[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_216":217,"_218":219},"routes/_app.x.$handle.$name",{"_107":106,"_33":56,"_115":97,"_28":116,"_13":14,"_117":-5,"_11":118,"_119":120,"_121":122,"_123":124,"_125":126,"_22":-5,"_127":-5,"_128":-5,"_129":26,"_130":131,"_132":26,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_54":55,"_33":56,"_39":57,"_58":-5,"_59":26,"_60":61,"_62":61,"_63":-5,"_64":-5,"_18":65,"_66":67,"_68":69,"_70":-5,"_71":-5,"_72":73,"_74":75,"_76":-5,"_77":-5,"_78":-5,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":90,"_91":92,"_93":94,"_95":26},"version",4,"changes",[19,20,21],"aiChatInfo","userId",{"_22":49,"_24":-7,"_25":26,"_27":26,"_28":50,"_30":50},{"_22":44,"_24":-7,"_25":26,"_27":26,"_28":45,"_30":45},{"_22":23,"_24":-7,"_25":26,"_27":26,"_28":29,"_30":29},"file",{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":14,"_42":43,"_25":26},"previous","deleted",false,"deletedHere","path","src/hosted/server.ts","latestPath","fileId","d2f92186-ad13-11f1-b27a-1607ee4eb77e","name","server.ts","fileType","script","content","/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * URL scheme (run-id is path-embedded so stateless-transport clients work):\n *\n * ALL /s//[/] Mounted scenario handler. The run\n * is created lazily on first hit;\n * pick any you like.\n * GET /s/ Convenience: mints a fresh run-id\n * and returns {mcpUrl, resultsUrl}.\n * GET /results/ JSON {summary, checks}\n * GET /results/.html Pretty HTML report\n * GET /scenarios JSON list of hostable scenarios\n * GET / Landing page\n * POST /mcp Meta-MCP: list_scenarios,\n * start_run, get_results\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each run gets a fresh Scenario instance.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { ServerResponse } from 'node:http';\nimport { timingSafeEqual } from 'node:crypto';\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n CallToolResult\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport {\n SessionManager,\n HostedRun,\n UnknownScenarioError,\n NotHostableError,\n listHostableScenarios\n} from './session.ts';\nimport { renderLanding, renderResults } from './html.ts';\nimport type { RunStore } from './store.ts';\nimport { getScenario } from '../scenarios/index.ts';\nimport {\n ConformanceCheck,\n AuxOriginRole,\n AuthHandlerScenario,\n RequestListener,\n Scenario\n} from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become hostable; their per-run AS issuer is\n * `/r/`. See examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n /**\n * Persist runs so a deployment that load-balances one run's requests\n * across processes (serverless isolates) still serves complete results.\n * See ./store.ts. Omit for a single long-lived process.\n */\n store?: RunStore;\n}\n\n/** Only allow run-ids that are safe in a single path segment. */\nconst RUN_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\n// ---------------------------------------------------------------------------\n// Stateless (\"/x\") mounting support.\n//\n// /x/ mounts a scenario with NO run-id and NO results polling: a\n// fresh scenario instance judges each request on its own content, and if the\n// request itself violates a conformance requirement the response is replaced\n// with a 400 explaining which checks failed. This only behaves sensibly for\n// scenarios whose checks are per-request (no cross-request memory) — which\n// is also exactly what serverless hosts with multiple isolates can support.\n// ---------------------------------------------------------------------------\n\n/** Scenarios whose checks need cross-request or timing state — excluded. */\nconst NOT_STATELESS = new Set(['sse-retry']);\n\n/**\n * The aux relay correlates flows by a /r/ in the path. In stateless\n * mode that segment encodes the scenario name instead of a run-id\n * ('auth/metadata-default' → 'x--auth--metadata-default'); run-ids can't\n * collide with it because '--' never appears in minted ids and the prefix is\n * reserved.