From 4ed264c3180bd557ce82ad239f51f7b40e10876e Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Mon, 8 Jun 2026 23:37:58 +0200
Subject: [PATCH] refactor(mcp): replace `as unknown as` globalThis casts with
 `declare global`

Use proper TypeScript `declare global` + `??` assignment pattern to
initialize HMR-safe singletons without double casts or non-null
assertions. Also removes dead eslint-disable comments (oxlint is used).
---
 apps/nextjs/src/app/api/mcp/oauth/_store.ts    | 18 ++++++++----------
 .../src/app/api/mcp/oauth/register/route.ts    | 12 +++++++-----
 .../src/app/api/mcp/oauth/token/route.ts       | 12 +++++++-----
 3 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/apps/nextjs/src/app/api/mcp/oauth/_store.ts b/apps/nextjs/src/app/api/mcp/oauth/_store.ts
index e15614691..5d50de9b2 100644
--- a/apps/nextjs/src/app/api/mcp/oauth/_store.ts
+++ b/apps/nextjs/src/app/api/mcp/oauth/_store.ts
@@ -34,18 +34,16 @@ interface OAuthStore {
   cleanupTimer: ReturnType<typeof setInterval> | null;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const globalStore = globalThis as unknown as { mcpOAuthStore?: OAuthStore };
-if (!globalStore.mcpOAuthStore) {
-  globalStore.mcpOAuthStore = {
-    clients: new Map(),
-    authCodes: new Map(),
-    pendingAuths: new Map(),
-    cleanupTimer: null,
-  };
+declare global {
+  var mcpOAuthStore: OAuthStore | undefined;
 }
 
-const store = globalStore.mcpOAuthStore;
+const store = globalThis.mcpOAuthStore ?? (globalThis.mcpOAuthStore = {
+  clients: new Map(),
+  authCodes: new Map(),
+  pendingAuths: new Map(),
+  cleanupTimer: null,
+});
 const clients = store.clients;
 const authCodes = store.authCodes;
 const pendingAuths = store.pendingAuths;
diff --git a/apps/nextjs/src/app/api/mcp/oauth/register/route.ts b/apps/nextjs/src/app/api/mcp/oauth/register/route.ts
index 47f00a4f7..ff28ad829 100644
--- a/apps/nextjs/src/app/api/mcp/oauth/register/route.ts
+++ b/apps/nextjs/src/app/api/mcp/oauth/register/route.ts
@@ -8,12 +8,14 @@ interface RateLimitStore {
 const REGISTER_RATE_WINDOW_MS = 60_000;
 const REGISTER_MAX_ATTEMPTS = 5;
 
-const globalStore = globalThis as unknown as { mcpRegisterRateLimit?: RateLimitStore };
-if (!globalStore.mcpRegisterRateLimit) {
-  globalStore.mcpRegisterRateLimit = { attempts: new Map(), timer: null };
+declare global {
+  var mcpRegisterRateLimit: RateLimitStore | undefined;
 }
-// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-const store = globalStore.mcpRegisterRateLimit!;
+
+const store = globalThis.mcpRegisterRateLimit ?? (globalThis.mcpRegisterRateLimit = {
+  attempts: new Map(),
+  timer: null,
+});
 const registerAttempts = store.attempts;
 
 if (!store.timer) {
diff --git a/apps/nextjs/src/app/api/mcp/oauth/token/route.ts b/apps/nextjs/src/app/api/mcp/oauth/token/route.ts
index 6153d1cf6..c9d24f7a1 100644
--- a/apps/nextjs/src/app/api/mcp/oauth/token/route.ts
+++ b/apps/nextjs/src/app/api/mcp/oauth/token/route.ts
@@ -18,12 +18,14 @@ interface RateLimitStore {
 const TOKEN_RATE_WINDOW_MS = 60_000;
 const TOKEN_MAX_FAILURES = 10;
 
-const globalStore = globalThis as unknown as { mcpTokenRateLimit?: RateLimitStore };
-if (!globalStore.mcpTokenRateLimit) {
-  globalStore.mcpTokenRateLimit = { failures: new Map(), timer: null };
+declare global {
+  var mcpTokenRateLimit: RateLimitStore | undefined;
 }
-// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-const store = globalStore.mcpTokenRateLimit!;
+
+const store = globalThis.mcpTokenRateLimit ?? (globalThis.mcpTokenRateLimit = {
+  failures: new Map(),
+  timer: null,
+});
 const tokenFailures = store.failures;
 
 if (!store.timer) {