skybridge 1.0.1 → 1.0.3

package/dist/server/server.js

@@ -17,6 +17,12 @@ const mergeWithUnion = (target, source) => {
         }
     });
 };
+/**
+ * Coerce a tool handler's return value into an MCP `content` array. Strings
+ * become a single `TextContent`; a single block is wrapped in an array;
+ * `undefined` produces `[]`. Mostly used internally — exported so consumers
+ * who build content lazily can apply the same normalization.
+ */
 export function normalizeContent(content) {
     if (content === undefined) {
         return [];
@@ -30,6 +36,35 @@ export function normalizeContent(content) {
     return [content];
 }
 const McpServerBaseOmitted = McpServerBase;
+/**
+ * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool
+ * registry, view resources, an embedded Express app, and protocol-level
+ * middleware. Construct it with the same `Implementation` info you would pass
+ * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,
+ * then call {@link McpServer.run} to start the HTTP server.
+ *
+ * The `TTools` generic accumulates each registered tool's input/output/meta
+ * shape, so `typeof server` carries enough information for view-side helpers
+ * like {@link generateHelpers} to produce fully-typed hooks.
+ *
+ * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`
+ * chaining; you almost never set this manually.
+ *
+ * @example
+ * ```ts
+ * const server = new McpServer({ name: "my-app", version: "1.0.0" }, {})
+ *   .registerTool({
+ *     name: "search",
+ *     inputSchema: { query: z.string() },
+ *     view: { component: "search" },
+ *   }, async ({ query }) => ({ content: `Results for ${query}` }));
+ *
+ * await server.run();
+ * export type AppType = typeof server;
+ * ```
+ *
+ * @see https://docs.skybridge.tech/api-reference/mcp-server
+ */
 export class McpServer extends McpServerBaseOmitted {
     /**
      * The underlying Express app. Use this to extend the HTTP server with
@@ -48,6 +83,7 @@ export class McpServer extends McpServerBaseOmitted {
     mcpMiddlewareEntries = [];
     mcpMiddlewareApplied = false;
     claimedViews = new Map();
+    viewMetaBuilders = new Map();
     viteManifest = null;
     serverInfo;
     serverOptions;
@@ -109,10 +145,32 @@ export class McpServer extends McpServerBaseOmitted {
             return;
         }
         this.mcpMiddlewareApplied = true;
+        // Surface view-resource _meta on `resources/list` (per ext-apps spec:
+        // hosts/checkers read CSP & domain at list time before fetching content).
+        const viewListMetaEntry = {
+            filter: "resources/list",
+            handler: async (_req, extra, next) => {
+                const result = (await next());
+                for (const resource of result.resources) {
+                    const builder = this.viewMetaBuilders.get(resource.uri);
+                    if (!builder) {
+                        continue;
+                    }
+                    const meta = builder(extra);
+                    resource._meta = {
+                        ...(resource._meta ?? {}),
+                        ...meta,
+                    };
+                }
+                return result;
+            },
+        };
         const monitoringEntry = createMiddlewareEntry();
-        const entries = monitoringEntry
-            ? [monitoringEntry, ...this.mcpMiddlewareEntries]
-            : this.mcpMiddlewareEntries;
+        const entries = [
+            ...(monitoringEntry ? [monitoringEntry] : []),
+            viewListMetaEntry,
+            ...this.mcpMiddlewareEntries,
+        ];
         if (entries.length === 0) {
             return;
         }
@@ -127,6 +185,14 @@ export class McpServer extends McpServerBaseOmitted {
         instrumentMap(requestHandlers, false);
         instrumentMap(notificationHandlers, true);
     }
+    /**
+     * Connect to an MCP transport (override of the SDK's `connect`). Use this
+     * when you're embedding Skybridge in a host that already manages its own
+     * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}
+     * which sets the transport up for you. Locks in any middleware registered
+     * via {@link McpServer.mcpMiddleware} — further calls to that method will
+     * throw afterwards.
+     */
     async connect(transport) {
         this.applyMcpMiddleware();
         return McpServerBase.prototype.connect.call(this, transport);
@@ -150,6 +216,16 @@ export class McpServer extends McpServerBaseOmitted {
         target._notificationHandlers = notificationHandlers;
         await fresh.connect(transport);
     }
+    /**
+     * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),
+     * mounts the `/mcp` route, applies any custom Express middleware registered
+     * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in
+     * any MCP middleware registered via {@link McpServer.mcpMiddleware}.
+     *
+     * On Cloudflare Workers / workerd, returns an object exposing `fetch` so
+     * the runtime can bridge incoming requests to the Node HTTP server. On
+     * Node, returns `undefined` once listening.
+     */
     async run() {
         this.applyMcpMiddleware();
         const httpServer = http.createServer();
@@ -199,6 +275,57 @@ export class McpServer extends McpServerBaseOmitted {
         }
         this.claimedViews.set(component, toolName);
     }
+    resolveViewRequestContext(extra) {
+        const isProduction = process.env.NODE_ENV === "production";
+        const headers = extra?.requestInfo?.headers || {};
+        const header = (key) => {
+            const val = headers[key];
+            return Array.isArray(val) ? val[0] : val;
+        };
+        const isClaude = header("user-agent") === "Claude-User";
+        let serverUrl;
+        const forwardedHost = header("x-forwarded-host");
+        const origin = header("origin");
+        const host = header("host");
+        if (forwardedHost) {
+            const proto = header("x-forwarded-proto") || "https";
+            serverUrl = `${proto}://${forwardedHost}`;
+        }
+        else if (origin) {
+            serverUrl = origin;
+        }
+        else if (host) {
+            const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
+                ? "http"
+                : "https";
+            serverUrl = `${proto}://${host}`;
+        }
+        else {
+            const devPort = process.env.__PORT || "3000";
+            serverUrl = `http://localhost:${devPort}`;
+        }
+        const connectDomains = [serverUrl];
+        if (!isProduction) {
+            const wsUrl = new URL(serverUrl);
+            wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
+            connectDomains.push(wsUrl.origin);
+        }
+        let contentMetaOverrides = {};
+        if (isClaude) {
+            const pathname = extra?.requestInfo?.url?.pathname ?? "";
+            const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
+            // Strip a lone trailing slash so the hash matches the connector URL
+            // as registered with Claude (which has no trailing slash on bare origins).
+            const url = rawUrl.endsWith("/") ? rawUrl.slice(0, -1) : rawUrl;
+            const hash = crypto
+                .createHash("sha256")
+                .update(url)
+                .digest("hex")
+                .slice(0, 32);
+            contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };
+        }
+        return { serverUrl, connectDomains, contentMetaOverrides };
+    }
     registerViewResources(toolName, view, toolMeta) {
         const hosts = view.hosts ?? ["apps-sdk", "mcp-app"];
         // Append a content-derived version param so hosts (e.g. ChatGPT) bust
@@ -308,35 +435,19 @@ export class McpServer extends McpServerBaseOmitted {
     }
     registerViewResource({ name, viewResource, view, }) {
         const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;
+        const buildMeta = (extra) => {
+            const { serverUrl, connectDomains, contentMetaOverrides } = this.resolveViewRequestContext(extra);
+            return buildContentMeta({
+                resourceDomains: [serverUrl],
+                connectDomains,
+                domain: serverUrl,
+                baseUriDomains: [serverUrl],
+            }, contentMetaOverrides);
+        };
+        this.viewMetaBuilders.set(viewUri, buildMeta);
         this.registerResource(name, viewUri, { description: view.description }, async (uri, extra) => {
             const isProduction = process.env.NODE_ENV === "production";
-            const isClaude = extra?.requestInfo?.headers?.["user-agent"] === "Claude-User";
-            const headers = extra?.requestInfo?.headers || {};
-            const header = (key) => {
-                const val = headers[key];
-                return Array.isArray(val) ? val[0] : val;
-            };
-            let serverUrl;
-            const forwardedHost = header("x-forwarded-host");
-            const origin = header("origin");
-            const host = header("host");
-            if (forwardedHost) {
-                const proto = header("x-forwarded-proto") || "https";
-                serverUrl = `${proto}://${forwardedHost}`;
-            }
-            else if (origin) {
-                serverUrl = origin;
-            }
-            else if (host) {
-                const proto = ["127.0.0.1:", "localhost:"].some((p) => host.startsWith(p))
-                    ? "http"
-                    : "https";
-                serverUrl = `${proto}://${host}`;
-            }
-            else {
-                const devPort = process.env.__PORT || "3000";
-                serverUrl = `http://localhost:${devPort}`;
-            }
+            const { serverUrl } = this.resolveViewRequestContext(extra);
             const html = isProduction
                 ? templateHelper.renderProduction({
                     hostType,
@@ -349,35 +460,9 @@ export class McpServer extends McpServerBaseOmitted {
                     serverUrl,
                     viewName: view.component,
                 });
-            const connectDomains = [serverUrl];
-            if (!isProduction) {
-                const wsUrl = new URL(serverUrl);
-                wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
-                connectDomains.push(wsUrl.origin);
-            }
-            let contentMetaOverrides = {};
-            if (isClaude) {
-                const pathname = extra?.requestInfo?.url?.pathname ?? "";
-                const rawUrl = header("x-alpic-forwarded-url") ?? `${serverUrl}${pathname}`;
-                // Strip a lone trailing slash so the hash matches the connector URL
-                // as registered with Claude (which has no trailing slash on bare origins).
-                const url = rawUrl.endsWith("/") ? rawUrl.slice(0, -1) : rawUrl;
-                const hash = crypto
-                    .createHash("sha256")
-                    .update(url)
-                    .digest("hex")
-                    .slice(0, 32);
-                contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };
-            }
-            const contentMeta = buildContentMeta({
-                resourceDomains: [serverUrl],
-                connectDomains,
-                domain: serverUrl,
-                baseUriDomains: [serverUrl],
-            }, contentMetaOverrides);
             return {
                 contents: [
-                    { uri: uri.href, mimeType, text: html, _meta: contentMeta },
+                    { uri: uri.href, mimeType, text: html, _meta: buildMeta(extra) },
                 ],
             };
         });
@@ -454,8 +539,16 @@ export class McpServer extends McpServerBaseOmitted {
         }
         const config = args[0];
         const cb = args[1];
-        const { name, view, _meta: userToolMeta, ...toolFields } = config;
+        const { name, view, securitySchemes, _meta: userToolMeta, ...toolFields } = config;
         const toolMeta = { ...userToolMeta };
+        if (securitySchemes) {
+            // SEP-1488 puts `securitySchemes` at the top level of the tool
+            // descriptor, but the SDK's `registerTool` drops unknown top-level
+            // fields, so the canonical spot isn't reachable without intercepting
+            // `tools/list`. Use the `_meta` back-compat mirror documented in the
+            // Apps SDK reference until SEP-1488 lands in the spec.
