skybridge 1.2.7 → 1.3.0

package/dist/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, await resolveViewsDir(root));\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,WAAW,EACT,oJAAoJ;YACtJ,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC;gBACxB,GAAG;gBACH,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa;aACd,CAAC,CAAC;YAEH,uEAAuE;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;gBACtC,aAAa,CAAC,IAAI,EAAE,CAAC;gBACrB,QAAQ,EAAE,CAAC;gBACX,KAAK,kBAAkB,EAAE;qBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { runPlain } from \"../cli/run-plain.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n    plain: Flags.boolean({\n      description:\n        \"Disable the interactive UI and stream raw server logs to stdout, so you can pipe them through a formatter (e.g. `skybridge dev --plain | bunyan`).\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, await resolveViewsDir(root));\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    if (flags.plain) {\n      const teardown = runPlain({\n        env,\n        port,\n        fallback,\n        version: this.config.version,\n        tunnel: flags.tunnel,\n        tunnelManager,\n      });\n\n      // Synchronous-first shutdown: kill the alpic subprocess up front so we\n      // can't leave it orphaned even if another SIGINT listener (e.g.\n      // nodemon's) exits the process before our async cleanup completes.\n      const shutdown = (code: number) => () => {\n        tunnelManager.stop();\n        teardown();\n        void closeTunnelControl()\n          .catch((err) => {\n            console.error(\"Failed to close tunnel control server\", err);\n          })\n          .finally(() => {\n            process.exit(code);\n          });\n      };\n      process.once(\"SIGINT\", shutdown(130));\n      process.once(\"SIGTERM\", shutdown(143));\n      return;\n    }\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}

package/dist/server/auth/security-schemes.d.ts

@@ -0,0 +1,23 @@
+import type { AuthInfo } from "../auth.js";
+import type { SecurityScheme, ToolAuth } from "../server.js";
+export declare function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[];
+export declare function securitySchemesAllowAnonymous(schemes: SecurityScheme[] | undefined): boolean;
+export type SchemeFailure = {
+    error: "invalid_token" | "insufficient_scope";
+    description: string;
+    scopes: string[];
+};
+export declare function evaluateSecuritySchemes(schemes: SecurityScheme[] | undefined, authInfo: AuthInfo | undefined): SchemeFailure | undefined;
+export declare function httpStatusForFailure(failure: SchemeFailure): 401 | 403;
+export declare function clientPrefersInBandChallenge(userAgent: string | undefined): boolean;
+export declare function wwwAuthenticateHeader(failure: SchemeFailure, resourceMetadataUrl?: string): string;
+export declare function inBandChallengeResult(failure: SchemeFailure, resourceMetadataUrl?: string): {
+    isError: boolean;
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    _meta: {
+        "mcp/www_authenticate": string[];
+    };
+};

package/dist/server/auth/security-schemes.js

@@ -0,0 +1,64 @@
+import { hostFromUserAgent } from "../host.js";
+export function authToSecuritySchemes(auth) {
+    const oauth2 = {
+        type: "oauth2",
+        ...(auth.scopes?.length ? { scopes: auth.scopes } : {}),
+    };
+    return auth.allowsAnonymous ? [{ type: "noauth" }, oauth2] : [oauth2];
+}
+export function securitySchemesAllowAnonymous(schemes) {
+    return !!schemes?.some((scheme) => scheme.type === "noauth");
+}
+export function evaluateSecuritySchemes(schemes, authInfo) {
+    if (securitySchemesAllowAnonymous(schemes) && !authInfo) {
+        return undefined;
+    }
+    const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === "oauth2");
+    const required = oauth2.length ? oauth2 : [{ type: "oauth2" }];
+    const scopes = [
+        ...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),
+    ];
+    if (!authInfo) {
+        return {
+            error: "invalid_token",
+            description: "Sign in to use this tool.",
+            scopes,
+        };
+    }
+    const satisfied = required.some((scheme) => (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)));
+    return satisfied
+        ? undefined
+        : {
+            error: "insufficient_scope",
