[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_182":183,"_184":185},"routes/_app.x.$handle.$name",{"_97":96,"_32":46,"_105":87,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":59,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","examples/hosted/valtown-relay.ts","latestPath","fileId","e756c5a2-ad13-11f1-892b-1607ee4eb77e","name","valtown-relay.ts","fileType","script","content","/**\n * MCP conformance — auxiliary-origin relay (val.town).\n *\n * The hosted RS app owns all scenario state, but auth scenarios need a second\n * public origin so OAuth `.well-known/*` discovery and issuer validation work\n * (those are origin-rooted by RFC 8414/9728 — they can't live under the\n * `/s///` prefix). This val IS that origin: it forwards\n * every request to the RS app's `/__aux//*` backchannel and adds a\n * shared secret so the backchannel can't be spoofed by hitting the RS\n * directly.\n *\n * One val per role: deploy this once for `as`, and again for `as2` / `idp`\n * if you need the three-origin scenarios (authorization-server-migration,\n * enterprise-managed-authorization).\n *\n * val.town env (Project → Settings → Environment variables):\n * CONFORMANCE_RS_ORIGIN https://.val.run\n * CONFORMANCE_RELAY_SECRET \n * CONFORMANCE_RELAY_ROLE as | as2 | idp (default: as)\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown-relay.ts\";\n * export default handler;\n *\n * No scenario logic lives here, so you only redeploy this when the relay\n * contract changes — adding/editing scenarios only touches the RS val.\n */\n\ndeclare const process: { env: Record };\n\nconst RS_ORIGIN = process.env.CONFORMANCE_RS_ORIGIN;\nconst RELAY_SECRET = process.env.CONFORMANCE_RELAY_SECRET;\nconst ROLE = process.env.CONFORMANCE_RELAY_ROLE ?? 'as';\n\n/**\n * Headers we forward from the client. Everything else is dropped so a client\n * can't smuggle x-relay-secret / x-forwarded-* through us, and so the\n * upstream sees a stable shape regardless of what the edge added.\n */\nconst FORWARD_HEADERS = [\n 'accept',\n 'authorization',\n 'content-type',\n 'content-length',\n 'user-agent'\n] as const;\n\nexport default async function handler(req: Request): Promise {\n if (!RS_ORIGIN || !RELAY_SECRET) {\n return Response.json(\n {\n error:\n 'relay misconfigured: set CONFORMANCE_RS_ORIGIN and CONFORMANCE_RELAY_SECRET'\n },\n { status: 500 }\n );\n }\n\n const url = new URL(req.url);\n const target = `${RS_ORIGIN}/__aux/${ROLE}${url.pathname}${url.search}`;\n\n const headers = new Headers();\n for (const h of FORWARD_HEADERS) {\n const v = req.headers.get(h);\n if (v) headers.set(h, v);\n }\n headers.set('x-relay-secret', RELAY_SECRET);\n // The aux handler reconstructs absolute URLs (issuer, endpoints) from\n // getAuxBaseUrl() which the RS app already knows, so it doesn't strictly\n // need this — but it's useful for logging/debugging on the RS side.\n headers.set('x-relay-host', url.host);\n\n const upstream = await fetch(target, {\n method: req.method,\n headers,\n body:\n req.method === 'GET' || req.method === 'HEAD'\n ? undefined\n : await req.arrayBuffer(),\n // /authorize 302s to the client's redirect_uri — pass it through, don't\n // follow it ourselves.\n redirect: 'manual'\n });\n\n // Strip hop-by-hop / origin-identifying headers; pass everything else.