstream" height="24"></picture></a>
+  &nbsp;&nbsp;
+  <a href="https://www.cottages.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/cottages-dark.svg"><img src="https://raw.githubusercontent.com/alpic-ai/skybridge/main/docs/images/user-logos/cottages-light.svg" alt="Cottages.com" height="24"></picture></a>
+</p>
+
+## Get started
+
+**For agents**
+
+Install our [skill](https://docs.skybridge.tech/devtools/skills) for building MCP apps and ChatGPT apps:
 ```bash
-npm create skybridge@latest
+npx skills add alpic-ai/skybridge -s skybridge
 ```
+Once installed, ask your agent "What skills do you have?" to confirm, then try:
 
-**Or add to an existing project:**
+- _Create a new MCP app_
+- _Migrate my MCP server to the Skybridge framework_
+- _Add a new view to my MCP app_ 
 
+**For humans**
+
+Bootstrap a new project with:
 ```bash
-npm i skybridge
-yarn add skybridge
-pnpm add skybridge
-bun add skybridge
-deno add skybridge
+npm create skybridge@latest my-app
 ```
+For full install instructions, read our [**Quickstart guide**](https://docs.skybridge.tech/quickstart/create-new-app).
 
-<div align="center">
-
-**👉 [Read the Docs](https://docs.skybridge.tech) 👈**
-
-</div>
+## Documentation
 
-<br />
+The [Skybridge documentation](https://docs.skybridge.tech) covers the full lifecycle of building MCP Apps:
 
-## 📦 Architecture
+- [Fundamentals](https://docs.skybridge.tech/fundamentals): understand MCP Apps, ChatGPT Apps, and how Skybridge bridges both runtimes.
+- [Core concepts](https://docs.skybridge.tech/concepts): learn about server <> model <> UI data flows, LLM context sync, type safety, and instant local iteration with our devtools.
+- [Guides](https://docs.skybridge.tech/guides/fetching-data): build real app behavior with tools, views, state, and model communication.
+- [API Reference](https://docs.skybridge.tech/api-reference): browse our MCP server APIs, React hooks, CLI commands, and runtime compatibility.
 
-Skybridge is a fullstack framework with unified server and client modules:
+## Deploy
 
-- **`skybridge/server`** — Define tools and views with full type inference. Extends the MCP SDK.
-- **`skybridge/web`** — React hooks that consume your server types. Works with Apps SDK (ChatGPT) and MCP Apps.
-- **Dev Environment** — Vite plugin with HMR, DevTools emulator, and optimized builds.
+Deploy Skybridge apps instantly on [Alpic](https://alpic.ai) for scalable hosting, MCP-specific analytics, permanent tunneling, app store compliance auditing and submission help. You can also self-host on any Node.js-compatible platform.
 
-### Server
+See our [deployment guide](https://docs.skybridge.tech/quickstart/deploy) for the full production path.
 
-```ts
-import { McpServer } from "skybridge/server";
+## Community & Contributing
 
-server.registerView("flights", {}, {
-  inputSchema: { destination: z.string() },
-}, async ({ destination }) => {
-  const flights = await searchFlights(destination);
-  return { structuredContent: { flights } };
-});
-```
-
-### View
-
-```tsx
-import { useToolInfo } from "skybridge/web";
-
-function FlightsView() {
-  const { output } = useToolInfo();
-
-  return output.structuredContent.flights.map(flight =>
-    <FlightCard key={flight.id} flight={flight} />
-  );
-}
-```
+We'd love your help improving Skybridge. Here are a few ways to get involved:
 
-<br />
+- **Bugs**: If you run into a bug or unexpected behavior, open a [GitHub Issue](https://github.com/alpic-ai/skybridge/issues) with a clear reproduction.
+- **Questions and ideas**: Need help building with Skybridge or have ideas to improve the framework, docs, examples, or developer experience? [Open an issue](https://github.com/alpic-ai/skybridge/issues) or share them on our [Discord](https://discord.com/invite/gNAazGueab).
+- **Pull requests**: For code or documentation changes, read the [Contributing Guide](https://github.com/alpic-ai/skybridge/blob/main/CONTRIBUTING.md) before opening a PR.
 
-## 🎯 Features at a Glance
+Skybridge is released under the [MIT License](https://github.com/alpic-ai/skybridge/blob/main/LICENSE).
 