+            toolMeta.securitySchemes = securitySchemes;
+        }
         if (view) {
             this.enforceOneToolPerView(view.component, name);
             this.registerViewResources(name, view, toolMeta);

package/dist/server/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EACL,MAAM,IAAI,SAAS,GAEpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAgBrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,OAAO,EAAE,EAIf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAYpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,cAAc,GAAG,CACrB,MAAS,EACT,MAAS,EACF,EAAE;IACT,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAyPF,MAAM,UAAU,gBAAgB,CAC9B,OAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAOD,MAAM,oBAAoB,GAAG,aAEJ,CAAC;AAE1B,MAAM,OAAO,SAEX,SAAQ,oBAAoB;IAE5B;;;;;;;;;;;OAWG;IACM,OAAO,CAAU;IAClB,qBAAqB,GAA4B,EAAE,CAAC;IACpD,oBAAoB,GAAyB,EAAE,CAAC;IAChD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,YAAY,GAA6C,IAAI,CAAC;IACrD,UAAU,CAAiB;IAC3B,aAAa,CAAiB;IAE/C,YAAY,UAA0B,EAAE,OAAuB;QAC7D,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAID,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAID,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAgDD,aAAa,CACX,eAAsD;IACtD,uIAAuI;IACvI,YAAkB;QAElB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAA2C,CAAC;QAE5D,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,eAAe;gBACvB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAEjC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,eAAe;YAC7B,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAGd,CAAC;QACF,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC;QAC1C,MAAM,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAEpD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEvC,MAAM,SAAS,CAAC;YACd,SAAS,EAAE,IAAI;YACf,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;SAC5C,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,8BAA8B,YAAY,YAAY,QAAQ,gEAAgE,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,qBAAqB,CAC3B,QAAgB,EAChB,IAAgB,EAChB,QAA0B;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,CAAC,UAAU,EAAE,SAAS,CAAW,CAAC;QAE/D,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,YAAY,GAA2C;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,qBAAqB;gBAC/B,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAC3C,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAuB;wBACnC,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,eAAe;4BACjC,eAAe,EAAE,cAAc;yBAChC;wBACD,qBAAqB,EAAE,MAAM;wBAC7B,0BAA0B,EAAE,IAAI,CAAC,WAAW;qBAC7C,CAAC;oBAEF,MAAM,QAAQ,GAOV;wBACF,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;4BAC3C,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc;4BACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;4BACrC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;yBAC5C;wBACD,qBAAqB,EAAE,IAAI,CAAC,MAAM;wBAClC,4BAA4B,EAAE,IAAI,CAAC,aAAa;qBACjD,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,qBAAqB,EAAE,SAAS,CAAC,MAAM;qBACxC,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAwB,CAAC;oBAC1D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,QAAQ,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,YAAY,GAA4C;gBAC5D,QAAQ,EAAE,SAAS;gBACnB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,2BAA2B;gBACrC,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,EAC3D,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,eAAe;gCACf,cAAc;gCACd,cAAc;6BACf;4BACD,MAAM;yBACP;qBACF,CAAC;oBAEF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;4BAC1D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gCACtC,aAAa,EAAE,IAAI,CAAC,aAAa;6BAClC,CAAC;4BACF,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;4BAC3C,GAAG,EAAE;gCACH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI;oCAC5B,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;iCACpC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;6BACH;yBACF;qBACF,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAyB,CAAC;oBAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,iGAAiG;YACjG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;YAE9C,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,EAC3B,IAAI,EACJ,YAAY,EACZ,IAAI,GAKL;QACC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE5E,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,OAAO,EACP,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACjC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YAC3D,MAAM,QAAQ,GACZ,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC;YAEhE,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;gBAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC;YAEF,IAAI,SAAiB,CAAC;YAEtB,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAE5B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC;gBACrD,SAAS,GAAG,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;YAC5C,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CACnB;oBACC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC;gBACZ,SAAS,GAAG,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;gBAC7C,SAAS,GAAG,oBAAoB,OAAO,EAAE,CAAC;YAC5C,CAAC;YAED,MAAM,IAAI,GAAG,YAAY;gBACvB,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBAC9B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;iBAClD,CAAC;gBACJ,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC/B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,SAAS;iBACzB,CAAC,CAAC;YAEP,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9D,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,oBAAoB,GAAwB,EAAE,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;gBACzD,MAAM,MAAM,GACV,MAAM,CAAC,uBAAuB,CAAC,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;gBAC/D,oEAAoE;gBACpE,2EAA2E;gBAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAChE,MAAM,IAAI,GAAG,MAAM;qBAChB,UAAU,CAAC,QAAQ,CAAC;qBACpB,MAAM,CAAC,GAAG,CAAC;qBACX,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChB,oBAAoB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,uBAAuB,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,WAAW,GAAG,gBAAgB,CAClC;gBACE,eAAe,EAAE,CAAC,SAAS,CAAC;gBAC5B,cAAc;gBACd,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,CAAC,SAAS,CAAC;aAC5B,EACD,oBAAoB,CACrB,CAAC;YAEF,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC5D;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,EAA0B,EAC1B,EAAE,cAAc,EAA+B;QAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzC,GAAG,CAAC,cAAc,IAAI;oBACpB,KAAK,EAAE;wBACL,GAAI,MAA8C,CAAC,KAAK;wBACxD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;qBAC9B;iBACF,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAAgB;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACf,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,mGAAmG,QAAQ,uCAAuC,CACpK,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAA0C;QACxD,IAAI,CAAC,YAAY,GAAG,QAA6C,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EACpE,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAoBD,YAAY,CAAC,GAAG,IAAe;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,YAE3B,CAAC;QAEb,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAmC,CAAC;QAErD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QAElE,MAAM,QAAQ,GAAqB,EAAE,GAAG,YAAY,EAAE,CAAC;QAEvD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import crypto from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport http from \"node:http\";\nimport path from \"node:path\";\nimport type {\n  McpUiResourceMeta,\n  McpUiToolMeta,\n} from \"@modelcontextprotocol/ext-apps\";\nimport {\n  Server as SdkServer,\n  type ServerOptions,\n} from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { McpServer as McpServerBase } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  AnySchema,\n  SchemaOutput,\n  ZodRawShapeCompat,\n} from \"@modelcontextprotocol/sdk/server/zod-compat.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  ContentBlock,\n  Implementation,\n  RequestMeta,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n  ToolAnnotations,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { mergeWith, union } from \"es-toolkit\";\nimport express, {\n  type ErrorRequestHandler,\n  type Express,\n  type RequestHandler,\n} from \"express\";\nimport { createApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type {\n  McpExtra,\n  McpExtraFor,\n  McpMethodString,\n  McpMiddlewareEntry,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport { templateHelper } from \"./templateHelper.js\";\n\nconst mergeWithUnion = <T extends object, S extends object>(\n  target: T,\n  source: S,\n): T & S => {\n  return mergeWith(target, source, (targetVal, sourceVal) => {\n    if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {\n      return union(targetVal, sourceVal);\n    }\n  });\n};\n\nexport type ToolDef<\n  TInput = unknown,\n  TOutput = unknown,\n  TResponseMetadata = unknown,\n> = {\n  input: TInput;\n  output: TOutput;\n  responseMetadata: TResponseMetadata;\n};\n\nexport type ViewHostType = \"apps-sdk\" | \"mcp-app\";\n\nexport interface ViewCsp {\n  /** Origins for static assets (images, fonts, scripts, styles). */\n  resourceDomains?: string[];\n  /** Origins the view may contact via fetch/XHR. */\n  connectDomains?: string[];\n  /** Origins allowed for iframe embeds (opts into stricter app review). */\n  frameDomains?: string[];\n  /** Origins that can receive openExternal redirects without the safe-link modal. */\n  redirectDomains?: string[];\n  /** Origins allowed in `<base href>` tags (mcp-apps only). */\n  baseUriDomains?: string[];\n}\n\n// Must be exported: TS module augmentation only merges with exported\n// declarations. Without `export`, `.skybridge/views.d.ts` augmentation\n// would create a separate interface and `ViewName` would stay `string`.\n// biome-ignore lint/suspicious/noEmptyInterface: register pattern — augmented by `.skybridge/views.d.ts` to narrow ViewName\nexport interface ViewNameRegistry {}\n\nexport type ViewName = keyof ViewNameRegistry & string;\n\nexport interface ViewConfig {\n  component: ViewName;\n  description?: string;\n  hosts?: ViewHostType[];\n  prefersBorder?: boolean;\n  domain?: string;\n  csp?: ViewCsp;\n  _meta?: Record<string, unknown>;\n}\n\nexport interface KnownToolMeta {\n  \"openai/widgetAccessible\"?: boolean;\n  \"openai/toolInvocation/invoking\"?: string;\n  \"openai/toolInvocation/invoked\"?: string;\n  \"openai/fileParams\"?: string[];\n  ui?: Pick<McpUiToolMeta, \"visibility\">;\n}\n\nexport type ToolMeta = KnownToolMeta & Record<string, unknown>;\n\nexport type HandlerContent = string | ContentBlock | ContentBlock[];\n\n/** @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters */\ntype ViteManifestEntry = {\n  file: string;\n  name?: string;\n  src?: string;\n  isEntry?: boolean;\n  isDynamicEntry?: boolean;\n  css?: string[];\n  assets?: string[];\n  imports?: string[];\n  dynamicImports?: string[];\n};\n\ntype OpenaiToolMeta = {\n  \"openai/outputTemplate\": string;\n  \"openai/widgetAccessible\"?: boolean;\n  \"openai/toolInvocation/invoking\"?: string;\n  \"openai/toolInvocation/invoked\"?: string;\n  \"openai/fileParams\"?: string[];\n};\n\n/** @see https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx#resource-discovery */\ntype McpAppsToolMeta = {\n  ui: McpUiToolMeta;\n};\n\ntype InternalToolMeta = Partial<OpenaiToolMeta & McpAppsToolMeta>;\n\n/** @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields */\ntype OpenaiViewCSP = {\n  connect_domains: string[];\n  resource_domains: string[];\n  frame_domains?: string[];\n  redirect_domains?: string[];\n};\n\ntype OpenaiResourceMeta = {\n  \"openai/widgetDescription\"?: string;\n  \"openai/widgetPrefersBorder\"?: boolean;\n  \"openai/widgetCSP\"?: OpenaiViewCSP;\n  \"openai/widgetDomain\"?: string;\n};\n\n/**\n * MCP Apps CSP extended with upcoming / Skybridge-specific fields.\n * @see https://github.com/modelcontextprotocol/ext-apps/pull/158\n */\ntype ExtendedMcpUiResourceCsp = McpUiResourceMeta[\"csp\"] & {\n  /**\n   * Origins that can receive openExternal redirects without the safe-link modal.\n   * OpenAI-specific; mirrored into the mcp-apps CSP for cross-host parity.