[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","mcpconformance","name","mcp-client-conformance","path","src/hosted/wire.ts","project",{"_22":49,"_11":12,"_35":50,"_51":-5,"_52":44,"_53":54,"_55":54,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/mcpconformance/mcp-client-conformance/code/src/hosted/wire.ts","extension","id","d0a7b158-9cd8-4668-b0b3-13443687f86f","wire.ts","fileId","0f9d7306-ae29-11f1-bb76-1607ee4eb77e","parentId","11abc952-e3be-41e6-ac33-6929c3af1284","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","branchVersion",393,"latest",true,"createdAt",["D",1789379129894],"version",11,"fileType","script","content","/**\n * What the wire said about a dispatched MCP request: the client's request as\n * a JSON-RPC message (method, requested version), the response the cell gave\n * it (status, body), and the two judgements the hosted layer records from\n * them so a cell cannot read green when every request was turned away:\n *\n * hosted-wire-rejected a 4xx whose body is one of the lifecycle\n * rejections (missing header / _meta, unsupported\n * protocol version) — the scenario never saw a\n * request it could judge;\n * hosted-wrong-revision the client spoke a revision other than the one\n * the cell is served on (a stateful `initialize` on\n * the stateless wire, a header naming another\n * revision).\n *\n * Both are FAILUREs, so they decide the cell's verdict (see report.ts). A\n * request that is both is one mistake and records only the wrong revision,\n * with the rejection folded in. Probing for a revision is negotiation, not\n * a mistake, and is noted as INFO in both directions, judged from the\n * request itself so that neither its timing nor which process saw it\n * matters: on a dated cell a `server/discover`, or another 2026-07-28-shaped\n * request the cell turned away, is a modern probe (see isModernProbe()); on\n * the stateless wire an `initialize` is a legacy probe (see isLegacyProbe()).\n */\n\nimport type { ServerResponse } from 'node:http';\nimport { isStatefulVersion } from '../connection/versions.ts';\nimport type { ConformanceCheck, SpecVersion } from '../types.ts';\n\nexport const WIRE_REJECTED_CHECK_ID = 'hosted-wire-rejected';\nexport const WRONG_REVISION_CHECK_ID = 'hosted-wrong-revision';\n\n/** Response bodies above this are not captured (a rejection is small). */\nexport const RESPONSE_CAP = 64 * 1024;\n\nconst META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion';\n\nfunction asRecord(v: unknown): Record | undefined {\n return typeof v === 'object' && v !== null && !Array.isArray(v)\n ? (v as Record)\n : undefined;\n}\n\nfunction str(v: unknown): string | undefined {\n return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n\n/** Whether a request body is not JSON at all: empty, or malformed. */\nexport function isUnparseable(body: Buffer | string | undefined): boolean {\n if (body === undefined) return false;\n try {\n JSON.parse(body.toString());\n return false;\n } catch {\n return true;\n }\n}\n\n/** The JSON-RPC message(s) of a body: one object, or a batch. */\nfunction messagesOfJson(text: string): Record[] {\n try {\n const parsed: unknown = JSON.parse(text);\n const list = Array.isArray(parsed) ? parsed : [parsed];\n return list.map(asRecord).filter((m): m is Record => !!m);\n } catch {\n return [];\n }\n}\n\n/**\n * JSON-RPC messages in a response body: a JSON object or batch, or the\n * `data:` lines of an SSE stream (the SDK transport answers a POST that\n * way — `event: message\\ndata: {...}\\n\\n`).\n */\nexport function jsonRpcMessages(\n body: string | undefined,\n contentType: string | undefined\n): Record[] {\n if (body === undefined) return [];\n if (/^text\\/event-stream\\b/i.test(contentType ?? '')) {\n const out: Record[] = [];\n for (const event of body.split(/\\r?\\n\\r?\\n/)) {\n const data = event\n .split(/\\r?\\n/)\n .filter((line) => line.startsWith('data:'))\n .map((line) => line.slice('data:'.length).replace(/^ /, ''))\n .join('\\n');\n if (data) out.push(...messagesOfJson(data));\n }\n return out;\n }\n return messagesOfJson(body);\n}\n\n/** What one request says about itself, read from its JSON-RPC body. */\nexport interface RequestInfo {\n /** JSON-RPC methods carried (one per batch member with a `method`). */\n methods: string[];\n /**\n * The protocol version the client asked for in the body: `initialize`\n * params on the stateful wire, `_meta` on the stateless one.\n */\n bodyVersion?: string;\n /**\n * The protocol version in a message's per-request `_meta`: the shape of a\n * 2026-07-28 (stateless) request, which a dated revision never uses.