-- **Live Reload** — Vite HMR. See changes instantly without reinstalling.
-- **Typed Hooks** — Full autocomplete for tools, inputs, outputs.
-- **View → Tool Calls** — Trigger server actions from UI.
-- **Dual Surface Sync** — Keep model aware of what users see with `data-llm`.
-- **React Query-style API** — `isPending`, `isError`, callbacks.
-- **Platform Agnostic** — Works with ChatGPT (Apps SDK) and MCP Apps clients (Goose, VSCode, etc.).
-- **MCP Compatible** — Extends the official SDK. Works with any MCP client.
+### Contributors
 
-<br />
+Built and maintained with ❤️ by [Harijoe](https://github.com/harijoe), [Fred Barthelet](https://github.com/fredericbarthelet), and the [Alpic](https://alpic.ai) team.
 
-## 📖 Showcase
+<a href="https://github.com/alpic-ai/skybridge/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=alpic-ai/skybridge" alt="Skybridge contributors">
+</a>
 
-Explore production-ready examples:
+## Example templates
 
-| Example                | Description                                                                      | Demo                                                | Code                                                                                |
-|------------------------|----------------------------------------------------------------------------------|-----------------------------------------------------|-------------------------------------------------------------------------------------|
-| **Awaze — Cottage Search** | Holiday cottage search and booking experience — browse properties, filter by location, and explore availability | [Try Demo](https://mcp.cottages.com/try) | —                                                                                                   |
-| **Capitals Explorer**     | Interactive world map with geolocation and Wikipedia integration                              | [Try Demo](https://capitals.skybridge.tech/try)           | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/capitals)           |
-| **Ecommerce Carousel**    | Product carousel with cart, localization, and modals                                          | [Try Demo](https://ecommerce.skybridge.tech/try)          | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/ecom-carousel)      |
-| **Everything**            | Comprehensive playground showcasing all hooks and features                                    | [Try Demo](https://everything.skybridge.tech/try)         | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/everything)         |
-| **Investigation Game**    | Interactive murder mystery game with multi-screen gameplay and dynamic story progression      | [Try Demo](https://investigation-game.skybridge.tech/try) | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/investigation-game) |
-| **Productivity**          | Data visualization dashboard demonstrating Skybridge capabilities for MCP Apps                | [Try Demo](https://productivity.skybridge.tech/try)       | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/productivity)       |
-| **Time's Up**             | Word-guessing party game where the user gives hints and the AI tries to guess the secret word | [Try Demo](https://times-up.skybridge.tech/try)           | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/times-up)           |
-| **Lumo — Interactive AI Tutor** | Adaptive educational tutor with Mermaid.js diagrams, mind maps, quizzes, and fill-in-the-blank exercises | [Try Demo](https://lumo-mcp-app-39519fdd.alpic.live/try) | [View Code](https://github.com/connorads/lumo-mcp-app)                                    |
-| **Auth — Auth0**          | Full OAuth authentication with Auth0 and personalized coffee shop search                      | —                                                         | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-auth0)         |
-| **Auth — Clerk**          | Full OAuth authentication with Clerk and personalized coffee shop search                      | —                                                         | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-clerk)         |
-| **Auth — Stytch**         | Full OAuth authentication with Stytch and personalized coffee shop search                     | —                                                         | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-stytch)        |
-| **Auth — WorkOS AuthKit** | Full OAuth authentication with WorkOS AuthKit and personalized coffee shop search             | —                                                         | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-workos)        |
-| **Flight Booking**        | Flight booking carousel with dynamic search and booking flow                                  | [Try Demo](https://flight-booking.skybridge.tech/try)     | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/flight-booking)     |
-| **Generative UI**         | Dynamic UI generation using json-render and Skybridge                                         | [Try Demo](https://generative-ui.skybridge.tech/try)      | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/generative-ui)      |
-| **Manifest Starter**      | Starter app with Manifest UI agentic components out-of-the-box                                | [Try Demo](https://manifest-ui.skybridge.tech/try)        | [View Code](https://github.com/alpic-ai/skybridge/tree/main/examples/manifest-ui)        |
+Explore all our example templates in the [Examples](https://docs.skybridge.tech/examples) section of the documentation.
 