\n   * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields\n   */\n  redirectDomains?: string[];\n};\n\ntype ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, \"csp\"> & {\n  csp?: ExtendedMcpUiResourceCsp;\n};\n\ntype McpAppsResourceMeta = {\n  ui?: ExtendedMcpUiResourceMeta;\n};\n\ntype ResourceMeta = OpenaiResourceMeta | McpAppsResourceMeta;\n\ntype ViewResourceConfig<T extends ResourceMeta = ResourceMeta> = {\n  hostType: ViewHostType;\n  uri: string;\n  mimeType: string;\n  buildContentMeta: (\n    defaults: {\n      resourceDomains: string[];\n      connectDomains: string[];\n      domain: string;\n      baseUriDomains: string[];\n    },\n    overrides: { domain?: string },\n  ) => T;\n};\n\n/**\n * Type-level marker interface for cross-package type inference.\n *\n * Consumers infer tool types via the structural `$types` property rather than\n * the `McpServer` class generic, because class-generic inference breaks when\n * `McpServer` comes from different package installations (e.g. a consumer\n * with its own `skybridge` dep vs. the in-tree workspace version).\n *\n * Inspired by tRPC's `_def` pattern and Hono's type markers.\n */\nexport interface McpServerTypes<TTools extends Record<string, ToolDef>> {\n  readonly tools: TTools;\n}\n\ntype Simplify<T> = { [K in keyof T]: T[K] };\n\ntype ShapeOutput<Shape extends ZodRawShapeCompat> = Simplify<\n  {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? never\n      : K]: SchemaOutput<Shape[K]>;\n  } & {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? K\n      : never]?: SchemaOutput<Shape[K]>;\n  }\n>;\n\ntype ExtractStructuredContent<T> = T extends { structuredContent: infer SC }\n  ? Simplify<SC>\n  : never;\n\ntype ExtractMeta<T> = [Extract<T, { _meta: unknown }>] extends [never]\n  ? unknown\n  : Extract<T, { _meta: unknown }> extends { _meta: infer M }\n    ? Simplify<M>\n    : unknown;\n\ntype AddTool<\n  TTools,\n  TName extends string,\n  TInput extends ZodRawShapeCompat,\n  TOutput,\n  TResponseMetadata = unknown,\n> = McpServer<\n  TTools & {\n    [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;\n  }\n>;\n\ninterface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {\n  name: string;\n  title?: string;\n  description?: string;\n  inputSchema?: TInput;\n  outputSchema?: ZodRawShapeCompat | AnySchema;\n  annotations?: ToolAnnotations;\n  view?: ViewConfig;\n  _meta?: ToolMeta;\n}\n\n/**\n * Optional client-supplied hints attached to `params._meta` on every tool call\n * by the Apps SDK host. Hints only: never use for authorization, and tolerate\n * absence.\n * @see https://developers.openai.com/apps-sdk/reference#_meta-fields-the-client-provides\n */\nexport interface ClientHintsMeta {\n  /** Requested locale (BCP-47, e.g. `\"en-US\"`). */\n  \"openai/locale\"?: string;\n  /** Browser user-agent */\n  \"openai/userAgent\"?: string;\n  /** Coarse user location. May be partially populated. */\n  \"openai/userLocation\"?: {\n    city?: string;\n    region?: string;\n    country?: string;\n    timezone?: string;\n    longitude?: number;\n    latitude?: number;\n  };\n  /** Anonymized user id. */\n  \"openai/subject\"?: string;\n  /** Anonymized conversation id, stable within a ChatGPT session. */\n  \"openai/session\"?: string;\n  /** Anonymized organization id, when the user account is part of an organization. */\n  \"openai/organization\"?: string;\n  /** Stable id for the currently mounted widget instance. */\n  \"openai/widgetSessionId\"?: string;\n}\n\ntype ToolHandlerExtra = Omit<\n  RequestHandlerExtra<ServerRequest, ServerNotification>,\n  \"_meta\"\n> & {\n  _meta?: RequestMeta & ClientHintsMeta;\n};\n\ntype ToolHandler<\n  TInput extends ZodRawShapeCompat,\n  TReturn extends { content?: HandlerContent } = { content?: HandlerContent },\n> = (\n  args: ShapeOutput<TInput>,\n  extra: ToolHandlerExtra,\n) => TReturn | Promise<TReturn>;\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\nexport function normalizeContent(\n  content: HandlerContent | undefined,\n): ContentBlock[] {\n  if (content === undefined) {\n    return [];\n  }\n  if (typeof content === \"string\") {\n    return [{ type: \"text\", text: content }];\n  }\n  if (Array.isArray(content)) {\n    return content;\n  }\n  return [content];\n}\n\n// We Omit `registerTool` from the base class at the type level so our\n// unified 2-arg signature can replace the SDK's 3-arg one without an\n// incompatible override.  The runtime prototype chain is unaffected.\ninterface McpServerBaseOmitted\n  extends Omit<McpServerBase, \"registerTool\" | \"connect\"> {}\nconst McpServerBaseOmitted = McpServerBase as unknown as new (\n  ...args: ConstructorParameters<typeof McpServerBase>\n) => McpServerBaseOmitted;\n\nexport class McpServer<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n> extends McpServerBaseOmitted {\n  declare readonly $types: McpServerTypes<TTools>;\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `server.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied. Register your handlers before `run()`;\n   * after `run()`, dev-mode middleware, the `/mcp` route, and the default\n   * error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  readonly express: Express;\n  private customErrorMiddleware: ErrorMiddlewareConfig[] = [];\n  private mcpMiddlewareEntries: McpMiddlewareEntry[] = [];\n  private mcpMiddlewareApplied = false;\n  private claimedViews = new Map<string, string>();\n  private viteManifest: Record<string, ViteManifestEntry> | null = null;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions?: ServerOptions;\n\n  constructor(serverInfo: Implementation, options?: ServerOptions) {\n    super(serverInfo, options);\n    this.serverInfo = serverInfo;\n    this.serverOptions = options;\n    this.express = express();\n    this.express.use(express.json());\n  }\n\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.express.use(pathOrHandler, ...handlers);\n    } else {\n      this.express.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.customErrorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.customErrorMiddleware.push({\n        handlers: [pathOrHandler, ...handlers],\n      });\n    }\n    return this;\n  }\n\n  /** Register MCP protocol-level middleware (catch-all). */\n  mcpMiddleware(handler: McpMiddlewareFn): this;\n  /** Register MCP protocol-level middleware for all requests (`extra` is `McpExtra`). */\n  mcpMiddleware(\n    filter: \"request\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtra,\n      next: () => Promise<ServerResult>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /** Register MCP protocol-level middleware for all notifications (`extra` is `undefined`). */\n  mcpMiddleware(\n    filter: \"notification\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: undefined,\n      next: () => Promise<undefined>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for an exact method.\n   * Narrows `params`, `extra`, and `next()` result based on the method string.\n   */\n  mcpMiddleware<M extends McpMethodString>(\n    filter: M,\n    handler: McpTypedMiddlewareFn<M>,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for a wildcard pattern (e.g. `\"tools/*\"`).\n   * `next()` returns the union of result types for matching methods.\n   */\n  mcpMiddleware<W extends McpWildcard>(\n    filter: W,\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtraFor<W>,\n      next: () => Promise<McpResultFor<W>>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware with a method filter.\n   * Filter can be an exact method (`\"tools/call\"`), wildcard (`\"tools/*\"`),\n   * category (`\"request\"` | `\"notification\"`), or an array of those.\n   */\n  mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn): this;\n  mcpMiddleware(\n    filterOrHandler: McpMiddlewareFilter | McpMiddlewareFn,\n    // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants\n    maybeHandler?: any,\n  ): this {\n    if (this.mcpMiddlewareApplied) {\n      throw new Error(\n        \"Cannot register MCP middleware after run() or connect() has been called\",\n      );\n    }\n\n    const handler = maybeHandler as McpMiddlewareFn | undefined;\n\n    if (typeof filterOrHandler === \"function\") {\n      this.mcpMiddlewareEntries.push({\n        filter: null,\n        handler: filterOrHandler,\n      });\n    } else if (handler) {\n      this.mcpMiddlewareEntries.push({\n        filter: filterOrHandler,\n        handler,\n      });\n    } else {\n      throw new Error(\n        \"mcpMiddleware requires a handler function when a filter is provided\",\n      );\n    }\n\n    return this;\n  }\n\n  private applyMcpMiddleware(): void {\n    if (this.mcpMiddlewareApplied) {\n      return;\n    }\n    this.mcpMiddlewareApplied = true;\n\n    const monitoringEntry = createMiddlewareEntry();\n    const entries = monitoringEntry\n      ? [monitoringEntry, ...this.mcpMiddlewareEntries]\n      : this.mcpMiddlewareEntries;\n\n    if (entries.length === 0) {\n      return;\n    }\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n\n  async connect(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n    return McpServerBase.prototype.connect.call(this, transport);\n  }\n\n  /**\n   * Per-request stateless connect. The SDK's `Protocol` only allows one\n   * transport per instance, so we can't reuse this `McpServer` across\n   * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`\n   * factory, but that would break Skybridge's singleton API — so instead\n   * we build a fresh underlying `Server` per request and share the main\n   * server's handler maps by reference. The cast is unavoidable: there's\n   * no public API to inject handler maps. `getHandlerMaps` validates the\n   * read side and fails fast on SDK field renames.\n   */\n  async connectStatelessTransport(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n    const fresh = new SdkServer(this.serverInfo, this.serverOptions);\n    const target = fresh as unknown as {\n      _requestHandlers: unknown;\n      _notificationHandlers: unknown;\n    };\n    target._requestHandlers = requestHandlers;\n    target._notificationHandlers = notificationHandlers;\n\n    await fresh.connect(transport);\n  }\n\n  async run(): Promise<{ fetch: (...args: unknown[]) => unknown } | undefined> {\n    this.applyMcpMiddleware();\n    const httpServer = http.createServer();\n\n    await createApp({\n      mcpServer: this,\n      httpServer,\n      errorMiddleware: this.customErrorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.express);\n    const port = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(port, () => {\n        resolve();\n      });\n    });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private enforceOneToolPerView(component: string, toolName: string): void {\n    const existingTool = this.claimedViews.get(component);\n    if (existingTool) {\n      throw new Error(\n        `skybridge: view \"${component}\" is already used by tool \"${existingTool}\". Tool \"${toolName}\" cannot also reference it — each view backs exactly one tool.`,\n      );\n    }\n    this.claimedViews.set(component, toolName);\n  }\n\n  private registerViewResources(\n    toolName: string,\n    view: ViewConfig,\n    toolMeta: InternalToolMeta,\n  ): void {\n    const hosts = view.hosts ?? ([\"apps-sdk\", \"mcp-app\"] as const);\n\n    // Append a content-derived version param so hosts (e.g. ChatGPT) bust\n    // their cache when the bundle changes, but keep the URI stable across\n    // `tools/list` calls when the bundle hasn't changed.