Deploy to Cloudflare Workers

// From: packages/xmcp/src/platforms/build-cloudflare-output.ts

async function buildCloudflareOutput(options = {}) {
  const outputDir = rootDir;
  const buildDir = path.join(rootDir, ".xmcp", "cloudflare");

  // Check if Cloudflare worker build exists
  const sourceFile = path.join(buildDir, "worker.js");
  if (!fs.existsSync(sourceFile)) {
    throw new Error("Cloudflare build output not found. Run: xmcp build --cf");
  }

  // Copy the bundled worker
  const targetFile = path.join(outputDir, "worker.js");
  fs.copyFileSync(sourceFile, targetFile);

  // Generate wrangler config (only if the user doesn't have one already)
  const wranglerTomlPath = path.join(outputDir, "wrangler.toml");
  const wranglerJsoncPath = path.join(outputDir, "wrangler.jsonc");
  if (!fs.existsSync(wranglerTomlPath) && !fs.existsSync(wranglerJsoncPath)) {
    const projectName = getProjectName();
    const wranglerConfig = generateWranglerConfig(projectName);
    fs.writeFileSync(wranglerJsoncPath, wranglerConfig);
  }
}

import { XmcpConfig } from "xmcp";

const config: XmcpConfig = {
  http: {
    debug: true,
  },
  paths: {
    tools: "./src/tools",
    prompts: false,
    resources: false,
  },
};

export default config;

// From: packages/xmcp/src/runtime/platforms/cloudflare/middlewares/api-key.ts

export function cloudflareApiKeyAuthMiddleware(
  config: { apiKey: string; headerName?: string }
): WebMiddleware {
  const headerName = config.headerName ?? "x-api-key";
  
  return async (request) => {
    const apiKeyHeader = request.headers.get(headerName);
    if (!apiKeyHeader || apiKeyHeader !== config.apiKey) {
      return new Response(
        JSON.stringify({ error: "Unauthorized: Missing or invalid API key" }),
        { status: 401, headers: { "Content-Type": "application/json" } }
      );
    }
    return; // Allow request to continue
  };
}

// From: packages/xmcp/src/runtime/platforms/cloudflare/middlewares/jwt.ts

import { jwtVerify, importJWK, importSPKI, importX509 } from "jose";

export function cloudflareJwtAuthMiddleware(
  config: CloudflareJWTAuthMiddlewareConfig
): WebMiddleware {
  return async (request) => {
    const authHeader = request.headers.get("authorization");
    const token = extractBearerToken(authHeader);
    
    if (!token) {
      return jsonUnauthorized(
        "Unauthorized: Missing or malformed Authorization header"
      );
    }

    try {
      await verifyJwt(token, config);
      return; // Valid token
    } catch {
      return jsonUnauthorized("Unauthorized: Invalid or expired token");
    }
  };
}