\n */\n metaVersion?: string;\n}\n\nexport function describeRequest(\n body: Buffer | string | undefined\n): RequestInfo {\n const messages = body === undefined ? [] : messagesOfJson(body.toString());\n const methods: string[] = [];\n let bodyVersion: string | undefined;\n let metaVersion: string | undefined;\n for (const m of messages) {\n const method = str(m.method);\n if (method) methods.push(method);\n const params = asRecord(m.params);\n metaVersion ??= str(asRecord(params?._meta)?.[META_PROTOCOL_VERSION]);\n bodyVersion ??=\n metaVersion ??\n (method === 'initialize' ? str(params?.protocolVersion) : undefined);\n }\n return {\n methods,\n ...(bodyVersion && { bodyVersion }),\n ...(metaVersion && { metaVersion })\n };\n}\n\n/** The response a cell gave, as captured by tapResponse(). */\nexport interface CapturedResponse {\n status: number;\n contentType?: string;\n /** The WWW-Authenticate challenge, on a 401 or 403 that carries one. */\n wwwAuthenticate?: string;\n /** Undefined when the body was over RESPONSE_CAP. */\n body?: string;\n /** The body's first bytes (up to RESPONSE_CAP), even when it was over. */\n head?: string;\n /** The body's full size in bytes. */\n size?: number;\n}\n\n/**\n * Wrap `res.write`/`res.end` so `onEnd` sees the status and (up to\n * RESPONSE_CAP) the body once the response is complete. `onEnd` runs after\n * the original `end`, synchronously, so a bridge that resolves its Response\n * from `end` still sees whatever `onEnd` records before it flushes.\n * `onWrite`, when given, runs after each write before the end, likewise\n * synchronously: for a response that may never end, such as a server-sent\n * event stream the client keeps open. It is handed the body so far (up to\n * RESPONSE_CAP).\n */\nexport function tapResponse(\n res: ServerResponse,\n onEnd: (captured: CapturedResponse) => void,\n onWrite?: (soFar: () => string) => void\n): void {\n const chunks: Buffer[] = [];\n let size = 0;\n let overflow = false;\n let ended = false;\n const capture = (chunk: unknown, encoding?: unknown) => {\n if (overflow) return;\n let buf: Buffer;\n if (Buffer.isBuffer(chunk)) buf = chunk;\n else if (chunk instanceof Uint8Array)\n buf = Buffer.from(chunk); // hono/node-server\n else if (typeof chunk === 'string')\n buf = Buffer.from(\n chunk,\n typeof encoding === 'string' ? (encoding as BufferEncoding) : 'utf8'\n );\n else return; // end(cb), end()\n size += buf.length;\n if (size > RESPONSE_CAP) overflow = true;\n else chunks.push(buf);\n };\n const write = res.write;\n const end = res.end;\n const soFar = () => Buffer.concat(chunks).toString('utf8');\n res.write = function (this: ServerResponse, ...args: unknown[]) {\n capture(args[0], args[1]);\n const out = (write as (...a: unknown[]) => boolean).apply(this, args);\n onWrite?.(soFar);\n return out;\n } as ServerResponse['write'];\n res.end = function (this: ServerResponse, ...args: unknown[]) {\n capture(args[0], args[1]);\n const out = (end as (...a: unknown[]) => ServerResponse).apply(this, args);\n if (!ended) {\n ended = true;\n const contentType = res.getHeader('content-type');\n const wwwAuthenticate = res.getHeader('www-authenticate');\n const head = soFar();\n onEnd({\n status: res.statusCode,\n ...(typeof contentType === 'string' && { contentType }),\n ...(typeof wwwAuthenticate === 'string' && { wwwAuthenticate }),\n ...(!overflow && { body: head }),\n head,\n size\n });\n }\n return out;\n } as ServerResponse['end'];\n}\n\nexport interface WireRejection {\n status: number;\n code: number;\n message: string;\n}\n\n/**\n * The lifecycle rejection in a 4xx response, if that is what it is: a\n * JSON-RPC error with code -32020 / -32022 (protocol-version header), -32602\n * naming `_meta`, or -32000 saying \"Unsupported protocol version\" (the SDK\n * transport's stateful negotiation failure).\n *\n * An unsupported-version rejection of a request whose header already names\n * the cell's revision `served` is not the client's doing — it is a\n * scenario's deliberate probe (request-metadata rejects a run's first\n * request to exercise the client's retry) — and is not one.\n */\nexport function wireRejection(\n response: CapturedResponse,\n served: SpecVersion,\n headerVersion: string | undefined\n): WireRejection | undefined {\n if (response.status < 400 || response.status >= 500) return undefined;\n for (const m of jsonRpcMessages(response.body, response.contentType)) {\n const error = asRecord(m.error);\n if (!error || typeof error.code !