+            description: "Missing required scope for this tool.",
+            scopes,
+        };
+}
+export function httpStatusForFailure(failure) {
+    return failure.error === "insufficient_scope" ? 403 : 401;
+}
+export function clientPrefersInBandChallenge(userAgent) {
+    return hostFromUserAgent(userAgent) === "openai";
+}
+export function wwwAuthenticateHeader(failure, resourceMetadataUrl) {
+    let header = `Bearer error="${failure.error}", error_description="${failure.description}"`;
+    if (failure.scopes.length) {
+        header += `, scope="${failure.scopes.join(" ")}"`;
+    }
+    if (resourceMetadataUrl) {
+        header += `, resource_metadata="${resourceMetadataUrl}"`;
+    }
+    return header;
+}
+export function inBandChallengeResult(failure, resourceMetadataUrl) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: failure.description }],
+        _meta: {
+            "mcp/www_authenticate": [
+                wwwAuthenticateHeader(failure, resourceMetadataUrl),
+            ],
+        },
+    };
+}
+//# sourceMappingURL=security-schemes.js.map

package/dist/server/auth/security-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,MAAM,MAAM,GAAmB;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IACF,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAqC;IAErC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,OAAqC,EACrC,QAA8B;IAE9B,IAAI,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM;SACP,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,OAAO,SAAS;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM;SACP,CAAC;AACR,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAA6B;IAE7B,OAAO,iBAAiB,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,IAAI,MAAM,GAAG,iBAAiB,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,WAAW,GAAG,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,mBAAmB,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/D,KAAK,EAAE;YACL,sBAAsB,EAAE;gBACtB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthInfo } from \"../auth.js\";\nimport { hostFromUserAgent } from \"../host.js\";\nimport type { SecurityScheme, ToolAuth } from \"../server.js\";\n\nexport function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[] {\n  const oauth2: SecurityScheme = {\n    type: \"oauth2\",\n    ...(auth.scopes?.length ? { scopes: auth.scopes } : {}),\n  };\n  return auth.allowsAnonymous ? [{ type: \"noauth\" }, oauth2] : [oauth2];\n}\n\nexport function securitySchemesAllowAnonymous(\n  schemes: SecurityScheme[] | undefined,\n): boolean {\n  return !!schemes?.some((scheme) => scheme.type === \"noauth\");\n}\n\nexport type SchemeFailure = {\n  error: \"invalid_token\" | \"insufficient_scope\";\n  description: string;\n  scopes: string[];\n};\n\nexport function evaluateSecuritySchemes(\n  schemes: SecurityScheme[] | undefined,\n  authInfo: AuthInfo | undefined,\n): SchemeFailure | undefined {\n  if (securitySchemesAllowAnonymous(schemes) && !authInfo) {\n    return undefined;\n  }\n  const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === \"oauth2\");\n  const required = oauth2.length ? oauth2 : [{ type: \"oauth2\" as const }];\n  const scopes = [\n    ...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),\n  ];\n  if (!authInfo) {\n    return {\n      error: \"invalid_token\",\n      description: \"Sign in to use this tool.\",\n      scopes,\n    };\n  }\n  const satisfied = required.some((scheme) =>\n    (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)),\n  );\n  return satisfied\n    ? undefined\n    : {\n        error: \"insufficient_scope\",\n        description: \"Missing required scope for this tool.\",\n        scopes,\n      };\n}\n\nexport function httpStatusForFailure(failure: SchemeFailure): 401 | 403 {\n  return failure.error === \"insufficient_scope\" ? 403 : 401;\n}\n\nexport function clientPrefersInBandChallenge(\n  userAgent: string | undefined,\n): boolean {\n  return hostFromUserAgent(userAgent) === \"openai\";\n}\n\nexport function wwwAuthenticateHeader(\n  failure: SchemeFailure,\n  resourceMetadataUrl?: string,\n): string {\n  let header = `Bearer error=\"${failure.error}\", error_description=\"${failure.description}\"`;\n  if (failure.scopes.length) {\n    header += `, scope=\"${failure.scopes.join(\" \")}\"`;\n  }\n  if (resourceMetadataUrl) {\n    header += `, resource_metadata=\"${resourceMetadataUrl}\"`;\n  }\n  return header;\n}\n\nexport function inBandChallengeResult(\n  failure: SchemeFailure,\n  resourceMetadataUrl?: string,\n) {\n  return {\n    isError: true,\n    content: [{ type: \"text\" as const, text: failure.description }],\n    _meta: {\n      \"mcp/www_authenticate\": [\n        wwwAuthenticateHeader(failure, resourceMetadataUrl),\n      ],\n    },\n  };\n}\n"]}