-See all examples in the [Showcase](https://docs.skybridge.tech/showcase) or browse the [examples/](examples/) directory.
+### Basic
 
-<br />
+| Preview | App | Description | Demo | Code |
+| --- | --- | --- | --- | --- |
+| <img src="docs/images/showcase-example.png" alt="Everything" width="160" /> | Everything | Comprehensive playground app showcasing all Skybridge hooks and features. | [Try Demo](https://everything.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/everything) |
 
-<div align="center">
+### Use cases
 
-[![GitHub Discussions](https://img.shields.io/badge/Discussions-Ask%20Questions-blue?style=flat-square&logo=github)](https://github.com/alpic-ai/skybridge/discussions)
-[![GitHub Issues](https://img.shields.io/badge/Issues-Report%20Bugs-red?style=flat-square&logo=github)](https://github.com/alpic-ai/skybridge/issues)
-[![Discord](https://img.shields.io/badge/Discord-Chat-5865F2?style=flat-square&logo=discord&logoColor=white)](https://discord.com/invite/gNAazGueab)
+| Preview | App | Description | Demo | Code |
+| --- | --- | --- | --- | --- |
+| <img src="docs/images/showcase-capitals.png" alt="Capitals Explorer" width="160" /> | Capitals Explorer | Interactive world map with geolocation, country information, and dynamic capital exploration. | [Try Demo](https://capitals.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/capitals) |
+| <img src="docs/images/showcase-flight-booking.png" alt="Flight Booking" width="160" /> | Flight Booking | Flight search carousel with route details, pricing comparison, and external booking. | [Try Demo](https://flight-booking.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/flight-booking) |
+| <img src="docs/images/showcase-ecommerce.png" alt="Ecommerce Carousel" width="160" /> | Ecommerce Carousel | Product carousel with persistent cart, localization, theme switching, and modal dialogs. | [Try Demo](https://ecommerce.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/ecom-carousel) |
+| <img src="docs/images/showcase-investigation-game.png" alt="Investigation Game" width="160" /> | Investigation Game | Multi-screen mystery game with fullscreen mode, dynamic story progression and context asynchronicity demonstration | [Try Demo](https://investigation-game.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/investigation-game) |
+| <img src="docs/images/showcase-productivity.png" alt="Productivity" width="160" /> | Productivity | Interactive analytics dashboard with charts, theme adaptation, localization, fullscreen mode, and bidirectional tool calls. | [Try Demo](https://productivity.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/productivity) |
+| <img src="docs/images/showcase-times-up.png" alt="Time's Up" width="160" /> | Time's Up | Word-guessing party game where the user gives hints and the AI tries to guess. | [Try Demo](https://times-up.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/times-up) |
+| <img src="docs/images/showcase-lumo.png" alt="Lumo Interactive AI Tutor" width="160" /> | Lumo — Interactive AI Tutor | Adaptive tutor with Mermaid diagrams, mind maps, quizzes, and fill-in-the-blank exercises. | [Try Demo](https://lumo-mcp-app-39519fdd.alpic.live/try) | [View code](https://github.com/connorads/lumo-mcp-app) |
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for setup instructions
+### Auth
 
-<br />
+| Preview | Provider | Description | Code |
+| --- | --- | --- | --- |
+| <img src="docs/images/showcase-clerk.png" alt="Auth Clerk" width="160" /> | Clerk | Full OAuth authentication with Clerk and personalized coffee shop search. | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-clerk) |
+| <img src="docs/images/showcase-workos.png" alt="Auth WorkOS AuthKit" width="160" /> | WorkOS AuthKit | Full OAuth authentication with WorkOS AuthKit and personalized coffee shop search. | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-workos) |
+| <img src="docs/images/showcase-stytch.png" alt="Auth Stytch" width="160" /> | Stytch | Full OAuth authentication with Stytch and personalized coffee shop search. | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-stytch) |
+| <img src="docs/images/showcase-auth0.png" alt="Auth Auth0" width="160" /> | Auth0 | Full OAuth authentication with Auth0 and personalized coffee shop search. | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/auth-auth0) |
 
-**[MIT License](LICENSE)** · Made with ❤️ by **[Alpic](https://alpic.ai)**
+### UI and component libraries
 