== 'number') continue;\n const code = error.code;\n const message = str(error.message) ?? '';\n const unsupportedVersion =\n code === -32022 ||\n (code === -32000 && message.includes('Unsupported protocol version'));\n if (unsupportedVersion && headerVersion === served) continue;\n if (\n unsupportedVersion ||\n code === -32020 ||\n (code === -32602 && message.includes('_meta'))\n ) {\n return { status: response.status, code, message };\n }\n }\n return undefined;\n}\n\nexport const MODERN_PROBE_CHECK_ID = 'hosted-modern-probe';\n\n/** How a cell turned a request away: its status, and any JSON-RPC error. */\nexport interface Refusal {\n status: number;\n code?: number;\n message?: string;\n}\n\nexport const DISCOVER_METHOD = 'server/discover';\n\n/** Whether revision `a` is later than `b` (both are dates, YYYY-MM-DD). */\nfunction isNewer(a: string, b: string): boolean {\n return a > b;\n}\n\n/**\n * Whether a request to a dated cell is a modern probe — era detection\n * rather than a client at the wrong revision — judged from the request and\n * the answer it drew alone, never from what came before it (2026-07-28\n * basic/versioning, \"Backward Compatibility with Initialization-Based\n * Versions\"):\n *\n * - a `server/discover`, whenever it arrives and however often: a dual-era\n * client may send one on every connect, and a dated cell\n * always turns it away (see discoverReply());\n * - any other request in the 2026-07-28 shape — per-request `_meta` naming\n * a revision newer than `served` — that the cell turned away (a 4xx: the\n * transport's 400, or the 401 an auth cell answers first). On HTTP a\n * dual-era client may probe with any modern request, and it may re-probe\n * whenever it reconnects.\n *\n * Either is noted (modernProbeCheck()), never failed. `initialize`\n * negotiates on this wire and is never judged. A foreign-revision request\n * the cell accepted, or one in the dated shape (no per-request `_meta`)\n * whose header names another revision, is the client carrying on at the\n * wrong revision. On the stateless wire nothing is a modern probe (see\n * isLegacyProbe() for the mirror case there).\n */\nexport function isModernProbe(\n served: SpecVersion,\n request: RequestInfo,\n headerVersion: string | undefined,\n response: CapturedResponse\n): boolean {\n if (!isStatefulVersion(served)) return false;\n if (request.methods.includes('initialize')) return false;\n if (request.methods.includes(DISCOVER_METHOD)) return true;\n const version = headerVersion ?? request.metaVersion;\n if (!request.metaVersion || !version || !isNewer(version, served))\n return false;\n return response.status >= 400 && response.status < 500;\n}\n\n/** Whether `body` holds one JSON-RPC message, a `server/discover`. */\nexport function isLoneDiscover(body: Buffer): boolean {\n const message = messagesOfJson(body.toString());\n return message.length === 1 && message[0].method === DISCOVER_METHOD;\n}\n\n/**\n * The answer every dated cell gives a `server/discover`, or undefined when\n * `body` is not one (or the cell is on the stateless wire): HTTP 400 with a\n * JSON-RPC -32000 \"Unsupported protocol version\", what the 2025-11-25 SDK\n * transport answers a header it does not know. That is how a server without\n * 2026-07-28 support turns a modern request away on HTTP: a 4xx whose body\n * is not a recognized modern error, so a dual-era client falls back to\n * `initialize` (2026-07-28 basic/transports/streamable-http, \"Backward\n * Compatibility\"). A 404 with -32601 would not do: that is a modern server\n * saying it lacks the method, and a client may take it as a modern server.\n * The hosted layer sends it before the scenario sees the request, so every\n * dated cell and composite agrees; the bundled servers answered 400, 404 or\n * even a DiscoverResult.\n */\nexport function discoverReply(\n served: SpecVersion,\n body: Buffer | undefined,\n headerVersion: string | undefined\n): { status: number; body: Record } | undefined {\n if (!isStatefulVersion(served) || body === undefined) return undefined;\n const message = messagesOfJson(body.toString());\n if (message.length !== 1 || message[0].method !== DISCOVER_METHOD)\n return undefined;\n const requested = headerVersion ?? describeRequest(body).metaVersion;\n return {\n status: 400,\n body: {\n jsonrpc: '2.0',\n id: message[0].id ?? null,\n error: {\n code: -32000,\n message:\n requested && requested !