package/dist/server/auth/security-schemes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/security-schemes.test.js

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+import { authToSecuritySchemes, clientPrefersInBandChallenge, evaluateSecuritySchemes, securitySchemesAllowAnonymous, wwwAuthenticateHeader, } from "./security-schemes.js";
+describe("clientPrefersInBandChallenge", () => {
+    it("detects ChatGPT / OpenAI user agents", () => {
+        expect(clientPrefersInBandChallenge("openai-mcp/1.0")).toBe(true);
+        expect(clientPrefersInBandChallenge("ChatGPT")).toBe(true);
+        expect(clientPrefersInBandChallenge("Claude-User/1.0")).toBe(false);
+        expect(clientPrefersInBandChallenge(undefined)).toBe(false);
+    });
+});
+describe("authToSecuritySchemes", () => {
+    it("maps the auth shorthand", () => {
+        expect(authToSecuritySchemes({ allowsAnonymous: true })).toEqual([
+            { type: "noauth" },
+            { type: "oauth2" },
+        ]);
+        expect(authToSecuritySchemes({})).toEqual([{ type: "oauth2" }]);
+        expect(authToSecuritySchemes({ scopes: ["checkout"] })).toEqual([
+            { type: "oauth2", scopes: ["checkout"] },
+        ]);
+        expect(authToSecuritySchemes({ allowsAnonymous: true, scopes: ["checkout"] })).toEqual([{ type: "noauth" }, { type: "oauth2", scopes: ["checkout"] }]);
+    });
+});
+const authInfo = (scopes) => ({
+    token: "t",
+    clientId: "c",
+    scopes,
+});
+describe("securitySchemesAllowAnonymous", () => {
+    it("is true only when a noauth scheme is present", () => {
+        expect(securitySchemesAllowAnonymous([{ type: "noauth" }])).toBe(true);
+        expect(securitySchemesAllowAnonymous([{ type: "noauth" }, { type: "oauth2" }])).toBe(true);
+        expect(securitySchemesAllowAnonymous([{ type: "oauth2" }])).toBe(false);
+        expect(securitySchemesAllowAnonymous(undefined)).toBe(false);
+    });
+});
+describe("evaluateSecuritySchemes", () => {
+    it("lets anonymous callers through a noauth tool", () => {
+        const schemes = [{ type: "noauth" }, { type: "oauth2" }];
+        expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();
+    });
+    it("enforces oauth2 scopes on a public tool once a token is present", () => {
+        const schemes = [
+            { type: "noauth" },
+            { type: "oauth2", scopes: ["checkout"] },
+        ];
+        expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();
+        expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.error).toBe("insufficient_scope");
+        expect(evaluateSecuritySchemes(schemes, authInfo(["checkout"]))).toBeUndefined();
+    });
+    it("fails an oauth2-only tool with no token (invalid_token / 401)", () => {
+        expect(evaluateSecuritySchemes([{ type: "oauth2" }], undefined)?.error).toBe("invalid_token");
+    });
+    it("fails when the token is missing a required scope (insufficient_scope / 403)", () => {
+        const schemes = [
+            { type: "oauth2", scopes: ["checkout"] },
+        ];
+        expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.error).toBe("insufficient_scope");
+    });
+    it("passes when the token carries every required scope", () => {
+        const schemes = [
+            { type: "oauth2", scopes: ["checkout"] },
+        ];
+        expect(evaluateSecuritySchemes(schemes, authInfo(["openid", "checkout"]))).toBeUndefined();
+    });
+    it("treats an undeclared tool as auth-required, satisfied by any valid token", () => {
+        expect(evaluateSecuritySchemes(undefined, undefined)?.error).toBe("invalid_token");
+        expect(evaluateSecuritySchemes(undefined, authInfo([]))).toBeUndefined();
+    });
+    it("carries the tool's required scopes on the failure", () => {
+        const schemes = [
+            { type: "oauth2", scopes: ["checkout"] },
+        ];
+        expect(evaluateSecuritySchemes(schemes, undefined)?.scopes).toEqual([
+            "checkout",
+        ]);
+        expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.scopes).toEqual(["checkout"]);