\n    const versionParam = this.computeViewVersionParam(view.component);\n\n    if (hosts.includes(\"apps-sdk\")) {\n      const viewResource: ViewResourceConfig<OpenaiResourceMeta> = {\n        hostType: \"apps-sdk\",\n        uri: `ui://views/apps-sdk/${view.component}.html${versionParam}`,\n        mimeType: \"text/html+skybridge\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain },\n          overrides,\n        ) => {\n          const defaults: OpenaiResourceMeta = {\n            \"openai/widgetCSP\": {\n              resource_domains: resourceDomains,\n              connect_domains: connectDomains,\n            },\n            \"openai/widgetDomain\": domain,\n            \"openai/widgetDescription\": view.description,\n          };\n\n          const fromView: Partial<\n            Omit<\n              OpenaiResourceMeta,\n              \"openai/widgetCSP\" | \"openai/widgetDescription\"\n            > & {\n              \"openai/widgetCSP\": Partial<OpenaiViewCSP>;\n            }\n          > = {\n            \"openai/widgetCSP\": {\n              resource_domains: view.csp?.resourceDomains,\n              connect_domains: view.csp?.connectDomains,\n              frame_domains: view.csp?.frameDomains,\n              redirect_domains: view.csp?.redirectDomains,\n            },\n            \"openai/widgetDomain\": view.domain,\n            \"openai/widgetPrefersBorder\": view.prefersBorder,\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            \"openai/widgetDomain\": overrides.domain,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as OpenaiResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      toolMeta[\"openai/outputTemplate\"] = viewResource.uri;\n    }\n\n    if (hosts.includes(\"mcp-app\")) {\n      const viewResource: ViewResourceConfig<McpAppsResourceMeta> = {\n        hostType: \"mcp-app\",\n        uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,\n        mimeType: \"text/html;profile=mcp-app\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain, baseUriDomains },\n          overrides,\n        ) => {\n          const defaults: McpAppsResourceMeta = {\n            ui: {\n              csp: {\n                resourceDomains,\n                connectDomains,\n                baseUriDomains,\n              },\n              domain,\n            },\n          };\n\n          const fromView: McpAppsResourceMeta = {\n            ui: {\n              ...(view.description && { description: view.description }),\n              ...(view.prefersBorder !== undefined && {\n                prefersBorder: view.prefersBorder,\n              }),\n              ...(view.domain && { domain: view.domain }),\n              csp: {\n                ...(view.csp?.resourceDomains && {\n                  resourceDomains: view.csp.resourceDomains,\n                }),\n                ...(view.csp?.connectDomains && {\n                  connectDomains: view.csp.connectDomains,\n                }),\n                ...(view.csp?.frameDomains && {\n                  frameDomains: view.csp.frameDomains,\n                }),\n                ...(view.csp?.baseUriDomains && {\n                  baseUriDomains: view.csp.baseUriDomains,\n                }),\n                ...(view.csp?.redirectDomains && {\n                  redirectDomains: view.csp.redirectDomains,\n                }),\n              },\n            },\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            ui: overrides,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as McpAppsResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      // @ts-expect-error - For backwards compatibility with Claude current implementation of the specs\n      toolMeta[\"ui/resourceUri\"] = viewResource.uri;\n\n      toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };\n    }\n  }\n\n  private registerViewResource({\n    name,\n    viewResource,\n    view,\n  }: {\n    name: string;\n    viewResource: ViewResourceConfig;\n    view: ViewConfig;\n  }): void {\n    const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;\n\n    this.registerResource(\n      name,\n      viewUri,\n      { description: view.description },\n      async (uri, extra) => {\n        const isProduction = process.env.NODE_ENV === \"production\";\n        const isClaude =\n          extra?.requestInfo?.headers?.[\"user-agent\"] === \"Claude-User\";\n\n        const headers = extra?.requestInfo?.headers || {};\n        const header = (key: string) => {\n          const val = headers[key];\n          return Array.isArray(val) ? val[0] : val;\n        };\n\n        let serverUrl: string;\n\n        const forwardedHost = header(\"x-forwarded-host\");\n        const origin = header(\"origin\");\n        const host = header(\"host\");\n\n        if (forwardedHost) {\n          const proto = header(\"x-forwarded-proto\") || \"https\";\n          serverUrl = `${proto}://${forwardedHost}`;\n        } else if (origin) {\n          serverUrl = origin;\n        } else if (host) {\n          const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) =>\n            host.startsWith(p),\n          )\n            ? \"http\"\n            : \"https\";\n          serverUrl = `${proto}://${host}`;\n        } else {\n          const devPort = process.env.__PORT || \"3000\";\n          serverUrl = `http://localhost:${devPort}`;\n        }\n\n        const html = isProduction\n          ? templateHelper.renderProduction({\n              hostType,\n              serverUrl,\n              viewFile: this.lookupViewFile(view.component),\n              styleFile: this.lookupDistFile(\"style.css\") ?? \"\",\n            })\n          : templateHelper.renderDevelopment({\n              hostType,\n              serverUrl,\n              viewName: view.component,\n            });\n\n        const connectDomains = [serverUrl];\n        if (!isProduction) {\n          const wsUrl = new URL(serverUrl);\n          wsUrl.protocol = wsUrl.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n          connectDomains.push(wsUrl.origin);\n        }\n\n        let contentMetaOverrides: { domain?: string } = {};\n        if (isClaude) {\n          const pathname = extra?.requestInfo?.url?.pathname ?? \"\";\n          const rawUrl =\n            header(\"x-alpic-forwarded-url\") ?? `${serverUrl}${pathname}`;\n          // Strip a lone trailing slash so the hash matches the connector URL\n          // as registered with Claude (which has no trailing slash on bare origins).\n          const url = rawUrl.endsWith(\"/\") ? rawUrl.slice(0, -1) : rawUrl;\n          const hash = crypto\n            .createHash(\"sha256\")\n            .update(url)\n            .digest(\"hex\")\n            .slice(0, 32);\n          contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };\n        }\n\n        const contentMeta = buildContentMeta(\n          {\n            resourceDomains: [serverUrl],\n            connectDomains,\n            domain: serverUrl,\n            baseUriDomains: [serverUrl],\n          },\n          contentMetaOverrides,\n        );\n\n        return {\n          contents: [\n            { uri: uri.href, mimeType, text: html, _meta: contentMeta },\n          ],\n        };\n      },\n    );\n  }\n\n  private wrapHandler<InputArgs extends ZodRawShapeCompat>(\n    cb: ToolHandler<InputArgs>,\n    { attachViewUUID }: { attachViewUUID: boolean },\n  ): ToolHandler<InputArgs> {\n    return async (args, extra) => {\n      const result = await cb(args, extra);\n      return {\n        ...result,\n        content: normalizeContent(result.content),\n        ...(attachViewUUID && {\n          _meta: {\n            ...(result as { _meta?: Record<string, unknown> })._meta,\n            viewUUID: crypto.randomUUID(),\n          },\n        }),\n      };\n    };\n  }\n\n  private computeViewVersionParam(viewName: string): string {\n    if (process.env.NODE_ENV !== \"production\") {\n      return \"\";\n    }\n    try {\n      const viewFile = this.lookupViewFile(viewName);\n      const styleFile = this.lookupDistFile(\"style.css\") ?? \"\";\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(viewFile)\n        .update(\"\\0\")\n        .update(styleFile)\n        .digest(\"hex\")\n        .slice(0, 8);\n      return `?v=${hash}`;\n    } catch {\n      return \"\";\n    }\n  }\n\n  private lookupViewFile(viewName: string) {\n    const manifest = this.readManifest();\n    for (const entry of Object.values(manifest)) {\n      if (entry?.isEntry && entry.name === viewName && entry.file) {\n        return entry.file;\n      }\n    }\n    throw new Error(\n      `View \"${viewName}\" not found in Vite manifest. Did the build complete successfully? Look for an entry with name \"${viewName}\" in dist/assets/.vite/manifest.json.`,\n    );\n  }\n\n  private lookupDistFile(key: string) {\n    const manifest = this.readManifest();\n    return manifest[key]?.file;\n  }\n\n  /**\n   * Inject the Vite manifest as a value rather than letting `readManifest()`\n   * load it from disk. Required for runtimes without a usable filesystem\n   * (Cloudflare Workers, etc.) — the user's `skybridge build` emits the\n   * manifest as a JS module which the entry imports and passes here.\n   */\n  setViteManifest(manifest: Record<string, { file: string }>): this {\n    this.viteManifest = manifest as Record<string, ViteManifestEntry>;\n    return this;\n  }\n\n  private readManifest(): Record<string, ViteManifestEntry> {\n    if (this.viteManifest) {\n      return this.viteManifest;\n    }\n    return JSON.parse(\n      readFileSync(\n        path.join(process.cwd(), \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        \"utf-8\",\n      ),\n    );\n  }\n\n  registerTool<\n    TName extends string,\n    InputArgs extends ZodRawShapeCompat,\n    TReturn extends { content?: HandlerContent },\n  >(\n    config: ToolConfig<InputArgs> & { name: TName },\n    cb: ToolHandler<InputArgs, TReturn>,\n  ): AddTool<\n    TTools,\n    TName,\n    InputArgs,\n    ExtractStructuredContent<TReturn>,\n    ExtractMeta<TReturn>\n  >;\n  registerTool<InputArgs extends ZodRawShapeCompat>(\n    config: ToolConfig<InputArgs>,\n    cb: ToolHandler<InputArgs>,\n  ): this;\n  registerTool(...args: unknown[]): unknown {\n    const baseFn = McpServerBase.prototype.registerTool as (\n      ...args: unknown[]\n    ) => unknown;\n\n    if (typeof args[0] === \"string\") {\n      baseFn.call(this, args[0], args[1], args[2]);\n      return this;\n    }\n\n    const config = args[0] as ToolConfig<ZodRawShapeCompat>;\n    const cb = args[1] as ToolHandler<ZodRawShapeCompat>;\n\n    const { name, view, _meta: userToolMeta, ...toolFields } = config;\n\n    const toolMeta: InternalToolMeta = { ...userToolMeta };\n\n    if (view) {\n      this.enforceOneToolPerView(view.component, name);\n      this.registerViewResources(name, view, toolMeta);\n    }\n\n    const wrappedCb = this.wrapHandler(cb, { attachViewUUID: Boolean(view) });\n\n    baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);\n\n    return this;\n  }\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EACL,MAAM,IAAI,SAAS,GAEpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAgBrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,OAAO,EAAE,EAIf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAYpD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,cAAc,GAAG,CACrB,MAAS,EACT,MAAS,EACF,EAAE;IACT,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AA2TF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAOD,MAAM,oBAAoB,GAAG,aAEJ,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,SAEX,SAAQ,oBAAoB;IAE5B;;;;;;;;;;;OAWG;IACM,OAAO,CAAU;IAClB,qBAAqB,GAA4B,EAAE,CAAC;IACpD,oBAAoB,GAAyB,EAAE,CAAC;IAChD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,gBAAgB,GAAG,IAAI,GAAG,EAG/B,CAAC;IACI,YAAY,GAA6C,IAAI,CAAC;IACrD,UAAU,CAAiB;IAC3B,aAAa,CAAiB;IAE/C,YAAY,UAA0B,EAAE,OAAuB;QAC7D,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAYD,GAAG,CACD,aAAsC,EACtC,GAAG,QAA0B;QAE7B,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,UAAU,CACR,aAA2C,EAC3C,GAAG,QAA+B;QAElC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,QAAQ,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAgDD,aAAa,CACX,eAAsD;IACtD,uIAAuI;IACvI,YAAkB;QAElB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAA2C,CAAC;QAE5D,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,eAAe;gBACvB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAEjC,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,iBAAiB,GAAuB;YAC5C,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAE3B,CAAC;gBACF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACxD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,QAAQ,CAAC,KAAK,GAAG;wBACf,GAAG,CAAE,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAC;wBACtD,GAAG,IAAI;qBACR,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC;QAEF,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,iBAAiB;YACjB,GAAG,IAAI,CAAC,oBAAoB;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CACpB,GAA0D,EAC1D,cAAuB,EACvB,EAAE;YACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,CACL,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,CACR,MAAc,EACd,OAAiD,EACjD,EAAE,CACF,WAAW,CACT,MAAM,EACN,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAC/D,CAAC;QACN,CAAC,CAAC;QAEF,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAgE;QAEhE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAC9D,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAGd,CAAC;QACF,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC;QAC1C,MAAM,