== served\n ? `Bad Request: Unsupported protocol version: ${requested} (supported versions: ${served})`\n : `Bad Request: ${DISCOVER_METHOD} is not part of ${served}; open a session with initialize`\n }\n }\n };\n}\n\nexport const UNPARSEABLE_BODY_CHECK_ID = 'hosted-unparseable-body';\n\n/** The answer to a POST whose body is not JSON: a plain -32700. */\nexport const PARSE_ERROR_REPLY = {\n jsonrpc: '2.0',\n id: null,\n error: { code: -32700, message: 'Parse error' }\n} as const;\n\n/**\n * A POST to the MCP endpoint whose body is empty or not JSON. The hosted\n * layer answers it with PARSE_ERROR_REPLY before the scenario sees it (the\n * bundled servers quoted their parser's exception), and notes it so the\n * client's author sees what was sent.\n */\nexport function unparseableBodyCheck(\n served: SpecVersion,\n empty: boolean,\n headerVersion: string | undefined\n): ConformanceCheck {\n return {\n id: UNPARSEABLE_BODY_CHECK_ID,\n name: 'UnparseableBody',\n description:\n `The client sent a POST to the MCP endpoint ${empty ? 'with an empty body' : 'whose body is not valid JSON'}, ` +\n 'so the cell answered HTTP 400 with JSON-RPC error -32700 (Parse error)',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n served,\n body: empty ? 'empty' : 'malformed',\n headerVersion: headerVersion ?? null,\n status: 400,\n code: -32700\n }\n };\n}\n\nexport const REVISION_SPOKEN_CHECK_ID = 'hosted-revision-spoken';\n\n/**\n * Whether the exchange shows the client speaking the cell's revision\n * `served`: an accepted (2xx) request at it. On a dated cell that is an\n * `initialize` asking for `served`, or a later request whose header names\n * it; on the stateless wire, a request whose header names it. A cell that\n * never saw one has not tested its revision, whatever else it recorded (see\n * SessionManager.results()).\n */\nexport function spokeRevision(\n served: SpecVersion,\n request: RequestInfo,\n headerVersion: string | undefined,\n response: CapturedResponse\n): boolean {\n if (response.status < 200 || response.status >= 300) return false;\n if (!request.methods.length) return false;\n if (request.methods.includes('initialize')) {\n return isStatefulVersion(served) && request.bodyVersion === served;\n }\n return headerVersion === served;\n}\n\n/**\n * The marker spokeRevision() leaves on a cell: kept with the hosted checks\n * so every process's sighting is pooled, and never shown.\n */\nexport function revisionSpokenCheck(served: SpecVersion): ConformanceCheck {\n return {\n id: REVISION_SPOKEN_CHECK_ID,\n name: 'RevisionSpoken',\n description: `The client made an accepted request at ${served}`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: { served }\n };\n}\n\nexport const REVISION_REACHED_CHECK_ID = 'hosted-revision-reached';\n\n/**\n * Whether the client sent the cell an MCP request at its revision `served`,\n * however the cell answered it — a 401 sign-in challenge counts. What a\n * scenario that expects the client to stop before it is let in (it must\n * refuse mismatched metadata, say) needs to have seen before it can pass:\n * fetching metadata alone, as a client listing its servers does, tests\n * nothing. At `served` as spokeRevision() reads it.\n */\nexport function reachedRevision(\n served: SpecVersion,\n request: RequestInfo,\n headerVersion: string | undefined\n): boolean {\n if (!request.methods.length) return false;\n if (request.methods.includes('initialize')) {\n return isStatefulVersion(served) && request.bodyVersion === served;\n }\n return headerVersion === served;\n}\n\n/** The marker reachedRevision() leaves on a cell; never shown. */\nexport function revisionReachedCheck(served: SpecVersion): ConformanceCheck {\n return {\n id: REVISION_REACHED_CHECK_ID,\n name: 'RevisionReached',\n description: `The client sent an MCP request at ${served}`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: { served }\n };\n}\n\nexport const ACTIVITY_CHECK_ID = 'hosted-client-activity';\n\n/**\n * The marker of the client's latest request to a cell, at any of its paths\n * (MCP, metadata, sign-in), re-stamped as requests come (see\n * SessionManager.noteActivity()): kept with the hosted checks so every\n * process's is pooled, and never shown. `awaitingInput` is set while the\n * cell has handed the client something to put before a person (an MRTR\n * input_required result, or a request of its own on a stream still open)\n * that no answer has closed yet.\n */\nexport function activityCheck(\n at: number,\n awaitingInput: boolean\n): ConformanceCheck {\n return {\n id: ACTIVITY_CHECK_ID,\n name: 'ClientActivity',\n description: 'The latest request the client sent the cell',\n status: 'INFO',\n timestamp: new Date(at).toISOString(),\n details: { awaitingInput }\n };\n}\n\n/** Whether a response asks the client to collect input: MRTR's input_required. */\nexport function asksForInput(response: CapturedResponse): boolean {\n return (\n response.body !