-</div>
+| Preview | App | Description | Demo | Code |
+| --- | --- | --- | --- | --- |
+| <img src="docs/images/showcase-manifest-ui.png" alt="Manifest UI" width="160" /> | Manifest UI | Agentic component library example for rich AI-powered experiences. | [Try Demo](https://manifest-ui.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/manifest-ui) |
+| <img src="docs/images/showcase-generative-ui.png" alt="Generative UI" width="160" /> | Generative UI | LLM-generated dynamic UIs with json-render and 36 pre-built shadcn/ui components. | [Try Demo](https://generative-ui.skybridge.tech/try) | [View code](https://github.com/alpic-ai/skybridge/tree/main/examples/generative-ui) |

package/dist/commands/create.d.ts

@@ -0,0 +1,9 @@
+import { Command, type Command as CommandLoadable, Help } from "@oclif/core";
+export default class Create extends Command {
+    static description: string;
+    static strict: boolean;
+    run(): Promise<void>;
+}
+export declare class SkybridgeHelp extends Help {
+    showCommandHelp(command: CommandLoadable.Loadable): Promise<void>;
+}

package/dist/commands/create.js

@@ -0,0 +1,30 @@
+import { Command, Help } from "@oclif/core";
+import spawn from "cross-spawn";
+function passthrough(args) {
+    const { status, error } = spawn.sync("npx", ["--yes", "create-skybridge@latest", ...args], { stdio: "inherit" });
+    if (error) {
+        console.error(error);
+        process.exit(1);
+    }
+    process.exit(status ?? 1);
+}
+export default class Create extends Command {
+    static description = "Scaffold a new Skybridge project";
+    static strict = false;
+    async run() {
+        passthrough(this.argv);
+    }
+}
+// Registered as `oclif.helpClass` so that `skybridge create --help` forwards
+// to `create-skybridge --help` (single source of truth for the help text)
+// instead of rendering oclif's auto-generated help. All other commands fall
+// through to the default `Help` behaviour.
+export class SkybridgeHelp extends Help {
+    async showCommandHelp(command) {
+        if (command.id === "create") {
+            passthrough(["--help"]);
+        }
+        return super.showCommandHelp(command);
+    }
+}
+//# sourceMappingURL=create.js.map

package/dist/commands/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmC,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,MAAM,aAAa,CAAC;AAEhC,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAClC,KAAK,EACL,CAAC,OAAO,EAAE,yBAAyB,EAAE,GAAG,IAAI,CAAC,EAC7C,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAU,WAAW,GAAG,kCAAkC,CAAC;IACjE,MAAM,CAAU,MAAM,GAAG,KAAK,CAAC;IAExB,KAAK,CAAC,GAAG;QACd,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;;AAGH,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,OAAO,aAAc,SAAQ,IAAI;IAC5B,KAAK,CAAC,eAAe,CAC5B,OAAiC;QAEjC,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF","sourcesContent":["import { Command, type Command as CommandLoadable, Help } from \"@oclif/core\";\nimport spawn from \"cross-spawn\";\n\nfunction passthrough(args: string[]): never {\n  const { status, error } = spawn.sync(\n    \"npx\",\n    [\"--yes\", \"create-skybridge@latest\", ...args],\n    { stdio: \"inherit\" },\n  );\n  if (error) {\n    console.error(error);\n    process.exit(1);\n  }\n  process.exit(status ?? 1);\n}\n\nexport default class Create extends Command {\n  static override description = \"Scaffold a new Skybridge project\";\n  static override strict = false;\n\n  public async run(): Promise<void> {\n    passthrough(this.argv);\n  }\n}\n\n// Registered as `oclif.helpClass` so that `skybridge create --help` forwards\n// to `create-skybridge --help` (single source of truth for the help text)\n// instead of rendering oclif's auto-generated help. All other commands fall\n// through to the default `Help` behaviour.\nexport class SkybridgeHelp extends Help {\n  override async showCommandHelp(\n    command: CommandLoadable.Loadable,\n  ): Promise<void> {\n    if (command.id === \"create\") {\n      passthrough([\"--help\"]);\n    }\n    return super.showCommandHelp(command);\n  }\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.d.ts

@@ -1,4 +1,5 @@
 import type { Plugin } from "vite";
+export declare function isCssRequest(id: string): boolean;
 /**
  * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
  * so they work both locally and behind tunnels.