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAEpD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEvC,MAAM,SAAS,CAAC;YACd,SAAS,EAAE,IAAI;YACf,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,qBAAqB;SAC5C,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,0EAA0E;QAC1E,0DAA0D;QAC1D,IACE,OAAO,SAAS,KAAK,WAAW;YAChC,SAAS,CAAC,SAAS,KAAK,oBAAoB,EAC5C,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,iDAAiD;YACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,8BAA8B,YAAY,YAAY,QAAQ,gEAAgE,CAC5J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,yBAAyB,CAAC,KAA2B;QAK3D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC;QAExD,IAAI,SAAiB,CAAC;QACtB,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC;YACrD,SAAS,GAAG,GAAG,KAAK,MAAM,aAAa,EAAE,CAAC;QAC5C,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC;YACZ,SAAS,GAAG,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;YAC7C,SAAS,GAAG,oBAAoB,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,oBAAoB,GAAwB,EAAE,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YACzD,MAAM,MAAM,GACV,MAAM,CAAC,uBAAuB,CAAC,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC/D,oEAAoE;YACpE,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,oBAAoB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,uBAAuB,EAAE,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IAC7D,CAAC;IAEO,qBAAqB,CAC3B,QAAgB,EAChB,IAAgB,EAChB,QAA0B;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,CAAC,UAAU,EAAE,SAAS,CAAW,CAAC;QAE/D,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,YAAY,GAA2C;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,qBAAqB;gBAC/B,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAC3C,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAuB;wBACnC,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,eAAe;4BACjC,eAAe,EAAE,cAAc;yBAChC;wBACD,qBAAqB,EAAE,MAAM;wBAC7B,0BAA0B,EAAE,IAAI,CAAC,WAAW;qBAC7C,CAAC;oBAEF,MAAM,QAAQ,GAOV;wBACF,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;4BAC3C,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc;4BACzC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;4BACrC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe;yBAC5C;wBACD,qBAAqB,EAAE,IAAI,CAAC,MAAM;wBAClC,4BAA4B,EAAE,IAAI,CAAC,aAAa;qBACjD,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,qBAAqB,EAAE,SAAS,CAAC,MAAM;qBACxC,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAwB,CAAC;oBAC1D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,QAAQ,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,YAAY,GAA4C;gBAC5D,QAAQ,EAAE,SAAS;gBACnB,GAAG,EAAE,uBAAuB,IAAI,CAAC,SAAS,QAAQ,YAAY,EAAE;gBAChE,QAAQ,EAAE,2BAA2B;gBACrC,gBAAgB,EAAE,CAChB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,EAC3D,SAAS,EACT,EAAE;oBACF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,eAAe;gCACf,cAAc;gCACd,cAAc;6BACf;4BACD,MAAM;yBACP;qBACF,CAAC;oBAEF,MAAM,QAAQ,GAAwB;wBACpC,EAAE,EAAE;4BACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;4BAC1D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gCACtC,aAAa,EAAE,IAAI,CAAC,aAAa;6BAClC,CAAC;4BACF,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;4BAC3C,GAAG,EAAE;gCACH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI;oCAC5B,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;iCACpC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI;oCAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc;iCACxC,CAAC;gCACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI;oCAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;iCAC1C,CAAC;6BACH;yBACF;qBACF,CAAC;oBAEF,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBAC9D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;oBAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAyB,CAAC;oBAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,iGAAiG;YACjG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;YAE9C,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,EAC3B,IAAI,EACJ,YAAY,EACZ,IAAI,GAKL;QACC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE5E,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAgB,EAAE;YAC9D,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,GACvD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,gBAAgB,CACrB;gBACE,eAAe,EAAE,CAAC,SAAS,CAAC;gBAC5B,cAAc;gBACd,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,CAAC,SAAS,CAAC;aAC5B,EACD,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9C,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,OAAO,EACP,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACjC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,YAAY;gBACvB,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBAC9B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;iBAClD,CAAC;gBACJ,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC/B,QAAQ;oBACR,SAAS;oBACT,QAAQ,EAAE,IAAI,CAAC,SAAS;iBACzB,CAAC,CAAC;YAEP,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;iBACjE;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,EAA0B,EAC1B,EAAE,cAAc,EAA+B;QAE/C,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzC,GAAG,CAAC,cAAc,IAAI;oBACpB,KAAK,EAAE;wBACL,GAAI,MAA8C,CAAC,KAAK;wBACxD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;qBAC9B;iBACF,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAAgB;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM;iBAChB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACf,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,mGAAmG,QAAQ,uCAAuC,CACpK,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAA0C;QACxD,IAAI,CAAC,YAAY,GAAG,QAA6C,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EACpE,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAiDD,YAAY,CAAC,GAAG,IAAe;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,YAE3B,CAAC;QAEb,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAmC,CAAC;QAErD,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,eAAe,EACf,KAAK,EAAE,YAAY,EACnB,GAAG,UAAU,EACd,GAAG,MAAM,CAAC;QAEX,MAAM,QAAQ,GAAqB,EAAE,GAAG,YAAY,EAAE,CAAC;QAEvD,IAAI,eAAe,EAAE,CAAC;YACpB,+DAA+D;YAC/D,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,uDAAuD;YACvD,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import crypto from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport http from \"node:http\";\nimport path from \"node:path\";\nimport type {\n  McpUiResourceMeta,\n  McpUiToolMeta,\n} from \"@modelcontextprotocol/ext-apps\";\nimport {\n  Server as SdkServer,\n  type ServerOptions,\n} from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { McpServer as McpServerBase } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  AnySchema,\n  SchemaOutput,\n  ZodRawShapeCompat,\n} from \"@modelcontextprotocol/sdk/server/zod-compat.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  ContentBlock,\n  Implementation,\n  RequestMeta,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n  ToolAnnotations,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { mergeWith, union } from \"es-toolkit\";\nimport express, {\n  type ErrorRequestHandler,\n  type Express,\n  type RequestHandler,\n} from \"express\";\nimport { createApp } from \"./express.js\";\nimport { createMiddlewareEntry } from \"./metric.js\";\nimport type {\n  McpExtra,\n  McpExtraFor,\n  McpMethodString,\n  McpMiddlewareEntry,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nimport { buildMiddlewareChain, getHandlerMaps } from \"./middleware.js\";\nimport { templateHelper } from \"./templateHelper.js\";\n\nconst mergeWithUnion = <T extends object, S extends object>(\n  target: T,\n  source: S,\n): T & S => {\n  return mergeWith(target, source, (targetVal, sourceVal) => {\n    if (Array.isArray(targetVal) && Array.isArray(sourceVal)) {\n      return union(targetVal, sourceVal);\n    }\n  });\n};\n\n/**\n * Type marker for a registered tool — carries its input, output, and response\n * metadata shapes so views can infer types from `typeof server`.\n *\n * You normally never construct this by hand; it is produced by `registerTool`\n * and consumed by helpers like {@link InferTools} and {@link generateHelpers}.\n */\nexport type ToolDef<\n  TInput = unknown,\n  TOutput = unknown,\n  TResponseMetadata = unknown,\n> = {\n  input: TInput;\n  output: TOutput;\n  responseMetadata: TResponseMetadata;\n};\n\n/** Which host runtime a view targets — `\"apps-sdk\"` (ChatGPT) or `\"mcp-app\"` (MCP Apps spec). */\nexport type ViewHostType = \"apps-sdk\" | \"mcp-app\";\n\n/**\n * Content Security Policy origins attached to a view's resource. Each list is\n * passed through to the host's CSP for the view iframe; omit a field to inherit\n * the host's default for that directive.\n */\nexport interface ViewCsp {\n  /** Origins for static assets (images, fonts, scripts, styles). */\n  resourceDomains?: string[];\n  /** Origins the view may contact via fetch/XHR. */\n  connectDomains?: string[];\n  /** Origins allowed for iframe embeds (opts into stricter app review). */\n  frameDomains?: string[];\n  /** Origins that can receive openExternal redirects without the safe-link modal. */\n  redirectDomains?: string[];\n  /** Origins allowed in `<base href>` tags (mcp-apps only). */\n  baseUriDomains?: string[];\n}\n\n/**\n * Registry of view component names. The Skybridge Vite plugin augments this\n * interface in the generated `.skybridge/views.d.ts` with one key per view\n * file, which narrows {@link ViewName} from `string` to the concrete union.\n */\n// Must be exported: TS module augmentation only merges with exported\n// declarations. Without `export`, `.skybridge/views.d.ts` augmentation\n// would create a separate interface and `ViewName` would stay `string`.\n// biome-ignore lint/suspicious/noEmptyInterface: register pattern — augmented by `.skybridge/views.d.ts` to narrow ViewName\nexport interface ViewNameRegistry {}\n\n/** Union of valid view component names. Narrowed by {@link ViewNameRegistry}. */\nexport type ViewName = keyof ViewNameRegistry & string;\n\n/**\n * Pass under `view` in a tool's `registerTool` config to render the tool's\n * result through a Skybridge view instead of a plain text response.\n */\nexport interface ViewConfig {\n  /** Filename of the view module (without extension) — matches a file in your `viewsDir`. */\n  component: ViewName;\n  /** Human-readable label the host may show alongside the view. */\n  description?: string;\n  /** Restrict where the view is rendered. Defaults to all known hosts. */\n  hosts?: ViewHostType[];\n  /** Apps SDK only: request a visible border around the widget. */\n  prefersBorder?: boolean;\n  /** Apps SDK only: override the iframe's served domain (advanced). */\n  domain?: string;\n  /** Per-view CSP overrides — see {@link ViewCsp}. */\n  csp?: ViewCsp;\n  /** Free-form metadata forwarded on the view resource's `_meta`. */\n  _meta?: Record<string, unknown>;\n}\n\nexport type SecurityScheme =\n  | { type: \"noauth\" }\n  | { type: \"oauth2\"; scopes?: string[] };\n\n/**\n * Well-known keys recognized by host runtimes when set on a tool's `_meta`.\n * Use {@link ToolMeta} to also pass arbitrary custom metadata alongside these.\n *\n * @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters\n */\nexport interface KnownToolMeta {\n  /** Apps SDK: allow the rendered view to call this tool from inside its iframe. */\n  \"openai/widgetAccessible\"?: boolean;\n  /** Apps SDK: status text shown while the tool is running (e.g. `\"Searching trips\"`). */\n  \"openai/toolInvocation/invoking\"?: string;\n  /** Apps SDK: status text shown once the tool returns (e.g. `\"Found 3 trips\"`). */\n  \"openai/toolInvocation/invoked\"?: string;\n  /** Apps SDK: input parameters that hold file references — the host attaches uploaded files to them. */\n  \"openai/fileParams\"?: string[];\n  /** MCP Apps: control whether the tool is exposed to the model, the app, or both. */\n  ui?: Pick<McpUiToolMeta, \"visibility\">;\n  securitySchemes?: SecurityScheme[];\n}\n\n/** {@link KnownToolMeta} merged with arbitrary string-keyed metadata for custom flags. */\nexport type ToolMeta = KnownToolMeta & Record<string, unknown>;\n\n/**\n * Convenient return type for tool handlers — a plain string, a single\n * {@link ContentBlock}, or an array. Skybridge normalizes it to the MCP\n * `content: ContentBlock[]` shape before responding.