== undefined &&\n /\"resultType\"\\s*:\\s*\"input_required\"/.test(response.body)\n );\n}\n\nexport const AUTH_STOP_CHECK_ID = 'hosted-auth-stop';\n\n/** The OAuth error a 401 or 403 carries, in its challenge or its body. */\nfunction oauthError(response: CapturedResponse): string | undefined {\n const challenge = response.wwwAuthenticate?.match(/\\berror=\"([^\"]*)\"/);\n if (challenge) return challenge[1];\n try {\n const body = JSON.parse(response.body ?? '') as unknown;\n const record = asRecord(body);\n if (record && !('jsonrpc' in record)) return str(record.error);\n } catch {\n // Not JSON: no OAuth error body.\n }\n return undefined;\n}\n\n/**\n * Whether the auth layer, not version negotiation, ended the exchange: the\n * request presented an access token (Bearer or DPoP), and the cell answered\n * 401 or 403 with an OAuth error (insufficient_scope, invalid_token) rather\n * than a JSON-RPC one. With a token presented the auth layer answers before\n * the version is looked at, so such a stop does not depend on the revision\n * the request carried: a cell counts it as reached at its own revision once\n * the client signed in there (signedInAuthStop()). A request with no token,\n * or one turned away at version negotiation, is not one.\n */\nexport function authLayerStop(\n authorization: string | undefined,\n response: CapturedResponse\n): boolean {\n if (response.status !== 401 && response.status !== 403) return false;\n if (!authorization || !/^(Bearer|DPoP) +\\S/i.test(authorization))\n return false;\n return oauthError(response) !== undefined;\n}\n\n/** The marker authLayerStop() leaves on a cell; never shown. */\nexport function authStopCheck(served: SpecVersion): ConformanceCheck {\n return {\n id: AUTH_STOP_CHECK_ID,\n name: 'AuthStop',\n description: `The auth layer turned away a request that presented an access token`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: { served }\n };\n}\n\n/**\n * Whether the client signed in at the cell and was then stopped by the\n * auth layer (authLayerStop()): the marker, and a token request to the\n * cell's own authorization server in the scenario's log. Such a cell was\n * reached at its revision whatever revision the stopped request carried:\n * a dual-era client that opens with `server/discover` and correctly stops\n * after 403 insufficient_scope has done what the scenario tests.\n */\nexport function signedInAuthStop(\n hostedLog: readonly ConformanceCheck[],\n scenarioLog: readonly ConformanceCheck[]\n): boolean {\n return (\n hostedLog.some((c) => c.id === AUTH_STOP_CHECK_ID) &&\n scenarioLog.some((c) => c.id === 'token-request')\n );\n}\n\nexport const REVISION_NOT_SPOKEN_CHECK_ID = 'hosted-revision-not-spoken';\n\n/**\n * Said on a cell whose checks would otherwise pass but where no request at\n * its revision was ever accepted (an OAuth flow completed, then the client\n * spoke only another revision, or nothing): it has not been tested yet.\n */\nexport function revisionNotSpokenCheck(\n served: SpecVersion,\n timestamp: string\n): ConformanceCheck {\n return {\n id: REVISION_NOT_SPOKEN_CHECK_ID,\n name: 'RevisionNotSpoken',\n description:\n `The client never spoke ${served} here: no MCP request at ${served} was accepted, ` +\n 'so the checks recorded so far cannot make this cell pass',\n status: 'INFO',\n timestamp,\n details: { served }\n };\n}\n\n/**\n * The cell's answer to a request at a revision it does not serve, or\n * undefined when the response is not one: a 4xx lifecycle rejection (see\n * wireRejection()) or -32601 method-not-found. Either tells a probing\n * client to fall back; a 401 does not (it says to sign in first, and the\n * probe is repeated with a token).\n */\nexport function versionAnswer(\n served: SpecVersion,\n headerVersion: string | undefined,\n response: CapturedResponse\n): Refusal | undefined {\n const rejection = wireRejection(response, served, headerVersion);\n if (rejection) return rejection;\n if (response.status < 400 || response.status >= 500) return undefined;\n for (const m of jsonRpcMessages(response.body, response.contentType)) {\n const error = asRecord(m.error);\n if (error?.code === -32601)\n return {\n status: response.status,\n code: -32601,\n message: str(error.message) ?? ''\n };\n }\n return undefined;\n}\n\n/**\n * How `response` turned a request away, for a modern probe's details: its\n * status and the JSON-RPC error it carried, if any (a 401's OAuth body\n * carries none).