\n const outHeaders = new Headers(upstream.headers);\n for (const h of ['content-encoding', 'transfer-encoding', 'connection']) {\n outHeaders.delete(h);\n }\n return new Response(upstream.body, {\n status: upstream.status,\n headers: outHeaders\n });\n}\n","/**\n * MCP conformance — auxiliary-origin relay (val.town).\n *\n * The hosted RS app owns all scenario state, but auth scenarios need a second\n * public origin so OAuth `.well-known/*` discovery and issuer validation work\n * (those are origin-rooted by RFC 8414/9728 — they can't live under the\n * `/s///` prefix). This val IS that origin: it forwards\n * every request to the RS app's `/__aux//*` backchannel and adds a\n * shared secret so the backchannel can't be spoofed by hitting the RS\n * directly.\n *\n * One val per role: deploy this once for `as`, and again for `as2` / `idp`\n * if you need the three-origin scenarios (authorization-server-migration,\n * enterprise-managed-authorization).\n *\n * val.town env (Project → Settings → Environment variables):\n * CONFORMANCE_RS_ORIGIN https://.val.run\n * CONFORMANCE_RELAY_SECRET \n * CONFORMANCE_RELAY_ROLE as | as2 | idp (default: as)\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown-relay.ts\";\n * export default handler;\n *\n * No scenario logic lives here, so you only redeploy this when the relay\n * contract changes — adding/editing scenarios only touches the RS val.\n */\n\ndeclare const process: { env: Record };\n\nconst RS_ORIGIN = process.env.CONFORMANCE_RS_ORIGIN;\nconst RELAY_SECRET = process.env.CONFORMANCE_RELAY_SECRET;\nconst ROLE = process.env.CONFORMANCE_RELAY_ROLE ?? 'as';\n\n/**\n * Headers we forward from the client. Everything else is dropped so a client\n * can't smuggle x-relay-secret / x-forwarded-* through us, and so the\n * upstream sees a stable shape regardless of what the edge added.\n */\nconst FORWARD_HEADERS = [\n 'accept',\n 'authorization',\n 'content-type',\n 'content-length',\n 'user-agent'\n] as const;\n\nexport default async function handler(req: Request): Promise {\n if (!RS_ORIGIN || !RELAY_SECRET) {\n return Response.json(\n {\n error:\n 'relay misconfigured: set CONFORMANCE_RS_ORIGIN and CONFORMANCE_RELAY_SECRET'\n },\n { status: 500 }\n );\n }\n\n const url = new URL(req.url);\n const target = `${RS_ORIGIN}/__aux/${ROLE}${url.pathname}${url.search}`;\n\n const headers = new Headers();\n for (const h of FORWARD_HEADERS) {\n const v = req.headers.get(h);\n if (v) headers.set(h, v);\n }\n headers.set('x-relay-secret', RELAY_SECRET);\n // Don't invite the RS edge to compress: the bytes are re-framed below anyway.\n headers.set('accept-encoding', 'identity');\n // The aux handler reconstructs absolute URLs (issuer, endpoints) from\n // getAuxBaseUrl() which the RS app already knows, so it doesn't strictly\n // need this — but it's useful for logging/debugging on the RS side.\n headers.set('x-relay-host', url.host);\n\n const upstream = await fetch(target, {\n method: req.method,\n headers,\n body:\n req.method === 'GET' || req.method === 'HEAD'\n ? undefined\n : await req.arrayBuffer(),\n // /authorize 302s to the client's redirect_uri — pass it through, don't\n // follow it ourselves.\n redirect: 'manual'\n });\n\n // fetch() transparently decompresses a gzip/br upstream body but leaves the\n // upstream's content-length (the *compressed* size) in place. Forwarding\n // that header with the decompressed bytes makes the client truncate the\n // body (\"Unterminated string in JSON at position N\" on AS metadata). So:\n // buffer the body, drop every framing/encoding header, and let the runtime\n // derive content-length from the bytes we actually send.