\n */\nexport type HandlerContent = string | ContentBlock | ContentBlock[];\n\n/** @see https://developers.openai.com/apps-sdk/reference#tool-descriptor-parameters */\ntype ViteManifestEntry = {\n  file: string;\n  name?: string;\n  src?: string;\n  isEntry?: boolean;\n  isDynamicEntry?: boolean;\n  css?: string[];\n  assets?: string[];\n  imports?: string[];\n  dynamicImports?: string[];\n};\n\ntype OpenaiToolMeta = {\n  \"openai/outputTemplate\": string;\n  \"openai/widgetAccessible\"?: boolean;\n  \"openai/toolInvocation/invoking\"?: string;\n  \"openai/toolInvocation/invoked\"?: string;\n  \"openai/fileParams\"?: string[];\n};\n\n/** @see https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx#resource-discovery */\ntype McpAppsToolMeta = {\n  ui: McpUiToolMeta;\n};\n\ntype SecuritySchemesToolMeta = {\n  securitySchemes: SecurityScheme[];\n};\n\ntype InternalToolMeta = Partial<\n  OpenaiToolMeta & McpAppsToolMeta & SecuritySchemesToolMeta\n>;\n\n/** @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields */\ntype OpenaiViewCSP = {\n  connect_domains: string[];\n  resource_domains: string[];\n  frame_domains?: string[];\n  redirect_domains?: string[];\n};\n\ntype OpenaiResourceMeta = {\n  \"openai/widgetDescription\"?: string;\n  \"openai/widgetPrefersBorder\"?: boolean;\n  \"openai/widgetCSP\"?: OpenaiViewCSP;\n  \"openai/widgetDomain\"?: string;\n};\n\n/**\n * MCP Apps CSP extended with upcoming / Skybridge-specific fields.\n * @see https://github.com/modelcontextprotocol/ext-apps/pull/158\n */\ntype ExtendedMcpUiResourceCsp = McpUiResourceMeta[\"csp\"] & {\n  /**\n   * Origins that can receive openExternal redirects without the safe-link modal.\n   * OpenAI-specific; mirrored into the mcp-apps CSP for cross-host parity.\n   * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields\n   */\n  redirectDomains?: string[];\n};\n\ntype ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, \"csp\"> & {\n  csp?: ExtendedMcpUiResourceCsp;\n};\n\ntype McpAppsResourceMeta = {\n  ui?: ExtendedMcpUiResourceMeta;\n};\n\ntype ResourceMeta = OpenaiResourceMeta | McpAppsResourceMeta;\n\ntype ViewResourceConfig<T extends ResourceMeta = ResourceMeta> = {\n  hostType: ViewHostType;\n  uri: string;\n  mimeType: string;\n  buildContentMeta: (\n    defaults: {\n      resourceDomains: string[];\n      connectDomains: string[];\n      domain: string;\n      baseUriDomains: string[];\n    },\n    overrides: { domain?: string },\n  ) => T;\n};\n\n/**\n * Type-level marker interface for cross-package type inference.\n *\n * Consumers infer tool types via the structural `$types` property rather than\n * the `McpServer` class generic, because class-generic inference breaks when\n * `McpServer` comes from different package installations (e.g. a consumer\n * with its own `skybridge` dep vs. the in-tree workspace version).\n *\n * Inspired by tRPC's `_def` pattern and Hono's type markers.\n */\nexport interface McpServerTypes<TTools extends Record<string, ToolDef>> {\n  readonly tools: TTools;\n}\n\ntype Simplify<T> = { [K in keyof T]: T[K] };\n\ntype ShapeOutput<Shape extends ZodRawShapeCompat> = Simplify<\n  {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? never\n      : K]: SchemaOutput<Shape[K]>;\n  } & {\n    [K in keyof Shape as undefined extends SchemaOutput<Shape[K]>\n      ? K\n      : never]?: SchemaOutput<Shape[K]>;\n  }\n>;\n\ntype ExtractStructuredContent<T> = T extends { structuredContent: infer SC }\n  ? Simplify<SC>\n  : never;\n\ntype ExtractMeta<T> = [Extract<T, { _meta: unknown }>] extends [never]\n  ? unknown\n  : Extract<T, { _meta: unknown }> extends { _meta: infer M }\n    ? Simplify<M>\n    : unknown;\n\ntype AddTool<\n  TTools,\n  TName extends string,\n  TInput extends ZodRawShapeCompat,\n  TOutput,\n  TResponseMetadata = unknown,\n> = McpServer<\n  TTools & {\n    [K in TName]: ToolDef<ShapeOutput<TInput>, TOutput, TResponseMetadata>;\n  }\n>;\n\ninterface ToolConfig<TInput extends ZodRawShapeCompat | AnySchema> {\n  name: string;\n  title?: string;\n  description?: string;\n  inputSchema?: TInput;\n  outputSchema?: ZodRawShapeCompat | AnySchema;\n  annotations?: ToolAnnotations;\n  view?: ViewConfig;\n  /**\n   * Declares which auth schemes this tool supports (e.g. `noauth`, `oauth2`).\n   * Lets clients label tools that require sign-in before calling, and pass\n   * the right scopes through the OAuth flow. Listing both `noauth` and\n   * `oauth2` signals that the tool works for anonymous callers and gives\n   * enhanced behavior to authenticated ones.\n   */\n  securitySchemes?: SecurityScheme[];\n  _meta?: ToolMeta;\n}\n\n/**\n * Optional client-supplied hints attached to `params._meta` on every tool call\n * by the Apps SDK host. Hints only: never use for authorization, and tolerate\n * absence.\n * @see https://developers.openai.com/apps-sdk/reference#_meta-fields-the-client-provides\n */\nexport interface ClientHintsMeta {\n  /** Requested locale (BCP-47, e.g. `\"en-US\"`). */\n  \"openai/locale\"?: string;\n  /** Browser user-agent */\n  \"openai/userAgent\"?: string;\n  /** Coarse user location. May be partially populated. */\n  \"openai/userLocation\"?: {\n    city?: string;\n    region?: string;\n    country?: string;\n    timezone?: string;\n    longitude?: number;\n    latitude?: number;\n  };\n  /** Anonymized user id. */\n  \"openai/subject\"?: string;\n  /** Anonymized conversation id, stable within a ChatGPT session. */\n  \"openai/session\"?: string;\n  /** Anonymized organization id, when the user account is part of an organization. */\n  \"openai/organization\"?: string;\n  /** Stable id for the currently mounted widget instance. */\n  \"openai/widgetSessionId\"?: string;\n}\n\ntype ToolHandlerExtra = Omit<\n  RequestHandlerExtra<ServerRequest, ServerNotification>,\n  \"_meta\"\n> & {\n  _meta?: RequestMeta & ClientHintsMeta;\n};\n\ntype ToolHandler<\n  TInput extends ZodRawShapeCompat,\n  TReturn extends { content?: HandlerContent } = { content?: HandlerContent },\n> = (\n  args: ShapeOutput<TInput>,\n  extra: ToolHandlerExtra,\n) => TReturn | Promise<TReturn>;\n\ntype ErrorMiddlewareConfig = {\n  path?: string;\n  handlers: ErrorRequestHandler[];\n};\n\n/**\n * Coerce a tool handler's return value into an MCP `content` array. Strings\n * become a single `TextContent`; a single block is wrapped in an array;\n * `undefined` produces `[]`. Mostly used internally — exported so consumers\n * who build content lazily can apply the same normalization.\n */\nexport function normalizeContent(\n  content: HandlerContent | undefined,\n): ContentBlock[] {\n  if (content === undefined) {\n    return [];\n  }\n  if (typeof content === \"string\") {\n    return [{ type: \"text\", text: content }];\n  }\n  if (Array.isArray(content)) {\n    return content;\n  }\n  return [content];\n}\n\n// We Omit `registerTool` from the base class at the type level so our\n// unified 2-arg signature can replace the SDK's 3-arg one without an\n// incompatible override.  The runtime prototype chain is unaffected.\ninterface McpServerBaseOmitted\n  extends Omit<McpServerBase, \"registerTool\" | \"connect\"> {}\nconst McpServerBaseOmitted = McpServerBase as unknown as new (\n  ...args: ConstructorParameters<typeof McpServerBase>\n) => McpServerBaseOmitted;\n\n/**\n * The Skybridge server. Extends the MCP SDK's `McpServer` with a typed tool\n * registry, view resources, an embedded Express app, and protocol-level\n * middleware. Construct it with the same `Implementation` info you would pass\n * to the SDK, chain {@link McpServer.registerTool} calls to declare tools,\n * then call {@link McpServer.run} to start the HTTP server.\n *\n * The `TTools` generic accumulates each registered tool's input/output/meta\n * shape, so `typeof server` carries enough information for view-side helpers\n * like {@link generateHelpers} to produce fully-typed hooks.\n *\n * @typeParam TTools - Accumulated tool registry. Filled in by `registerTool`\n * chaining; you almost never set this manually.\n *\n * @example\n * ```ts\n * const server = new McpServer({ name: \"my-app\", version: \"1.0.0\" }, {})\n *   .registerTool({\n *     name: \"search\",\n *     inputSchema: { query: z.string() },\n *     view: { component: \"search\" },\n *   }, async ({ query }) => ({ content: `Results for ${query}` }));\n *\n * await server.run();\n * export type AppType = typeof server;\n * ```\n *\n * @see https://docs.skybridge.tech/api-reference/mcp-server\n */\nexport class McpServer<\n  TTools extends Record<string, ToolDef> = Record<never, ToolDef>,\n> extends McpServerBaseOmitted {\n  declare readonly $types: McpServerTypes<TTools>;\n  /**\n   * The underlying Express app. Use this to extend the HTTP server with\n   * custom routes, middleware, or settings — e.g.\n   * `server.express.get(\"/health\", ...)`.\n   *\n   * `express.json()` is pre-applied. Register your handlers before `run()`;\n   * after `run()`, dev-mode middleware, the `/mcp` route, and the default\n   * error handler are appended in that order.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp` — custom routes work\n   * locally and on self-hosted deployments.\n   */\n  readonly express: Express;\n  private customErrorMiddleware: ErrorMiddlewareConfig[] = [];\n  private mcpMiddlewareEntries: McpMiddlewareEntry[] = [];\n  private mcpMiddlewareApplied = false;\n  private claimedViews = new Map<string, string>();\n  private viewMetaBuilders = new Map<\n    string,\n    (extra: McpExtra | undefined) => ResourceMeta\n  >();\n  private viteManifest: Record<string, ViteManifestEntry> | null = null;\n  private readonly serverInfo: Implementation;\n  private readonly serverOptions?: ServerOptions;\n\n  constructor(serverInfo: Implementation, options?: ServerOptions) {\n    super(serverInfo, options);\n    this.serverInfo = serverInfo;\n    this.serverOptions = options;\n    this.express = express();\n    this.express.use(express.json());\n  }\n\n  /**\n   * Register Express middleware on the underlying app. Mirrors `app.use` —\n   * pass handlers directly or a path-prefixed handler list. Register before\n   * {@link McpServer.run}; ordering matches Express.\n   *\n   * Note: Alpic Cloud only routes traffic to `/mcp`. Custom paths work\n   * locally and on self-hosted deployments.\n   */\n  use(...handlers: RequestHandler[]): this;\n  use(path: string, ...handlers: RequestHandler[]): this;\n  use(\n    pathOrHandler: string | RequestHandler,\n    ...handlers: RequestHandler[]\n  ): this {\n    // Branching is load-bearing: Express's `app.use` overloads can't be\n    // resolved against a `string | RequestHandler` union, so we narrow.\n    if (typeof pathOrHandler === \"string\") {\n      this.express.use(pathOrHandler, ...handlers);\n    } else {\n      this.express.use(pathOrHandler, ...handlers);\n    }\n    return this;\n  }\n\n  /**\n   * Register Express error-handling middleware to run after the built-in\n   * `/mcp` route (or your custom route). Use this to log or transform errors\n   * thrown by tool handlers before the default error handler responds.\n   *\n   * @example\n   * ```ts\n   * server.useOnError((err, _req, _res, next) => {\n   *   logger.error(err);\n   *   next(err);\n   * });\n   * ```\n   */\n  useOnError(...handlers: ErrorRequestHandler[]): this;\n  useOnError(path: string, ...handlers: ErrorRequestHandler[]): this;\n  useOnError(\n    pathOrHandler: string | ErrorRequestHandler,\n    ...handlers: ErrorRequestHandler[]\n  ): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.customErrorMiddleware.push({ path: pathOrHandler, handlers });\n    } else {\n      this.customErrorMiddleware.push({\n        handlers: [pathOrHandler, ...handlers],\n      });\n    }\n    return this;\n  }\n\n  /** Register MCP protocol-level middleware (catch-all). */\n  mcpMiddleware(handler: McpMiddlewareFn): this;\n  /** Register MCP protocol-level middleware for all requests (`extra` is `McpExtra`). */\n  mcpMiddleware(\n    filter: \"request\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtra,\n      next: () => Promise<ServerResult>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /** Register MCP protocol-level middleware for all notifications (`extra` is `undefined`). */\n  mcpMiddleware(\n    filter: \"notification\",\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: undefined,\n      next: () => Promise<undefined>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for an exact method.\n   * Narrows `params`, `extra`, and `next()` result based on the method string.