\n */\nexport function refusalOf(response: CapturedResponse): Refusal {\n for (const m of jsonRpcMessages(response.body, response.contentType)) {\n const error = asRecord(m.error);\n if (error && typeof error.code === 'number')\n return {\n status: response.status,\n code: error.code,\n message: str(error.message) ?? ''\n };\n }\n return { status: response.status };\n}\n\n/**\n * Whether the exchange was an accepted `initialize`: the cell negotiated a\n * revision with the client, so every later request's header has had its\n * answer.\n */\nexport function isAcceptedInitialize(\n request: RequestInfo,\n response: CapturedResponse\n): boolean {\n if (!request.methods.includes('initialize')) return false;\n if (response.status < 200 || response.status >= 300) return false;\n return jsonRpcMessages(response.body, response.contentType).some(\n (m) => asRecord(m.result) !== undefined\n );\n}\n\nexport const VERSION_OFFERED_CHECK_ID = 'hosted-version-offered';\n\n/** The `protocolVersion` field of a JSON-RPC result, as it is on the wire. */\nconst PROTOCOL_VERSION_FIELD = /(\"protocolVersion\"\\s*:\\s*\")([^\"\\\\]*)(\")/;\n\n/**\n * Make the `initialize` result a dated cell sends state the cell's revision\n * `served`, whatever the scenario negotiated. A cell tests exactly its\n * column's revision, but the bundled servers echo any version they support\n * (the SDK's, 2025-06-18 among them; the raw `initialize` scenario's), and a\n * client that then speaks the version it was given would be failed for it.\n * Told `served`, a client that cannot speak it declines, as the lifecycle\n * says it should. Wraps `res.write`/`res.end` and rewrites the first\n * `\"protocolVersion\":\"…\"` of a 2xx response once `isInitialize()` says the\n * request was one (the scenario has read the body by the time it answers).\n * Bytes are rewritten in place (latin1 keeps them 1:1), and a declared\n * Content-Length not yet sent is kept right. Hosted only: the CLI runner\n * still sees what the scenario answers.\n */\nexport function pinInitializeVersion(\n res: ServerResponse,\n served: SpecVersion,\n isInitialize: () => boolean\n): void {\n let pinned = false;\n const rewrite = (chunk: unknown): unknown => {\n if (pinned || res.statusCode < 200 || res.statusCode >= 300) return chunk;\n const bytes = Buffer.isBuffer(chunk) || chunk instanceof Uint8Array;\n if (!bytes && typeof chunk !== 'string') return chunk;\n if (!isInitialize()) return chunk;\n const text = bytes ? Buffer.from(chunk).toString('latin1') : chunk;\n const match = PROTOCOL_VERSION_FIELD.exec(text);\n if (!match) return chunk;\n pinned = true;\n if (match[2] === served) return chunk;\n const out =\n text.slice(0, match.index) +\n match[1] +\n served +\n match[3] +\n text.slice(match.index + match[0].length);\n const delta = served.length - match[2].length;\n const declared = res.getHeader('content-length');\n if (delta !== 0 && !res.headersSent && declared !== undefined)\n res.setHeader('content-length', String(Number(declared) + delta));\n return bytes ? Buffer.from(out, 'latin1') : out;\n };\n const write = res.write;\n const end = res.end;\n res.write = function (this: ServerResponse, ...args: unknown[]) {\n args[0] = rewrite(args[0]);\n return (write as (...a: unknown[]) => boolean).apply(this, args);\n } as ServerResponse['write'];\n res.end = function (this: ServerResponse, ...args: unknown[]) {\n if (typeof args[0] !== 'function') args[0] = rewrite(args[0]);\n return (end as (...a: unknown[]) => ServerResponse).apply(this, args);\n } as ServerResponse['end'];\n}\n\n/** The `protocolVersion` an accepted `initialize` answered with, if any. */\nexport function answeredVersion(\n response: CapturedResponse\n): string | undefined {\n if (response.status < 200 || response.status >= 300) return undefined;\n for (const m of jsonRpcMessages(response.body, response.contentType)) {\n const version = str(asRecord(m.result)?.protocolVersion);\n if (version) return version;\n }\n return undefined;\n}\n\n/**\n * The client's `initialize` asked a dated cell for a revision other than the\n * one it serves, and was told the cell's (see pinInitializeVersion()). Noted\n * so the results page can explain a client that then declined or went quiet;\n * one that carries on at the version it asked for is at the wrong revision.\n */\nexport function versionOfferedCheck(\n served: SpecVersion,\n requestedVersion: string,\n answered: string | undefined\n): ConformanceCheck {\n return {\n id: VERSION_OFFERED_CHECK_ID,\n name: 'VersionOffered',\n description:\n `The client asked for ${requestedVersion} in initialize; this cell tests ${served} only, ` +\n `so it answered ${answered ?? served}. A client that cannot speak ${served} may disconnect; ` +\n `one that carries on at ${requestedVersion} is at the wrong revision`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n served,\n requestedVersion,\n ...