\n const body = await upstream.arrayBuffer();\n const outHeaders = new Headers(upstream.headers);\n for (const h of [\n 'content-encoding',\n 'content-length',\n 'transfer-encoding',\n 'connection'\n ]) {\n outHeaders.delete(h);\n }\n return new Response(body.byteLength ? body : null, {\n status: upstream.status,\n headers: outHeaders\n });\n}\n","createdAt",["D",1789047277233],"branchVersion","branchId","005ad84e-85a0-4b82-bb6a-620a6d7d952f","id","ec6df808-1fce-4b69-884e-7fe2708988ac","mcp-client-conformance-as",["D",1789043641702],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e78f28a2-ad13-11f1-a016-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":-5},"org",{"_97":96,"_98":99,"_100":-5,"_18":-5,"_101":102,"_103":25},"branch",{"_13":86,"_32":87,"_44":43,"_88":45,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":46,"_95":96},"isOwned",4,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mcpconformance","handle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":178,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":179,"_81":180,"_83":181,"_85":25},"tree",[157,160],"files",[157,158,159,160],"counts",{"_147":63,"_148":143,"_149":63,"_150":151,"_152":153},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":140,"_32":141,"_30":142,"_131":-5,"_42":43,"_41":143,"_133":59,"_39":144,"_13":63,"_34":145,"_36":-5,"_24":25,"_137":-5,"_27":146},{"_44":129,"_32":130,"_30":57,"_131":-5,"_42":43,"_41":132,"_133":59,"_39":134,"_13":63,"_34":135,"_36":136,"_24":25,"_137":138,"_27":139},"01296084-809f-49d4-bc5b-bacbb1642a4c","http.ts","parentId",2,"latest",["D",1789043642597],"http","export { default } from './examples/hosted/valtown-relay.ts';\n","label","mcp-c9e-auth",[130],"0f04efc4-7cfc-4d35-8fb3-ec78c7eee7fb","examples","9f5ac879-e2a8-41ac-86a6-9707c802b288",1,["D",1789043642196],"directory",[141],"pulls","branches","forks","envVars",{"_154":14,"_156":63},"connections",{"_154":63,"_155":63},"count","unfilledCount","emptyCount",{"_44":140,"_32":141,"_30":142,"_131":-5,"_42":43,"_41":143,"_133":59,"_39":175,"_13":63,"_34":145,"_36":-5,"_24":25,"_137":-5,"_162":176,"_27":177},{"_44":171,"_32":170,"_30":166,"_131":142,"_42":43,"_41":143,"_133":59,"_39":172,"_13":63,"_34":145,"_36":-5,"_24":25,"_137":-5,"_162":173,"_27":174},{"_44":165,"_32":33,"_30":31,"_131":166,"_42":43,"_41":14,"_133":25,"_39":167,"_13":143,"_34":35,"_36":38,"_24":25,"_137":-5,"_162":168,"_27":169},{"_44":129,"_32":130,"_30":57,"_131":-5,"_42":43,"_41":132,"_133":59,"_39":161,"_13":63,"_34":135,"_36":136,"_24":25,"_137":138,"_162":163,"_27":164},["D",1789043642597],"children",[],[130],"6ab5d04d-da23-4a6e-b74f-fd321a99631a","c78bba3d-3444-467f-8cae-fd128b05965d",["D",1789047277233],[],[141,170,33],"hosted","f6076cf1-ce14-439e-8f29-092e23a9dc12",["D",1789043642196],[159],[141,170],["D",1789043642196],[158],[141],["D",1789043641702],{"_97":96,"_104":-5},{"_97":96,"_98":99,"_100":-5,"_18":-5,"_101":102,"_103":25},{"_13":86,"_32":87,"_44":43,"_88":45,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":46,"_95":96},"ctx",{"_79":-5,"_124":215,"_216":217,"_218":219,"_220":25,"_221":25,"_222":25,"_223":59,"_224":-5,"_225":-7,"_226":-7,"_227":63,"_228":25,"_229":25,"_230":-5,"_231":25,"_232":25,"_233":25,"_234":-5},"ENV",{"_186":187,"_188":189,"_190":87,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3