\n   */\n  mcpMiddleware<M extends McpMethodString>(\n    filter: M,\n    handler: McpTypedMiddlewareFn<M>,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware for a wildcard pattern (e.g. `\"tools/*\"`).\n   * `next()` returns the union of result types for matching methods.\n   */\n  mcpMiddleware<W extends McpWildcard>(\n    filter: W,\n    handler: (\n      request: { method: string; params: Record<string, unknown> },\n      extra: McpExtraFor<W>,\n      next: () => Promise<McpResultFor<W>>,\n    ) => Promise<unknown> | unknown,\n  ): this;\n  /**\n   * Register MCP protocol-level middleware with a method filter.\n   * Filter can be an exact method (`\"tools/call\"`), wildcard (`\"tools/*\"`),\n   * category (`\"request\"` | `\"notification\"`), or an array of those.\n   */\n  mcpMiddleware(filter: McpMiddlewareFilter, handler: McpMiddlewareFn): this;\n  mcpMiddleware(\n    filterOrHandler: McpMiddlewareFilter | McpMiddlewareFn,\n    // biome-ignore lint/suspicious/noExplicitAny: overloads narrow the handler type at call sites; implementation must accept all variants\n    maybeHandler?: any,\n  ): this {\n    if (this.mcpMiddlewareApplied) {\n      throw new Error(\n        \"Cannot register MCP middleware after run() or connect() has been called\",\n      );\n    }\n\n    const handler = maybeHandler as McpMiddlewareFn | undefined;\n\n    if (typeof filterOrHandler === \"function\") {\n      this.mcpMiddlewareEntries.push({\n        filter: null,\n        handler: filterOrHandler,\n      });\n    } else if (handler) {\n      this.mcpMiddlewareEntries.push({\n        filter: filterOrHandler,\n        handler,\n      });\n    } else {\n      throw new Error(\n        \"mcpMiddleware requires a handler function when a filter is provided\",\n      );\n    }\n\n    return this;\n  }\n\n  private applyMcpMiddleware(): void {\n    if (this.mcpMiddlewareApplied) {\n      return;\n    }\n    this.mcpMiddlewareApplied = true;\n\n    // Surface view-resource _meta on `resources/list` (per ext-apps spec:\n    // hosts/checkers read CSP & domain at list time before fetching content).\n    const viewListMetaEntry: McpMiddlewareEntry = {\n      filter: \"resources/list\",\n      handler: async (_req, extra, next) => {\n        const result = (await next()) as {\n          resources: Array<Record<string, unknown> & { uri: string }>;\n        };\n        for (const resource of result.resources) {\n          const builder = this.viewMetaBuilders.get(resource.uri);\n          if (!builder) {\n            continue;\n          }\n          const meta = builder(extra);\n          resource._meta = {\n            ...((resource._meta as Record<string, unknown>) ?? {}),\n            ...meta,\n          };\n        }\n        return result;\n      },\n    };\n\n    const monitoringEntry = createMiddlewareEntry();\n    const entries = [\n      ...(monitoringEntry ? [monitoringEntry] : []),\n      viewListMetaEntry,\n      ...this.mcpMiddlewareEntries,\n    ];\n\n    if (entries.length === 0) {\n      return;\n    }\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n\n    const instrumentMap = (\n      map: Map<string, (...args: unknown[]) => Promise<unknown>>,\n      isNotification: boolean,\n    ) => {\n      for (const [method, handler] of map) {\n        map.set(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n      }\n      const originalSet = map.set.bind(map);\n      map.set = (\n        method: string,\n        handler: (...args: unknown[]) => Promise<unknown>,\n      ) =>\n        originalSet(\n          method,\n          buildMiddlewareChain(method, isNotification, handler, entries),\n        );\n    };\n\n    instrumentMap(requestHandlers, false);\n    instrumentMap(notificationHandlers, true);\n  }\n\n  /**\n   * Connect to an MCP transport (override of the SDK's `connect`). Use this\n   * when you're embedding Skybridge in a host that already manages its own\n   * transport (e.g. stdio for desktop apps); for HTTP, prefer {@link McpServer.run}\n   * which sets the transport up for you. Locks in any middleware registered\n   * via {@link McpServer.mcpMiddleware} — further calls to that method will\n   * throw afterwards.\n   */\n  async connect(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n    return McpServerBase.prototype.connect.call(this, transport);\n  }\n\n  /**\n   * Per-request stateless connect. The SDK's `Protocol` only allows one\n   * transport per instance, so we can't reuse this `McpServer` across\n   * concurrent requests. The SDK's idiomatic fix is a `() => McpServer`\n   * factory, but that would break Skybridge's singleton API — so instead\n   * we build a fresh underlying `Server` per request and share the main\n   * server's handler maps by reference. The cast is unavoidable: there's\n   * no public API to inject handler maps. `getHandlerMaps` validates the\n   * read side and fails fast on SDK field renames.\n   */\n  async connectStatelessTransport(\n    transport: Parameters<typeof McpServerBase.prototype.connect>[0],\n  ): Promise<void> {\n    this.applyMcpMiddleware();\n\n    const { requestHandlers, notificationHandlers } = getHandlerMaps(\n      this.server,\n    );\n    const fresh = new SdkServer(this.serverInfo, this.serverOptions);\n    const target = fresh as unknown as {\n      _requestHandlers: unknown;\n      _notificationHandlers: unknown;\n    };\n    target._requestHandlers = requestHandlers;\n    target._notificationHandlers = notificationHandlers;\n\n    await fresh.connect(transport);\n  }\n\n  /**\n   * Start the HTTP server. Listens on `process.env.__PORT` (default `3000`),\n   * mounts the `/mcp` route, applies any custom Express middleware registered\n   * via {@link McpServer.use} / {@link McpServer.useOnError}, and locks in\n   * any MCP middleware registered via {@link McpServer.mcpMiddleware}.\n   *\n   * On Cloudflare Workers / workerd, returns an object exposing `fetch` so\n   * the runtime can bridge incoming requests to the Node HTTP server. On\n   * Node, returns `undefined` once listening.\n   */\n  async run(): Promise<{ fetch: (...args: unknown[]) => unknown } | undefined> {\n    this.applyMcpMiddleware();\n    const httpServer = http.createServer();\n\n    await createApp({\n      mcpServer: this,\n      httpServer,\n      errorMiddleware: this.customErrorMiddleware,\n    });\n\n    httpServer.on(\"request\", this.express);\n    const port = parseInt(process.env.__PORT ?? \"3000\", 10);\n    await new Promise<void>((resolve, reject) => {\n      httpServer.on(\"error\", (error: Error) => {\n        console.error(\"Failed to start server:\", error);\n        reject(error);\n      });\n      httpServer.listen(port, () => {\n        resolve();\n      });\n    });\n\n    // On workerd, bridge the Node http server to a Workers fetch handler.\n    // The specifier is held in a variable to sidestep tsc's module resolution\n    // (`cloudflare:node` only exists under wrangler/workerd).\n    if (\n      typeof navigator !== \"undefined\" &&\n      navigator.userAgent === \"Cloudflare-Workers\"\n    ) {\n      const cloudflareNode = \"cloudflare:node\";\n      const { httpServerHandler } = await import(cloudflareNode);\n      return httpServerHandler({ port });\n    }\n\n    const shutdown = () => {\n      // Drop both handlers so a second signal falls through to Node's default\n      // (force-quit on a second Ctrl+C while drain is hanging).\n      process.off(\"SIGTERM\", shutdown);\n      process.off(\"SIGINT\", shutdown);\n      httpServer.close(() => process.exit(0));\n      // Force exit if connections don't drain in time so the port is still\n      // released promptly (e.g. for nodemon restarts).\n      setTimeout(() => process.exit(0), 3000).unref();\n    };\n    process.on(\"SIGTERM\", shutdown);\n    process.on(\"SIGINT\", shutdown);\n    return undefined;\n  }\n\n  private enforceOneToolPerView(component: string, toolName: string): void {\n    const existingTool = this.claimedViews.get(component);\n    if (existingTool) {\n      throw new Error(\n        `skybridge: view \"${component}\" is already used by tool \"${existingTool}\". Tool \"${toolName}\" cannot also reference it — each view backs exactly one tool.`,\n      );\n    }\n    this.claimedViews.set(component, toolName);\n  }\n\n  private resolveViewRequestContext(extra: McpExtra | undefined): {\n    serverUrl: string;\n    connectDomains: string[];\n    contentMetaOverrides: { domain?: string };\n  } {\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const headers = extra?.requestInfo?.headers || {};\n    const header = (key: string) => {\n      const val = headers[key];\n      return Array.isArray(val) ? val[0] : val;\n    };\n    const isClaude = header(\"user-agent\") === \"Claude-User\";\n\n    let serverUrl: string;\n    const forwardedHost = header(\"x-forwarded-host\");\n    const origin = header(\"origin\");\n    const host = header(\"host\");\n\n    if (forwardedHost) {\n      const proto = header(\"x-forwarded-proto\") || \"https\";\n      serverUrl = `${proto}://${forwardedHost}`;\n    } else if (origin) {\n      serverUrl = origin;\n    } else if (host) {\n      const proto = [\"127.0.0.1:\", \"localhost:\"].some((p) => host.startsWith(p))\n        ? \"http\"\n        : \"https\";\n      serverUrl = `${proto}://${host}`;\n    } else {\n      const devPort = process.env.__PORT || \"3000\";\n      serverUrl = `http://localhost:${devPort}`;\n    }\n\n    const connectDomains = [serverUrl];\n    if (!isProduction) {\n      const wsUrl = new URL(serverUrl);\n      wsUrl.protocol = wsUrl.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n      connectDomains.push(wsUrl.origin);\n    }\n\n    let contentMetaOverrides: { domain?: string } = {};\n    if (isClaude) {\n      const pathname = extra?.requestInfo?.url?.pathname ?? \"\";\n      const rawUrl =\n        header(\"x-alpic-forwarded-url\") ?? `${serverUrl}${pathname}`;\n      // Strip a lone trailing slash so the hash matches the connector URL\n      // as registered with Claude (which has no trailing slash on bare origins).\n      const url = rawUrl.endsWith(\"/\") ? rawUrl.slice(0, -1) : rawUrl;\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(url)\n        .digest(\"hex\")\n        .slice(0, 32);\n      contentMetaOverrides = { domain: `${hash}.claudemcpcontent.com` };\n    }\n\n    return { serverUrl, connectDomains, contentMetaOverrides };\n  }\n\n  private registerViewResources(\n    toolName: string,\n    view: ViewConfig,\n    toolMeta: InternalToolMeta,\n  ): void {\n    const hosts = view.hosts ?? ([\"apps-sdk\", \"mcp-app\"] as const);\n\n    // Append a content-derived version param so hosts (e.g. ChatGPT) bust\n    // their cache when the bundle changes, but keep the URI stable across\n    // `tools/list` calls when the bundle hasn't changed.\n    const versionParam = this.computeViewVersionParam(view.component);\n\n    if (hosts.includes(\"apps-sdk\")) {\n      const viewResource: ViewResourceConfig<OpenaiResourceMeta> = {\n        hostType: \"apps-sdk\",\n        uri: `ui://views/apps-sdk/${view.component}.html${versionParam}`,\n        mimeType: \"text/html+skybridge\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain },\n          overrides,\n        ) => {\n          const defaults: OpenaiResourceMeta = {\n            \"openai/widgetCSP\": {\n              resource_domains: resourceDomains,\n              connect_domains: connectDomains,\n            },\n            \"openai/widgetDomain\": domain,\n            \"openai/widgetDescription\": view.description,\n          };\n\n          const fromView: Partial<\n            Omit<\n              OpenaiResourceMeta,\n              \"openai/widgetCSP\" | \"openai/widgetDescription\"\n            > & {\n              \"openai/widgetCSP\": Partial<OpenaiViewCSP>;\n            }\n          > = {\n            \"openai/widgetCSP\": {\n              resource_domains: view.csp?.resourceDomains,\n              connect_domains: view.csp?.connectDomains,\n              frame_domains: view.csp?.frameDomains,\n              redirect_domains: view.csp?.redirectDomains,\n            },\n            \"openai/widgetDomain\": view.domain,\n            \"openai/widgetPrefersBorder\": view.prefersBorder,\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            \"openai/widgetDomain\": overrides.domain,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as OpenaiResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      toolMeta[\"openai/outputTemplate\"] = viewResource.uri;\n    }\n\n    if (hosts.includes(\"mcp-app\")) {\n      const viewResource: ViewResourceConfig<McpAppsResourceMeta> = {\n        hostType: \"mcp-app\",\n        uri: `ui://views/ext-apps/${view.component}.html${versionParam}`,\n        mimeType: \"text/html;profile=mcp-app\",\n        buildContentMeta: (\n          { resourceDomains, connectDomains, domain, baseUriDomains },\n          overrides,\n        ) => {\n          const defaults: McpAppsResourceMeta = {\n            ui: {\n              csp: {\n                resourceDomains,\n                connectDomains,\n                baseUriDomains,\n              },\n              domain,\n            },\n          };\n\n          const fromView: McpAppsResourceMeta = {\n            ui: {\n              ...