(answered && { answeredVersion: answered })\n }\n };\n}\n\n/**\n * `version` is the revision the probe asked for (its header, else its\n * `_meta`); `refusal` is how the cell turned it away.\n */\nexport function modernProbeCheck(\n served: SpecVersion,\n method: string | undefined,\n version: string | undefined,\n refusal: Refusal\n): ConformanceCheck {\n const asked = version ? `asked for ${version}` : 'probed';\n return {\n id: MODERN_PROBE_CHECK_ID,\n name: 'ModernProbe',\n description:\n `The client ${asked}${method ? ` with ${method}` : ''} on a cell served on ${served}, ` +\n `and the cell answered ${refusalText(refusal)}. ` +\n `That is version negotiation, not a failure, however often the client repeats it: ` +\n `the client is judged on the requests it makes at ${served}`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n served,\n ...(method && { method }),\n headerVersion: version ?? null,\n rejected: { ...refusal }\n }\n };\n}\n\nfunction refusalText(r: Refusal): string {\n if (r.code === undefined) {\n return r.status === 401\n ? 'HTTP 401, asking the client to sign in first'\n : `HTTP ${r.status}`;\n }\n return `HTTP ${r.status}, JSON-RPC error ${r.code}${r.message ? `: ${r.message}` : ''}`;\n}\n\n/**\n * Why a request is not one the cell's revision `served` should receive, or\n * undefined when it is. On the stateless wire every request must carry the\n * cell's revision in the header and `initialize` does not exist; on a dated\n * (stateful) revision `initialize` negotiates and is exempt, and every later\n * request's header, when present, must name the cell's revision — unless\n * it was a modern probe (isModernProbe()), which the caller decides from\n * the request and the response.\n */\nexport function wrongRevision(\n served: SpecVersion,\n method: string,\n headerVersion: string | undefined\n): string | undefined {\n if (isStatefulVersion(served)) {\n if (method === 'initialize') return undefined;\n if (headerVersion !== undefined && headerVersion !== served)\n return `sent ${headerVersion}`;\n return undefined;\n }\n if (method === 'initialize') return 'sent initialize';\n if (headerVersion !== served)\n return headerVersion === undefined\n ? 'sent no MCP-Protocol-Version header'\n : `sent ${headerVersion}`;\n return undefined;\n}\n\nexport const LEGACY_PROBE_CHECK_ID = 'hosted-legacy-probe';\n\n/**\n * Whether `method` on a cell served at `served` is a legacy probe: an\n * `initialize` on the stateless wire. A dual-era client may open that way to\n * learn the server's era, and a modern-only server answers it with an error\n * naming its versions (2026-07-28 basic/versioning, \"Backward Compatibility\n * with Initialization-Based Versions\"), so it is negotiation, not a wrong\n * revision — and it explains any rejection it drew.\n */\nexport function isLegacyProbe(served: SpecVersion, method: string): boolean {\n return method === 'initialize' && !isStatefulVersion(served);\n}\n\n/**\n * The answer every cell on the stateless wire gives a legacy `initialize`,\n * or undefined when `body` is not one (or the cell is on a dated revision):\n * HTTP 400 with -32022 naming the revision the cell serves, as a modern-only\n * server should (2026-07-28 basic/versioning). The hosted layer sends it\n * before the scenario sees the request, so every cell of the column agrees —\n * a scenario whose bundled SDK server would complete the handshake (the CLI\n * runner's SDK clients rely on json-schema-ref-no-deref doing so) cannot\n * accept it here and then fail the client for following that answer.\n */\nexport function legacyInitializeReply(\n served: SpecVersion,\n body: Buffer | undefined,\n headerVersion: string | undefined\n): { status: number; body: Record } | undefined {\n if (isStatefulVersion(served) || body === undefined) return undefined;\n let message: Record | undefined;\n try {\n message = asRecord(JSON.parse(body.toString()));\n } catch {\n return undefined;\n }\n if (message?.method !== 'initialize') return undefined;\n const params = asRecord(message.params);\n return {\n status: 400,\n body: {\n jsonrpc: '2.0',\n id: message.id ?? null,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [served],\n requested: String(params?.protocolVersion ?? headerVersion ?? '')\n }\n }\n }\n };\n}\n\n/**\n * What the cell answered a legacy `initialize`, for its note: its version\n * answer (a -32022 naming the revisions it serves), another refusal (the\n * 401 an auth cell answers before it looks at the protocol), or undefined\n * when it accepted the request.