package/dist/server/asset-base-url-transform-plugin.js

@@ -1,3 +1,10 @@
+// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions
+// either at the end of the id or right before the query string. Catches both
+// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).
+const CSS_LANGS_RE = /\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
+export function isCssRequest(id) {
+    return CSS_LANGS_RE.test(id);
+}
 /**
  * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,
  * so they work both locally and behind tunnels.
@@ -15,10 +22,18 @@ export function assetBaseUrlTransform(code) {
 export function assetBaseUrlTransformPlugin() {
     return {
         name: "asset-base-url-transform",
-        transform(code) {
+        transform(code, id) {
             if (!code) {
                 return null;
             }
+            // Vite serves CSS modules as JS that embeds the stylesheet as a string
+            // literal. Rewriting `url("/foo.woff2")` inside that string to a JS
+            // concatenation expression produces invalid CSS once it lands in a
+            // <style> tag. CSS asset URLs are already handled at build time by
+            // `experimental.renderBuiltUrl`, so skip CSS requests here.
+            if (isCssRequest(id)) {
+                return null;
+            }
             const transformedCode = assetBaseUrlTransform(code);
             if (transformedCode === code) {
                 return null;

package/dist/server/asset-base-url-transform-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;IAE/G,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACpE,OAAO,0CAA0C,SAAS,GAAG,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,SAAS,CAAC,IAAI;YACZ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\n\n/**\n * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,\n * so they work both locally and behind tunnels.\n */\nexport function assetBaseUrlTransform(code: string): string {\n  const assetStringPattern =\n    /(?<!\\bfrom\\s)(?<!https?:\\/\\/)([\"'`])(\\/[^\"'`]+\\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\\1/g;\n\n  code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {\n    return `(window.skybridge?.serverUrl ?? \"\") + \"${assetPath}\"`;\n  });\n\n  return code;\n}\n\n/**\n * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.\n */\nexport function assetBaseUrlTransformPlugin(): Plugin {\n  return {\n    name: \"asset-base-url-transform\",\n    transform(code) {\n      if (!code) {\n        return null;\n      }\n\n      const transformedCode = assetBaseUrlTransform(code);\n\n      if (transformedCode === code) {\n        return null;\n      }\n\n      return {\n        code: transformedCode,\n        map: null,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"asset-base-url-transform-plugin.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,6EAA6E;AAC7E,uFAAuF;AACvF,MAAM,YAAY,GAChB,6DAA6D,CAAC;AAEhE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,kBAAkB,GACtB,4GAA4G,CAAC;IAE/G,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACpE,OAAO,0CAA0C,SAAS,GAAG,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,SAAS,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Plugin } from \"vite\";\n\n// Mirrors Vite's own `isCSSRequest`: matches the css family of extensions\n// either at the end of the id or right before the query string. Catches both\n// plain `.css` requests and SFC style blocks (e.g. `Foo.vue?vue&type=style&lang.css`).\nconst CSS_LANGS_RE =\n  /\\.(css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\\?)/;\n\nexport function isCssRequest(id: string): boolean {\n  return CSS_LANGS_RE.test(id);\n}\n\n/**\n * Transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`,\n * so they work both locally and behind tunnels.\n */\nexport function assetBaseUrlTransform(code: string): string {\n  const assetStringPattern =\n    /(?<!\\bfrom\\s)(?<!https?:\\/\\/)([\"'`])(\\/[^\"'`]+\\.(svg|png|jpeg|jpg|gif|webp|mp3|mp4|woff|woff2|ttf|eot))\\1/g;\n\n  code = code.replace(assetStringPattern, (_match, _quote, assetPath) => {\n    return `(window.skybridge?.serverUrl ?? \"\") + \"${assetPath}\"`;\n  });\n\n  return code;\n}\n\n/**\n * Vite plugin that transforms asset import paths to resolve at runtime via `window.skybridge.serverUrl`.\n */\nexport function assetBaseUrlTransformPlugin(): Plugin {\n  return {\n    name: \"asset-base-url-transform\",\n    transform(code, id) {\n      if (!code) {\n        return null;\n      }\n\n      // Vite serves CSS modules as JS that embeds the stylesheet as a string\n      // literal. Rewriting `url(\"/foo.woff2\")` inside that string to a JS\n      // concatenation expression produces invalid CSS once it lands in a\n      // <style> tag. CSS asset URLs are already handled at build time by\n      // `experimental.renderBuiltUrl`, so skip CSS requests here.\n      if (isCssRequest(id)) {\n        return null;\n      }\n\n      const transformedCode = assetBaseUrlTransform(code);\n\n      if (transformedCode === code) {\n        return null;\n      }\n\n      return {\n        code: transformedCode,\n        map: null,\n      };\n    },\n  };\n}\n"]}