+    });
+});
+describe("wwwAuthenticateHeader", () => {
+    it("names the required scopes so the client can step up", () => {
+        const header = wwwAuthenticateHeader({
+            error: "insufficient_scope",
+            description: "Missing required scope for this tool.",
+            scopes: ["checkout"],
+        });
+        expect(header).toContain('error="insufficient_scope"');
+        expect(header).toContain('scope="checkout"');
+    });
+    it("omits the scope parameter when there are none", () => {
+        const header = wwwAuthenticateHeader({
+            error: "invalid_token",
+            description: "Sign in to use this tool.",
+            scopes: [],
+        });
+        expect(header).not.toContain("scope=");
+    });
+});
+//# sourceMappingURL=security-schemes.test.js.map

package/dist/server/auth/security-schemes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-schemes.test.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/D,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,CACJ,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,GAAG;IACV,QAAQ,EAAE,GAAG;IACb,MAAM;CACP,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CACJ,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACxE,oBAAoB,CACrB,CAAC;QACF,MAAM,CACJ,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CACzD,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CACJ,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,CAChE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACxE,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CACJ,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CACnE,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAC/D,eAAe,CAChB,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;YAClE,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CACJ,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAC/D,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport type { AuthInfo } from \"../auth.js\";\nimport type { SecurityScheme } from \"../server.js\";\nimport {\n  authToSecuritySchemes,\n  clientPrefersInBandChallenge,\n  evaluateSecuritySchemes,\n  securitySchemesAllowAnonymous,\n  wwwAuthenticateHeader,\n} from \"./security-schemes.js\";\n\ndescribe(\"clientPrefersInBandChallenge\", () => {\n  it(\"detects ChatGPT / OpenAI user agents\", () => {\n    expect(clientPrefersInBandChallenge(\"openai-mcp/1.0\")).toBe(true);\n    expect(clientPrefersInBandChallenge(\"ChatGPT\")).toBe(true);\n    expect(clientPrefersInBandChallenge(\"Claude-User/1.0\")).toBe(false);\n    expect(clientPrefersInBandChallenge(undefined)).toBe(false);\n  });\n});\n\ndescribe(\"authToSecuritySchemes\", () => {\n  it(\"maps the auth shorthand\", () => {\n    expect(authToSecuritySchemes({ allowsAnonymous: true })).toEqual([\n      { type: \"noauth\" },\n      { type: \"oauth2\" },\n    ]);\n    expect(authToSecuritySchemes({})).toEqual([{ type: \"oauth2\" }]);\n    expect(authToSecuritySchemes({ scopes: [\"checkout\"] })).toEqual([\n      { type: \"oauth2\", scopes: [\"checkout\"] },\n    ]);\n    expect(\n      authToSecuritySchemes({ allowsAnonymous: true, scopes: [\"checkout\"] }),\n    ).toEqual([{ type: \"noauth\" }, { type: \"oauth2\", scopes: [\"checkout\"] }]);\n  });\n});\n\nconst authInfo = (scopes: string[]): AuthInfo => ({\n  token: \"t\",\n  clientId: \"c\",\n  scopes,\n});\n\ndescribe(\"securitySchemesAllowAnonymous\", () => {\n  it(\"is true only when a noauth scheme is present\", () => {\n    expect(securitySchemesAllowAnonymous([{ type: \"noauth\" }])).toBe(true);\n    expect(\n      securitySchemesAllowAnonymous([{ type: \"noauth\" }, { type: \"oauth2\" }]),\n    ).toBe(true);\n    expect(securitySchemesAllowAnonymous([{ type: \"oauth2\" }])).toBe(false);\n    expect(securitySchemesAllowAnonymous(undefined)).toBe(false);\n  });\n});\n\ndescribe(\"evaluateSecuritySchemes\", () => {\n  it(\"lets anonymous callers through a noauth tool\", () => {\n    const schemes: SecurityScheme[] = [{ type: \"noauth\" }, { type: \"oauth2\" }];\n    expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();\n  });\n\n  it(\"enforces oauth2 scopes on a public tool once a token is present\", () => {\n    const schemes: SecurityScheme[] = [\n      { type: \"noauth\" },\n      { type: \"oauth2\", scopes: [\"checkout\"] },\n    ];\n    expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();\n    