\n */\nconst STATELESS_SLUG_PREFIX = 'x--';\nfunction statelessSlug(scenarioName: string): string {\n return STATELESS_SLUG_PREFIX + scenarioName.split('/').join('--');\n}\nfunction decodeStatelessSlug(segment: string): string | undefined {\n if (!segment.startsWith(STATELESS_SLUG_PREFIX)) return undefined;\n return segment.slice(STATELESS_SLUG_PREFIX.length).split('--').join('/');\n}\n\ninterface CapturedResponse {\n status: number;\n headers: Record;\n body: Buffer;\n}\n\n/**\n * Run a scenario listener against a buffered response so the outcome can be\n * judged (and replaced) after the handler finishes. Same interception\n * surface the valtown bridge uses: writeHead/setHeader/write/end and the\n * statusCode property — everything express and the SDK transport touch.\n */\nfunction runCaptured(\n listener: RequestListener,\n req: Request,\n rewrittenUrl: string\n): Promise {\n return new Promise((resolve, reject) => {\n const headers: Record = {};\n const chunks: Buffer[] = [];\n let status = 200;\n\n const fake = new ServerResponse(req) as ServerResponse;\n const captureHeaders = (\n h?: Record\n ): void => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n }\n };\n fake.setHeader = ((k: string, v: string | string[] | number) => {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n return fake;\n }) as ServerResponse['setHeader'];\n fake.getHeader = (k: string) => headers[k.toLowerCase()];\n fake.removeHeader = (k: string) => {\n delete headers[k.toLowerCase()];\n };\n fake.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return fake;\n }) as ServerResponse['writeHead'];\n fake.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n fake.flushHeaders = () => {};\n Object.defineProperty(fake, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n fake.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve({ status, headers, body: Buffer.concat(chunks) });\n return fake;\n }) as ServerResponse['end'];\n\n req.url = rewrittenUrl;\n try {\n listener(req, fake);\n } catch (e) {\n reject(e instanceof Error ? e : new Error(String(e)));\n }\n });\n}\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({\n ttlMs: opts.ttlMs,\n auxOrigins,\n store: opts.store\n });\n const app = express();\n const hostable = new Set(listHostableScenarios(haveAux));\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n function runBaseUrl(req: Request, scenario: string, runId: string): string {\n return `${origin(req)}/s/${scenario}/${runId}`;\n }\n\n /**\n * Resolve \"//\" against the hostable set.\n * Scenario names may contain '/', so try progressively longer prefixes.\n * Returns undefined if no hostable scenario matches the prefix.\n */\n function resolveRun(rest: string):\n | {\n scenarioName: string;\n runId: string | undefined;\n suffix: string;\n }\n | undefined {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate)) {\n const runId = segments[i] || undefined;\n const suffix = '/' + segments.slice(i + 1).join('/');\n return { scenarioName: candidate, runId, suffix };\n }\n }\n return undefined;\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the run-prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string\n ) {\n res.setHeader(\n 'link',\n `<${origin(req)}/results/${run.id}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n if (sessions.store) {\n // Write this process's view through once the scenario has answered\n // (hosted scenarios record their checks before calling end()).\n // Serverless entry points should await sessions.flush() before\n // returning the response so this write isn't abandoned.\n const end = res.end;\n res.end = function (this: Response, ...args: unknown[]) {\n const out = (end as (...a: unknown[]) => Response).apply(this, args);\n void sessions.persist(run);\n return out;\n } as Response['end'];\n }\n listener(req, res);\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res\n .type('html')\n .send(\n renderLanding(\n origin(req),\n Array.from(hostable),\n (name) => getScenario(name)?.steps\n )\n );\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n Array.from(hostable).map((name) => {\n const s = getScenario(name)!;\n return {\n name,\n description: s.description,\n source: s.source,\n mcpPath: s.mcpPath ?? '',\n ...