package/dist/server/asset-base-url-transform-plugin.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { assetBaseUrlTransform } from "./asset-base-url-transform-plugin.js";
+import { assetBaseUrlTransform, assetBaseUrlTransformPlugin, isCssRequest, } from "./asset-base-url-transform-plugin.js";
 describe("assetBaseUrlTransform", () => {
     it("should transform asset paths to use window.skybridge.serverUrl", () => {
         const cases = [
@@ -81,4 +81,54 @@ describe("assetBaseUrlTransform", () => {
         expect(result).toContain(`const logo = (window.skybridge?.serverUrl ?? "") + "/assets/logo.png";`);
     });
 });
+describe("isCssRequest", () => {
+    it("returns true for CSS-family extensions", () => {
+        expect(isCssRequest("/src/styles.css")).toBe(true);
+        expect(isCssRequest("/src/styles.module.css")).toBe(true);
+        expect(isCssRequest("/src/styles.scss")).toBe(true);
+        expect(isCssRequest("/src/styles.sass")).toBe(true);
+        expect(isCssRequest("/src/styles.less")).toBe(true);
+        expect(isCssRequest("/src/styles.styl")).toBe(true);
+    });
+    it("returns true for CSS modules with Vite query strings", () => {
+        expect(isCssRequest("/src/styles.css?direct")).toBe(true);
+        expect(isCssRequest("/src/styles.css?inline")).toBe(true);
+        expect(isCssRequest("/src/styles.css?used")).toBe(true);
+        expect(isCssRequest("/src/Foo.vue?vue&type=style&lang.css")).toBe(true);
+    });
+    it("returns false for non-CSS modules", () => {
+        expect(isCssRequest("/src/index.tsx")).toBe(false);
+        expect(isCssRequest("/src/utils.ts")).toBe(false);
+        expect(isCssRequest("/src/Logo.svg")).toBe(false);
+        expect(isCssRequest("/src/notes.cssx")).toBe(false);
+    });
+});
+describe("assetBaseUrlTransformPlugin", () => {
+    function runTransform(id, code) {
+        const plugin = assetBaseUrlTransformPlugin();
+        const hook = plugin.transform;
+        if (!hook) {
+            throw new Error("plugin.transform is not defined");
+        }
+        const handler = typeof hook === "function" ? hook : hook.handler;
+        return handler.call(
+        // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook
+        {}, code, id, { moduleType: "js" });
+    }
+    it("rewrites asset paths in JS modules", () => {
+        const result = runTransform("/src/widget.tsx", `const logo = "/assets/logo.png";`);
+        expect(result?.code).toContain(`(window.skybridge?.serverUrl ?? "") + "/assets/logo.png"`);
+    });
+    // Reproducer for #697: CSS imports are served as JS modules with the
+    // stylesheet embedded as a string. Rewriting url("/foo.woff2") inside that
+    // string would produce invalid CSS once the styles are injected.
+    it("does not rewrite asset paths when transforming a CSS module", () => {
+        const cssCode = `__vite__updateStyle("style-id", "@font-face { src: url(\\"/fonts/Brand.woff2\\") format(\\"woff2\\"); }");`;
+        expect(runTransform("/src/fonts.css", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?direct", cssCode)).toBeNull();
+        expect(runTransform("/src/fonts.css?inline", cssCode)).toBeNull();
+        expect(runTransform("/src/styles.scss", cssCode)).toBeNull();
+        expect(runTransform("/src/Foo.vue?vue&type=style&lang.css", cssCode)).toBeNull();
+    });
+});
 //# sourceMappingURL=asset-base-url-transform-plugin.test.js.map