expect(evaluateSecuritySchemes(schemes, authInfo([\"openid\"]))?.error).toBe(\n      \"insufficient_scope\",\n    );\n    expect(\n      evaluateSecuritySchemes(schemes, authInfo([\"checkout\"])),\n    ).toBeUndefined();\n  });\n\n  it(\"fails an oauth2-only tool with no token (invalid_token / 401)\", () => {\n    expect(\n      evaluateSecuritySchemes([{ type: \"oauth2\" }], undefined)?.error,\n    ).toBe(\"invalid_token\");\n  });\n\n  it(\"fails when the token is missing a required scope (insufficient_scope / 403)\", () => {\n    const schemes: SecurityScheme[] = [\n      { type: \"oauth2\", scopes: [\"checkout\"] },\n    ];\n    expect(evaluateSecuritySchemes(schemes, authInfo([\"openid\"]))?.error).toBe(\n      \"insufficient_scope\",\n    );\n  });\n\n  it(\"passes when the token carries every required scope\", () => {\n    const schemes: SecurityScheme[] = [\n      { type: \"oauth2\", scopes: [\"checkout\"] },\n    ];\n    expect(\n      evaluateSecuritySchemes(schemes, authInfo([\"openid\", \"checkout\"])),\n    ).toBeUndefined();\n  });\n\n  it(\"treats an undeclared tool as auth-required, satisfied by any valid token\", () => {\n    expect(evaluateSecuritySchemes(undefined, undefined)?.error).toBe(\n      \"invalid_token\",\n    );\n    expect(evaluateSecuritySchemes(undefined, authInfo([]))).toBeUndefined();\n  });\n\n  it(\"carries the tool's required scopes on the failure\", () => {\n    const schemes: SecurityScheme[] = [\n      { type: \"oauth2\", scopes: [\"checkout\"] },\n    ];\n    expect(evaluateSecuritySchemes(schemes, undefined)?.scopes).toEqual([\n      \"checkout\",\n    ]);\n    expect(\n      evaluateSecuritySchemes(schemes, authInfo([\"openid\"]))?.scopes,\n    ).toEqual([\"checkout\"]);\n  });\n});\n\ndescribe(\"wwwAuthenticateHeader\", () => {\n  it(\"names the required scopes so the client can step up\", () => {\n    const header = wwwAuthenticateHeader({\n      error: \"insufficient_scope\",\n      description: \"Missing required scope for this tool.\",\n      scopes: [\"checkout\"],\n    });\n    expect(header).toContain('error=\"insufficient_scope\"');\n    expect(header).toContain('scope=\"checkout\"');\n  });\n\n  it(\"omits the scope parameter when there are none\", () => {\n    const header = wwwAuthenticateHeader({\n      error: \"invalid_token\",\n      description: \"Sign in to use this tool.\",\n      scopes: [],\n    });\n    expect(header).not.toContain(\"scope=\");\n  });\n});\n"]}

package/dist/server/auth/setup.d.ts

@@ -1,4 +1,6 @@
 import type { Express } from "express";
+import type { SecurityScheme } from "../server.js";
 import type { OAuthConfig } from "./index.js";
+export type ResourceMetadataUrlResolver = (getHeader: (key: string) => string | undefined) => string;
 /** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
-export declare function setupOAuth(app: Express, config: OAuthConfig): void;
+export declare function setupOAuth(app: Express, config: OAuthConfig, schemesByTool: Map<string, SecurityScheme[] | undefined>): ResourceMetadataUrlResolver;

package/dist/server/auth/setup.js

@@ -1,14 +1,22 @@
 import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import cors from "cors";
-import { requireBearerAuth } from "../auth.js";
+import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
 import { resolveServerOrigin } from "../requestOrigin.js";
+import { clientPrefersInBandChallenge, evaluateSecuritySchemes, httpStatusForFailure, inBandChallengeResult, securitySchemesAllowAnonymous, wwwAuthenticateHeader, } from "./security-schemes.js";
 import { createJwksVerifier } from "./verify.js";
 /** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
-export function setupOAuth(app, config) {
+export function setupOAuth(app, config, schemesByTool) {
     if (!config.verify?.issuer) {
         throw new Error("oauth.verify requires an `issuer`");
     }
+    const acceptsAnonymous = () => [...schemesByTool.values()].some(securitySchemesAllowAnonymous);
     const verifier = createJwksVerifier(config.verify);
+    const bearer = (options) => {
+        const required = requireBearerAuth(options);
+        const optional = optionalBearerAuth(options);
+        return (req, res, next) => (acceptsAnonymous() ? optional : required)(req, res, next);
+    };
+    let resourceMetadataUrl;
     // baseUrl known at boot: bake the resource URLs once, no Host-header trust.