(view.description && { description: view.description }),\n              ...(view.prefersBorder !== undefined && {\n                prefersBorder: view.prefersBorder,\n              }),\n              ...(view.domain && { domain: view.domain }),\n              csp: {\n                ...(view.csp?.resourceDomains && {\n                  resourceDomains: view.csp.resourceDomains,\n                }),\n                ...(view.csp?.connectDomains && {\n                  connectDomains: view.csp.connectDomains,\n                }),\n                ...(view.csp?.frameDomains && {\n                  frameDomains: view.csp.frameDomains,\n                }),\n                ...(view.csp?.baseUriDomains && {\n                  baseUriDomains: view.csp.baseUriDomains,\n                }),\n                ...(view.csp?.redirectDomains && {\n                  redirectDomains: view.csp.redirectDomains,\n                }),\n              },\n            },\n          };\n\n          const base = mergeWithUnion(mergeWithUnion(defaults, fromView), {\n            ui: overrides,\n          });\n\n          if (view._meta) {\n            return { ...base, ...view._meta } as McpAppsResourceMeta;\n          }\n          return base;\n        },\n      };\n      this.registerViewResource({\n        name: toolName,\n        viewResource,\n        view,\n      });\n      // @ts-expect-error - For backwards compatibility with Claude current implementation of the specs\n      toolMeta[\"ui/resourceUri\"] = viewResource.uri;\n\n      toolMeta.ui = { ...toolMeta.ui, resourceUri: viewResource.uri };\n    }\n  }\n\n  private registerViewResource({\n    name,\n    viewResource,\n    view,\n  }: {\n    name: string;\n    viewResource: ViewResourceConfig;\n    view: ViewConfig;\n  }): void {\n    const { hostType, uri: viewUri, mimeType, buildContentMeta } = viewResource;\n\n    const buildMeta = (extra: McpExtra | undefined): ResourceMeta => {\n      const { serverUrl, connectDomains, contentMetaOverrides } =\n        this.resolveViewRequestContext(extra);\n      return buildContentMeta(\n        {\n          resourceDomains: [serverUrl],\n          connectDomains,\n          domain: serverUrl,\n          baseUriDomains: [serverUrl],\n        },\n        contentMetaOverrides,\n      );\n    };\n    this.viewMetaBuilders.set(viewUri, buildMeta);\n\n    this.registerResource(\n      name,\n      viewUri,\n      { description: view.description },\n      async (uri, extra) => {\n        const isProduction = process.env.NODE_ENV === \"production\";\n        const { serverUrl } = this.resolveViewRequestContext(extra);\n\n        const html = isProduction\n          ? templateHelper.renderProduction({\n              hostType,\n              serverUrl,\n              viewFile: this.lookupViewFile(view.component),\n              styleFile: this.lookupDistFile(\"style.css\") ?? \"\",\n            })\n          : templateHelper.renderDevelopment({\n              hostType,\n              serverUrl,\n              viewName: view.component,\n            });\n\n        return {\n          contents: [\n            { uri: uri.href, mimeType, text: html, _meta: buildMeta(extra) },\n          ],\n        };\n      },\n    );\n  }\n\n  private wrapHandler<InputArgs extends ZodRawShapeCompat>(\n    cb: ToolHandler<InputArgs>,\n    { attachViewUUID }: { attachViewUUID: boolean },\n  ): ToolHandler<InputArgs> {\n    return async (args, extra) => {\n      const result = await cb(args, extra);\n      return {\n        ...result,\n        content: normalizeContent(result.content),\n        ...(attachViewUUID && {\n          _meta: {\n            ...(result as { _meta?: Record<string, unknown> })._meta,\n            viewUUID: crypto.randomUUID(),\n          },\n        }),\n      };\n    };\n  }\n\n  private computeViewVersionParam(viewName: string): string {\n    if (process.env.NODE_ENV !== \"production\") {\n      return \"\";\n    }\n    try {\n      const viewFile = this.lookupViewFile(viewName);\n      const styleFile = this.lookupDistFile(\"style.css\") ?? \"\";\n      const hash = crypto\n        .createHash(\"sha256\")\n        .update(viewFile)\n        .update(\"\\0\")\n        .update(styleFile)\n        .digest(\"hex\")\n        .slice(0, 8);\n      return `?v=${hash}`;\n    } catch {\n      return \"\";\n    }\n  }\n\n  private lookupViewFile(viewName: string) {\n    const manifest = this.readManifest();\n    for (const entry of Object.values(manifest)) {\n      if (entry?.isEntry && entry.name === viewName && entry.file) {\n        return entry.file;\n      }\n    }\n    throw new Error(\n      `View \"${viewName}\" not found in Vite manifest. Did the build complete successfully? Look for an entry with name \"${viewName}\" in dist/assets/.vite/manifest.json.`,\n    );\n  }\n\n  private lookupDistFile(key: string) {\n    const manifest = this.readManifest();\n    return manifest[key]?.file;\n  }\n\n  /**\n   * Inject the Vite manifest as a value rather than letting `readManifest()`\n   * load it from disk. Required for runtimes without a usable filesystem\n   * (Cloudflare Workers, etc.) — the user's `skybridge build` emits the\n   * manifest as a JS module which the entry imports and passes here.\n   */\n  setViteManifest(manifest: Record<string, { file: string }>): this {\n    this.viteManifest = manifest as Record<string, ViteManifestEntry>;\n    return this;\n  }\n\n  private readManifest(): Record<string, ViteManifestEntry> {\n    if (this.viteManifest) {\n      return this.viteManifest;\n    }\n    return JSON.parse(\n      readFileSync(\n        path.join(process.cwd(), \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n        \"utf-8\",\n      ),\n    );\n  }\n\n  /**\n   * Register a tool. Pass a `config` describing the tool (name, schemas,\n   * optional {@link ViewConfig}, optional {@link ToolMeta}) and a handler that\n   * returns the tool's result.\n   *\n   * Chain calls to build up a server: each call returns a new `McpServer`\n   * type that captures the tool's input/output/`_meta` shape so the\n   * resulting `typeof server` can drive {@link generateHelpers}.\n   *\n   * The handler's return shape determines the output types: the\n   * `structuredContent` field becomes the tool's typed output, and `_meta`\n   * becomes its `responseMetadata`. The `content` field is normalized through\n   * {@link normalizeContent}.\n   *\n   * @example\n   * ```ts\n   * server.registerTool({\n   *   name: \"search\",\n   *   inputSchema: { query: z.string() },\n   *   outputSchema: { results: z.array(z.string()) },\n   *   view: { component: \"search\" },\n   * }, async ({ query }) => ({\n   *   content: `Found results for ${query}`,\n   *   structuredContent: { results: [...] },\n   * }));\n   * ```\n   *\n   * @see https://docs.skybridge.tech/api-reference/register-tool\n   */\n  registerTool<\n    TName extends string,\n    InputArgs extends ZodRawShapeCompat,\n    TReturn extends { content?: HandlerContent },\n  >(\n    config: ToolConfig<InputArgs> & { name: TName },\n    cb: ToolHandler<InputArgs, TReturn>,\n  ): AddTool<\n    TTools,\n    TName,\n    InputArgs,\n    ExtractStructuredContent<TReturn>,\n    ExtractMeta<TReturn>\n  >;\n  registerTool<InputArgs extends ZodRawShapeCompat>(\n    config: ToolConfig<InputArgs>,\n    cb: ToolHandler<InputArgs>,\n  ): this;\n  registerTool(...args: unknown[]): unknown {\n    const baseFn = McpServerBase.prototype.registerTool as (\n      ...args: unknown[]\n    ) => unknown;\n\n    if (typeof args[0] === \"string\") {\n      baseFn.call(this, args[0], args[1], args[2]);\n      return this;\n    }\n\n    const config = args[0] as ToolConfig<ZodRawShapeCompat>;\n    const cb = args[1] as ToolHandler<ZodRawShapeCompat>;\n\n    const {\n      name,\n      view,\n      securitySchemes,\n      _meta: userToolMeta,\n      ...toolFields\n    } = config;\n\n    const toolMeta: InternalToolMeta = { ...userToolMeta };\n\n    if (securitySchemes) {\n      // SEP-1488 puts `securitySchemes` at the top level of the tool\n      // descriptor, but the SDK's `registerTool` drops unknown top-level\n      // fields, so the canonical spot isn't reachable without intercepting\n      // `tools/list`. Use the `_meta` back-compat mirror documented in the\n      // Apps SDK reference until SEP-1488 lands in the spec.\n      toolMeta.securitySchemes = securitySchemes;\n    }\n\n    if (view) {\n      this.enforceOneToolPerView(view.component, name);\n      this.registerViewResources(name, view, toolMeta);\n    }\n\n    const wrappedCb = this.wrapHandler(cb, { attachViewUUID: Boolean(view) });\n\n    baseFn.call(this, name, { ...toolFields, _meta: toolMeta }, wrappedCb);\n\n    return this;\n  }\n}\n"]}

package/dist/test/view.test.js

@@ -1,5 +1,8 @@
 import crypto from "node:crypto";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 import { afterEach, beforeEach, describe, expect, it, vi, } from "vitest";
+import { McpServer as McpServerClass } from "../server/server.js";
 import { createMockExtra, createMockMcpServer, resetTestEnv, setTestEnv, } from "./utils.js";
 const mockManifest = {
     "skybridge:view:my-view": {
@@ -520,4 +523,46 @@ describe("McpServer.registerTool (unified API)", () => {
         expect(toolConfig._meta?.["acme.com/category"]).toBe("utility");
     });
 });
+describe("resources/list view _meta injection", () => {
+    afterEach(() => resetTestEnv());
+    it("attaches CSP, domain, and connectDomains _meta to view resources at list time", async () => {
+        setTestEnv({ NODE_ENV: "production" });
+        const server = new McpServerClass({ name: "test", version: "1.0.0" }, { capabilities: {} });
+        server.registerTool({
+            name: "start",
+            description: "Start",
+            view: {
+                component: "my-view",
+                description: "Onboarding deck",
+                domain: "skybridge.tech",
+                csp: {
+                    resourceDomains: ["https://fonts.googleapis.com"],
+                    redirectDomains: ["https://docs.skybridge.tech"],
+                },
+            },
+        }, vi.fn().mockResolvedValue({
+            content: [{ type: "text", text: "ok" }],
+            structuredContent: {},
+        }));
+        const client = new Client({ name: "test-client", version: "1.0.0" });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await server.connect(serverTransport);
+        await client.connect(clientTransport);
+        const { resources } = await client.listResources();
+        await client.close();
+        await server.close();
+        const appsSdk = resources.find((r) => r.uri.includes("apps-sdk"));
+        const extApps = resources.find((r) => r.uri.includes("ext-apps"));
+        expect(appsSdk?._meta).toBeDefined();
+        expect(extApps?._meta).toBeDefined();
+        const appsSdkCsp = appsSdk?._meta?.["openai/widgetCSP"];
+        expect(appsSdkCsp.connect_domains?.length).toBeGreaterThan(0);
+        expect(appsSdkCsp.resource_domains).toContain("https://fonts.googleapis.com");
+        expect(appsSdk?._meta?.["openai/widgetDomain"]).toBe("skybridge.tech");
+        const extUi = (extApps?._meta).ui;
+        expect(extUi?.csp?.connectDomains?.length).toBeGreaterThan(0);
+        expect(extUi?.csp?.resourceDomains).toContain("https://fonts.googleapis.com");
+        expect(extUi?.domain).toBe("skybridge.tech");
+    });
+});
 //# sourceMappingURL=view.test.js.map