package/dist/server/asset-base-url-transform-plugin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { assetBaseUrlTransform } from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n"]}
+{"version":3,"file":"asset-base-url-transform-plugin.test.js","sourceRoot":"","sources":["../../src/server/asset-base-url-transform-plugin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,GACb,MAAM,sCAAsC,CAAC;AAE9C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG;YACZ;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,yEAAyE;aACpF;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG;;;;KAIZ,CAAC;QACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,0DAA0D,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,wEAAwE;QACxE,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,yCAAyC;YACzC,yCAAyC;YACzC,8CAA8C;YAC9C,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,IAAI,GAAG;YACX,iCAAiC;YACjC,+CAA+C;YAC/C,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE3C,oBAAoB;QACpB,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAG3C,SAAS,YAAY,CAAC,EAAU,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,OAAO,CAAC,IAAI;QACjB,6EAA6E;QAC7E,EAAS,EACT,IAAI,EACJ,EAAE,EACF,EAAE,UAAU,EAAE,IAAI,EAAE,CACF,CAAC;IACvB,CAAC;IAED,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CACzB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GAAG,4GAA4G,CAAC;QAE7H,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,CACJ,YAAY,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  assetBaseUrlTransform,\n  assetBaseUrlTransformPlugin,\n  isCssRequest,\n} from \"./asset-base-url-transform-plugin.js\";\n\ndescribe(\"assetBaseUrlTransform\", () => {\n  it(\"should transform asset paths to use window.skybridge.serverUrl\", () => {\n    const cases = [\n      {\n        desc: \"single-quoted\",\n        code: `const image = '/assets/logo.png';`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"double-quoted\",\n        code: `const image = \"/assets/logo.png\";`,\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n      {\n        desc: \"backtick-quoted\",\n        code: \"const image = `/assets/logo.png`;\",\n        expected: `const image = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n      },\n    ];\n\n    for (const { code, expected } of cases) {\n      const result = assetBaseUrlTransform(code);\n      expect(result).toBe(expected);\n    }\n  });\n\n  it(\"should transform multiple asset paths\", () => {\n    const code = `\n      const logo = '/assets/logo.png';\n      const icon = '/assets/icon.svg';\n      const font = '/assets/font.woff2';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/icon.svg\"`,\n    );\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/font.woff2\"`,\n    );\n  });\n\n  it(\"should not transform already absolute URLs\", () => {\n    const code = `\n      const local = '/assets/logo.png';\n      const http = 'http://example.com/image.png';\n      const https = 'https://example.com/image.png';\n    `;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n    expect(result).toContain(\"http://example.com/image.png\");\n    expect(result).toContain(\"https://example.com/image.png\");\n  });\n\n  it(\"should not transform code without asset paths\", () => {\n    const code = `const text = \"Hello World\";`;\n    const result = assetBaseUrlTransform(code);\n\n    expect(result).toBe(code);\n  });\n\n  it(\"should not transform asset paths inside static `import ... from` clauses\", () => {\n    // Reproducer for #713: a dep does `import * as sprite from './icons.svg'`,\n    // Vite resolves the relative path to absolute, then this transform used\n    // to rewrite the resolved string — producing invalid JS like\n    // `import * as sprite from (expr) + \"...\"` that crashes vite:import-analysis.\n    const cases = [\n      `import * as sprite from \"/Users/me/proj/node_modules/pkg/icons.svg\";`,\n      `import sprite from '/assets/icons.svg';`,\n      `import sprite from \"/assets/icons.svg\";`,\n      `export { default } from \"/assets/icons.svg\";`,\n      `export * from '/assets/sprites.svg';`,\n    ];\n\n    for (const code of cases) {\n      expect(assetBaseUrlTransform(code)).toBe(code);\n    }\n  });\n\n  it(\"should still transform value-position asset paths in files that also have unrelated imports\", () => {\n    const code = [\n      `import { foo } from \"./foo.js\";`,\n      `import * as sprite from \"/assets/sprite.svg\";`,\n      `const logo = \"/assets/logo.png\";`,\n    ].join(\"\\n\");\n    const result = assetBaseUrlTransform(code);\n\n    // Imports untouched\n    expect(result).toContain(`from \"./foo.js\"`);\n    expect(result).toContain(`from \"/assets/sprite.svg\"`);\n    // Value-position rewritten\n    expect(result).toContain(\n      `const logo = (window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\";`,\n    );\n  });\n});\n\ndescribe(\"isCssRequest\", () => {\n  it(\"returns true for CSS-family extensions\", () => {\n    expect(isCssRequest(\"/src/styles.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.module.css\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.scss\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.sass\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.less\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.styl\")).toBe(true);\n  });\n\n  it(\"returns true for CSS modules with Vite query strings\", () => {\n    expect(isCssRequest(\"/src/styles.css?direct\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?inline\")).toBe(true);\n    expect(isCssRequest(\"/src/styles.css?used\")).toBe(true);\n    expect(isCssRequest(\"/src/Foo.vue?vue&type=style&lang.css\")).toBe(true);\n  });\n\n  it(\"returns false for non-CSS modules\", () => {\n    expect(isCssRequest(\"/src/index.tsx\")).toBe(false);\n    expect(isCssRequest(\"/src/utils.ts\")).toBe(false);\n    expect(isCssRequest(\"/src/Logo.svg\")).toBe(false);\n    expect(isCssRequest(\"/src/notes.cssx\")).toBe(false);\n  });\n});\n\ndescribe(\"assetBaseUrlTransformPlugin\", () => {\n  type TransformResult = { code: string; map: null } | null;\n\n  function runTransform(id: string, code: string): TransformResult {\n    const plugin = assetBaseUrlTransformPlugin();\n    const hook = plugin.transform;\n    if (!hook) {\n      throw new Error(\"plugin.transform is not defined\");\n    }\n    const handler = typeof hook === \"function\" ? hook : hook.handler;\n    return handler.call(\n      // biome-ignore lint/suspicious/noExplicitAny: vitest harness for plugin hook\n      {} as any,\n      code,\n      id,\n      { moduleType: \"js\" },\n    ) as TransformResult;\n  }\n\n  it(\"rewrites asset paths in JS modules\", () => {\n    const result = runTransform(\n      \"/src/widget.tsx\",\n      `const logo = \"/assets/logo.png\";`,\n    );\n    expect(result?.code).toContain(\n      `(window.skybridge?.serverUrl ?? \"\") + \"/assets/logo.png\"`,\n    );\n  });\n\n  // Reproducer for #697: CSS imports are served as JS modules with the\n  // stylesheet embedded as a string. Rewriting url(\"/foo.woff2\") inside that\n  // string would produce invalid CSS once the styles are injected.\n  it(\"does not rewrite asset paths when transforming a CSS module\", () => {\n    const cssCode = `__vite__updateStyle(\"style-id\", \"@font-face { src: url(\\\\\"/fonts/Brand.woff2\\\\\") format(\\\\\"woff2\\\\\"); }\");`;\n\n    expect(runTransform(\"/src/fonts.css\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?direct\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/fonts.css?inline\", cssCode)).toBeNull();\n    expect(runTransform(\"/src/styles.scss\", cssCode)).toBeNull();\n    expect(\n      runTransform(\"/src/Foo.vue?vue&type=style&lang.css\", cssCode),\n    ).toBeNull();\n  });\n});\n"]}