     if (config.baseUrl !== undefined) {
         let baseUrl;
@@ -23,29 +31,62 @@ export function setupOAuth(app, config) {
             resourceServerUrl: baseUrl,
             scopesSupported: config.scopesSupported,
         }));
-        app.use("/mcp", requireBearerAuth({
-            verifier,
-            requiredScopes: config.requiredScopes,
-            resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
-        }));
-        return;
+        const url = getOAuthProtectedResourceMetadataUrl(baseUrl);
+        resourceMetadataUrl = () => url;
     }
-    // No baseUrl: resolve the resource origin per request from forwarded headers
-    // (same precedence the framework uses for view serverUrl). Origin headers are
-    // pathless, so the PRM path stays at root, matching the SDK's static layout.
-    const resolveOrigin = (req) => new URL(resolveServerOrigin((key) => req.get(key)));
-    app.use("/.well-known/oauth-authorization-server", cors(), (_req, res) => void res.json(config.oauthMetadata));
-    app.use("/.well-known/oauth-protected-resource", cors(), (req, res) => {
-        res.json({
-            resource: resolveOrigin(req).href,
-            authorization_servers: [config.oauthMetadata.issuer],
-            scopes_supported: config.scopesSupported,
+    else {
+        // No baseUrl: resolve the resource origin per request from forwarded headers
+        // (same precedence the framework uses for view serverUrl). Origin headers are
+        // pathless, so the PRM path stays at root, matching the SDK's static layout.
+        const resolveOrigin = (getHeader) => new URL(resolveServerOrigin(getHeader));
+        app.use("/.well-known/oauth-authorization-server", cors(), (_req, res) => void res.json(config.oauthMetadata));
+        app.use("/.well-known/oauth-protected-resource", cors(), (req, res) => {
+            res.json({
+                resource: resolveOrigin((key) => req.get(key)).href,
+                authorization_servers: [config.oauthMetadata.issuer],
+                scopes_supported: config.scopesSupported,
+            });
         });
-    });
-    app.use("/mcp", (req, res, next) => requireBearerAuth({
+        resourceMetadataUrl = (getHeader) => getOAuthProtectedResourceMetadataUrl(resolveOrigin(getHeader));
+    }
+    app.use("/mcp", (req, res, next) => bearer({
         verifier,
         requiredScopes: config.requiredScopes,
-        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resolveOrigin(req)),
+        resourceMetadataUrl: resourceMetadataUrl((key) => req.get(key)),
     })(req, res, next));
+    app.use("/mcp", (req, res, next) => {
+        const body = req.body;
+        const calls = Array.isArray(body) ? body : [body];
+        const auth = req.auth;
+        let failure;
+        for (const call of calls) {
+            const tool = call?.params?.name;
+            if (call?.method === "tools/call" && tool && schemesByTool.has(tool)) {
+                failure = evaluateSecuritySchemes(schemesByTool.get(tool), auth);
+                if (failure) {
+                    break;
+                }
+            }
+        }
+        if (!failure) {
+            return next();
+        }
+        const url = resourceMetadataUrl((key) => req.get(key));
+        if (!Array.isArray(body) &&
+            clientPrefersInBandChallenge(req.get("user-agent"))) {
+            res.json({
+                jsonrpc: "2.0",
+                id: body?.id ?? null,
+                result: inBandChallengeResult(failure, url),
+            });
+            return;
+        }
+        res.set("WWW-Authenticate", wwwAuthenticateHeader(failure, url));
+        res.status(httpStatusForFailure(failure)).json({
+            error: failure.error,
+            error_description: failure.description,
+        });
+    });
+    return resourceMetadataUrl;
 }