\n */\nexport function legacyAnswer(\n served: SpecVersion,\n response: CapturedResponse\n): Refusal | undefined {\n if (response.status < 400) return undefined;\n // Looked up without the header: a -32022 to an initialize that happened\n // to name the cell's revision is still the answer.\n return wireRejection(response, served, undefined) ?? refusalOf(response);\n}\n\nexport function legacyProbeCheck(\n served: SpecVersion,\n headerVersion: string | undefined,\n answer?: Refusal,\n requestedVersion?: string\n): ConformanceCheck {\n return {\n id: LEGACY_PROBE_CHECK_ID,\n name: 'LegacyProbe',\n description:\n `The client opened with initialize, the legacy handshake, on a cell served on ${served}. ` +\n 'On this revision that is era detection, not a failure' +\n (answer\n ? `; the cell answered ${refusalText(answer)}`\n : '; the cell accepted it'),\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n served,\n headerVersion: headerVersion ?? null,\n ...(requestedVersion && { requestedVersion }),\n ...(answer && { rejected: { ...answer } })\n }\n };\n}\n\nexport const GET_ON_MCP_CHECK_ID = 'hosted-get-on-mcp-path';\n\n/**\n * The 405 a cell answers a GET on its MCP endpoint with when its scenario\n * serves no GET stream there, shaped like the SDK transport's own.\n */\nexport const GET_ON_MCP_REPLY = {\n jsonrpc: '2.0',\n error: { code: -32000, message: 'Method not allowed.' },\n id: null\n} as const;\n\n/**\n * A GET to the MCP endpoint of a cell that serves no stream there: a client\n * opening a standalone SSE stream, or falling back to the old HTTP+SSE\n * transport after a POST was turned away. Noted so the client's author sees\n * it; the spec allows either, so it never decides the verdict.\n */\nexport function getOnMcpCheck(served: SpecVersion): ConformanceCheck {\n return {\n id: GET_ON_MCP_CHECK_ID,\n name: 'GetOnMcpPath',\n description:\n 'The client sent GET to the MCP endpoint — to open a server-sent event stream, ' +\n 'or to fall back to the old HTTP+SSE transport after a POST was turned away. ' +\n 'This cell serves no such stream, so it answered 405 Method Not Allowed; ' +\n 'a client should carry on with POST',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: { served, status: 405 }\n };\n}\n\nexport function wireRejectedCheck(\n rejection: WireRejection,\n request: RequestInfo,\n headerVersion: string | undefined\n): ConformanceCheck {\n const method = request.methods[0];\n return {\n id: WIRE_REJECTED_CHECK_ID,\n name: 'WireRejected',\n description:\n 'The cell turned a request away before the scenario could judge it',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `${response(rejection)}${method ? ` to ${method}` : ''}: ${rejection.message}`,\n details: {\n status: rejection.status,\n code: rejection.code,\n message: rejection.message,\n ...(method && { method }),\n requestedVersion: headerVersion ?? request.bodyVersion ?? null\n }\n };\n}\n\nfunction response(r: WireRejection): string {\n return `HTTP ${r.status}, JSON-RPC error ${r.code}`;\n}\n\n/**\n * `rejection` is the wire turning the same request away: one mistake, so it\n * is folded into this check rather than recorded as hosted-wire-rejected too.\n */\nexport function wrongRevisionCheck(\n served: SpecVersion,\n method: string,\n headerVersion: string | undefined,\n reason: string,\n rejection?: WireRejection\n): ConformanceCheck {\n return {\n id: WRONG_REVISION_CHECK_ID,\n name: 'WrongRevision',\n description: `The client spoke a revision other than the one this cell is served on`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `cell is served on ${served}; client ${reason}` +\n (rejection\n ? ` (turned away: ${response(rejection)}: ${rejection.message})`\n : ''),\n details: {\n served,\n method,\n headerVersion: headerVersion ?? null,\n ...(rejection && {\n rejected: {\n status: rejection.status,\n code: rejection.code,\n message: rejection.message\n }\n })\n }\n };\n}\n","deleted",false,"label",[47,48,24],"src","hosted","7dcb6042-d92f-40c5-9cc8-0f661f96e58b",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":-5},"org",{"_9":10,"_99":100,"_101":-5,"_58":-5,"_102":103,"_104":44},"branch",{"_37":89,"_11":90,"_22":30,"_91":49,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":44,"_146":44,"_147":44,"_148":34,"_149":-5,"_150":-7,"_151":-7,"_152":66,"_153":44,"_154":44,"_155":-5,"_156":44,"_157":44,"_158":44,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":90,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]