package/dist/server/auth.d.ts

@@ -0,0 +1,20 @@
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import type { RequestHandler } from "express";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+export type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;

package/dist/server/auth.js

@@ -0,0 +1,28 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export function optionalBearerAuth(options) {
+    const required = requireBearerAuth(options);
+    return (req, res, next) => {
+        if (!req.headers.authorization) {
+            next();
+            return;
+        }
+        return required(req, res, next);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n  type AuthMetadataOptions,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nexport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/index.d.ts

@@ -1,7 +1,8 @@
+export { type AuthInfo, type AuthMetadataOptions, type BearerAuthMiddlewareOptions, InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
 export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
 export { FileRef } from "./file-ref.js";
 export type { AnyToolRegistry, InferTools, ToolInput, ToolNames, ToolOutput, ToolResponseMetadata, } from "./inferUtilityTypes.js";
 export type { McpExtra, McpMethodString, McpMiddlewareFilter, McpMiddlewareFn, McpResultFor, McpTypedMiddlewareFn, McpWildcard, } from "./middleware.js";
-export type { HandlerContent, KnownToolMeta, McpServerTypes, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
+export type { HandlerContent, KnownToolMeta, McpServerTypes, SecurityScheme, ToolDef, ToolMeta, ViewConfig, ViewCsp, ViewHostType, ViewName, ViewNameRegistry, } from "./server.js";
 export { McpServer, normalizeContent, } from "./server.js";
 export { viewsDevServer } from "./viewsDevServer.js";

package/dist/server/index.js

@@ -1,3 +1,4 @@
+export { InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
 export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
 export { FileRef } from "./file-ref.js";
 export { McpServer, normalizeContent, } from "./server.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA8BxC,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  KnownToolMeta,\n  McpServerTypes,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA+BxC,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  type AuthInfo,\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  InvalidTokenError,\n  mcpAuthMetadataRouter,\n  optionalBearerAuth,\n  requireBearerAuth,\n} from \"./auth.js\";\nexport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport type {\n  HandlerContent,\n  KnownToolMeta,\n  McpServerTypes,\n  SecurityScheme,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}