 //# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;YACpB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,OAAO;YAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CACL,MAAM,EACN,iBAAiB,CAAC;YAChB,QAAQ;YACR,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;SACnE,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CACrC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,IAAI,EAAE,EACN,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACnD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI;YACjC,qBAAqB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YACpD,gBAAgB,EAAE,MAAM,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjC,iBAAiB,CAAC;QAChB,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CACvD,aAAa,CAAC,GAAG,CAAC,CACnB;KACF,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport cors from \"cors\";\nimport type { Express, Request } from \"express\";\nimport { requireBearerAuth } from \"../auth.js\";\nimport { resolveServerOrigin } from \"../requestOrigin.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  if (!config.verify?.issuer) {\n    throw new Error(\"oauth.verify requires an `issuer`\");\n  }\n\n  const verifier = createJwksVerifier(config.verify);\n\n  // baseUrl known at boot: bake the resource URLs once, no Host-header trust.\n  if (config.baseUrl !== undefined) {\n    let baseUrl: URL;\n    try {\n      baseUrl = new URL(config.baseUrl);\n    } catch {\n      throw new Error(\n        `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n          config.baseUrl,\n        )}`,\n      );\n    }\n    app.use(\n      mcpAuthMetadataRouter({\n        oauthMetadata: config.oauthMetadata,\n        resourceServerUrl: baseUrl,\n        scopesSupported: config.scopesSupported,\n      }),\n    );\n    app.use(\n      \"/mcp\",\n      requireBearerAuth({\n        verifier,\n        requiredScopes: config.requiredScopes,\n        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n      }),\n    );\n    return;\n  }\n\n  // No baseUrl: resolve the resource origin per request from forwarded headers\n  // (same precedence the framework uses for view serverUrl). Origin headers are\n  // pathless, so the PRM path stays at root, matching the SDK's static layout.\n  const resolveOrigin = (req: Request) =>\n    new URL(resolveServerOrigin((key) => req.get(key)));\n\n  app.use(\n    \"/.well-known/oauth-authorization-server\",\n    cors(),\n    (_req, res) => void res.json(config.oauthMetadata),\n  );\n  app.use(\"/.well-known/oauth-protected-resource\", cors(), (req, res) => {\n    res.json({\n      resource: resolveOrigin(req).href,\n      authorization_servers: [config.oauthMetadata.issuer],\n      scopes_supported: config.scopesSupported,\n    });\n  });\n  app.use(\"/mcp\", (req, res, next) =>\n    requireBearerAuth({\n      verifier,\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(\n        resolveOrigin(req),\n      ),\n    })(req, res, next),\n  );\n}\n"]}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EAErB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CACxB,GAAY,EACZ,MAAmB,EACnB,aAAwD;IAExD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,OAAoC,EAAkB,EAAE;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACxB,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,IAAI,mBAAgD,CAAC;IAErD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;YACpB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,OAAO;YAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;QAC1D,mBAAmB,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,aAAa,GAAG,CAAC,SAA8C,EAAE,EAAE,CACvE,IAAI,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,IAAI,EAAE,EACN,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACnD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpE,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,aAAa,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBACnD,qBAAqB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBACpD,gBAAgB,EAAE,MAAM,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,mBAAmB,GAAG,CAAC,SAAS,EAAE,EAAE,CAClC,oCAAoC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjC,MAAM,CAAC;QACL,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KAChE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CACnB,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAMjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAiC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,GAAI,GAAqC,CAAC,IAAI,CAAC;QACzD,IAAI,OAAkC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;YAChC,IAAI,IAAI,EAAE,MAAM,KAAK,YAAY,IAAI,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,GAAG,uBAAuB,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBACjE,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EACnD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;gBACpB,MAAM,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC;AAC7B,CAAC","sourcesContent":["import type { BearerAuthMiddlewareOptions } from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nimport {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport cors from \"cors\";\nimport type { Express, Request, RequestHandler } from \"express\";\nimport type { AuthInfo } from \"../auth.js\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport { resolveServerOrigin } from \"../requestOrigin.js\";\nimport type { SecurityScheme } from \"../server.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport {\n  clientPrefersInBandChallenge,\n  evaluateSecuritySchemes,\n  httpStatusForFailure,\n  inBandChallengeResult,\n  type SchemeFailure,\n  securitySchemesAllowAnonymous,\n  wwwAuthenticateHeader,\n} from \"./security-schemes.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nexport type ResourceMetadataUrlResolver = (\n  getHeader: (key: string) => string | undefined,\n) => string;\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(\n  app: Express,\n  config: OAuthConfig,\n  schemesByTool: Map<string, SecurityScheme[] | undefined>,\n): ResourceMetadataUrlResolver {\n  if (!config.verify?.issuer) {\n    throw new Error(\"oauth.verify requires an `issuer`\");\n  }\n\n  const acceptsAnonymous = () =>\n    [...schemesByTool.values()].some(securitySchemesAllowAnonymous);\n  const verifier = createJwksVerifier(config.verify);\n  const bearer = (options: BearerAuthMiddlewareOptions): RequestHandler => {\n    const required = requireBearerAuth(options);\n    const optional = optionalBearerAuth(options);\n    return (req, res, next) =>\n      (acceptsAnonymous() ? optional : required)(req, res, next);\n  };\n\n  let resourceMetadataUrl: ResourceMetadataUrlResolver;\n\n  // baseUrl known at boot: bake the resource URLs once, no Host-header trust.\n  if (config.baseUrl !== undefined) {\n    let baseUrl: URL;\n    try {\n      baseUrl = new URL(config.baseUrl);\n    } catch {\n      throw new Error(\n        `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n          config.baseUrl,\n        )}`,\n      );\n    }\n    app.use(\n      mcpAuthMetadataRouter({\n        oauthMetadata: config.oauthMetadata,\n        resourceServerUrl: baseUrl,\n        scopesSupported: config.scopesSupported,\n      }),\n    );\n    const url = getOAuthProtectedResourceMetadataUrl(baseUrl);\n    resourceMetadataUrl = () => url;\n  } else {\n    // No baseUrl: resolve the resource origin per request from forwarded headers\n    // (same precedence the framework uses for view serverUrl). Origin headers are\n    // pathless, so the PRM path stays at root, matching the SDK's static layout.\n    const resolveOrigin = (getHeader: (key: string) => string | undefined) =>\n      new URL(resolveServerOrigin(getHeader));\n    app.use(\n      \"/.well-known/oauth-authorization-server\",\n      cors(),\n      (_req, res) => void res.json(config.oauthMetadata),\n    );\n    app.use(\"/.well-known/oauth-protected-resource\", cors(), (req, res) => {\n      res.json({\n        resource: resolveOrigin((key) => req.get(key)).href,\n        authorization_servers: [config.oauthMetadata.issuer],\n        scopes_supported: config.scopesSupported,\n      });\n    });\n    resourceMetadataUrl = (getHeader) =>\n      getOAuthProtectedResourceMetadataUrl(resolveOrigin(getHeader));\n  }\n\n  app.use(\"/mcp\", (req, res, next) =>\n    bearer({\n      verifier,\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: resourceMetadataUrl((key) => req.get(key)),\n    })(req, res, next),\n  );\n\n  app.use(\"/mcp\", (req, res, next) => {\n    type Call = {\n      id?: string | number | null;\n      method?: string;\n      params?: { name?: string };\n    };\n    const body = req.body as Call | Call[] | undefined;\n    const calls = Array.isArray(body) ? body : [body];\n    const auth = (req as Request & { auth?: AuthInfo }).auth;\n    let failure: SchemeFailure | undefined;\n    for (const call of calls) {\n      const tool = call?.params?.name;\n      if (call?.method === \"tools/call\" && tool && schemesByTool.has(tool)) {\n        failure = evaluateSecuritySchemes(schemesByTool.get(tool), auth);\n        if (failure) {\n          break;\n        }\n      }\n    }\n    if (!failure) {\n      return next();\n    }\n    const url = resourceMetadataUrl((key) => req.get(key));\n    if (\n      !Array.isArray(body) &&\n      clientPrefersInBandChallenge(req.get(\"user-agent\"))\n    ) {\n      res.json({\n        jsonrpc: \"2.0\",\n        id: body?.id ?? null,\n        result: inBandChallengeResult(failure, url),\n      });\n      return;\n    }\n    res.set(\"WWW-Authenticate\", wwwAuthenticateHeader(failure, url));\n    res.status(httpStatusForFailure(failure)).json({\n      error: failure.error,\n      error_description: failure.description,\n    });\n  });\n\n  return resourceMetadataUrl;\n}\n"]}