(s.steps && { steps: s.steps })\n };\n })\n );\n });\n\n // ---------- scenario mounting ----------\n //\n // We can't pre-register an express route per (scenario, run-id) because\n // run-ids are open-ended. Instead a single catch-all route resolves the\n // run, rewrites req.url to strip the /s// prefix, and hands\n // off to the run's listener — exactly what app.use(prefix, fn) would do,\n // but with a dynamic prefix.\n\n app.all(/^\\/s\\/(.+)$/, (req, res, next) => {\n const rest = req.params[0]; // \"//\"\n const resolved = resolveRun(rest);\n if (!resolved) {\n // Distinguish \"exists but not hostable\" from \"unknown\"\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n if (getScenario(segments.slice(0, i).join('/'))) {\n res.status(501).json({\n error: `scenario '${segments.slice(0, i).join('/')}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, runId, suffix } = resolved;\n\n // GET /s/ with no run-id → mint one and tell the caller where\n // to point their client.\n if (!runId) {\n if (req.method !== 'GET') {\n res.status(400).json({\n error:\n 'Missing run-id. Use /s//, or GET /s/ to mint one.'\n });\n return;\n }\n try {\n const run = sessions.getOrCreate(scenarioName, undefined, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n res.json({\n runId: run.id,\n mcpUrl: `${runBaseUrl(req, scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${origin(req)}/results/${run.id}`,\n resultsHtmlUrl: `${origin(req)}/results/${run.id}.html`,\n context: contextFor(run)\n });\n } catch (e) {\n next(e);\n }\n return;\n }\n\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n\n let run;\n try {\n run = sessions.getOrCreate(scenarioName, runId, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n dispatch(\n run,\n run.listener,\n req,\n res,\n suffix === '/' ? run.mcpPath || '/' : suffix\n );\n });\n\n // ---------- stateless mounting (no run-id, fail-fast) ----------\n //\n // /x/[/] judges every request on its own content with a\n // fresh scenario instance. A request that records a FAILURE check gets a\n // 400 explaining what went wrong instead of the scenario's response — the\n // client-under-test finds out immediately, no results polling, no mint.\n\n interface StatelessInstance {\n scenario: Scenario;\n listener: RequestListener;\n auxListeners?: Partial>;\n mcpPath: string;\n }\n\n function instantiateStateless(\n scenarioName: string,\n baseUrl: string\n ): StatelessInstance {\n const proto = getScenario(scenarioName);\n if (!proto) throw new UnknownScenarioError(scenarioName);\n const Ctor = proto.constructor as new () => Scenario;\n const scenario = new Ctor();\n\n if (scenario instanceof AuthHandlerScenario) {\n const missing = scenario.auxRoles.filter((r) => !auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n scenarioName,\n `needs aux origin(s) [${missing.join(', ')}] — start with --as-origin`\n );\n }\n const handlers = scenario.authHandlers({\n getRsBaseUrl: () => baseUrl,\n getAuxBaseUrl: (role) =>\n `${auxOrigins[role]}/r/${statelessSlug(scenarioName)}`\n });\n return {\n scenario,\n listener: handlers.rs,\n auxListeners: handlers.aux,\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n if (scenario.handler) {\n return {\n scenario,\n listener: scenario.handler(() => baseUrl),\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n throw new NotHostableError(scenarioName);\n }\n\n /**\n * Resolve \"/\" (no run-id segment) against the\n * hostable set, longest scenario-name prefix first.\n */\n function resolveStateless(\n rest: string\n ): { scenarioName: string; suffix: string } | undefined {\n const segments = rest.split('/');\n for (let i = segments.length; i >= 1; i--) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate) && !NOT_STATELESS.has(candidate)) {\n return {\n scenarioName: candidate,\n suffix: '/' + segments.slice(i).join('/')\n };\n }\n }\n return undefined;\n }\n\n /** Emit the captured response, or replace it with a 400 on FAILUREs. */\n function finishStateless(\n res: Response,\n scenario: Scenario,\n captured: CapturedResponse,\n scenarioName: string\n ): void {\n const checks = scenario.rawChecks?.() ?? scenario.getChecks();\n const failures = checks.filter((c) => c.status === 'FAILURE');\n if (failures.length > 0) {\n res.status(400).json({\n error: 'conformance failure',\n scenario: scenarioName,\n failures: failures.map(({ id, description, details }) => ({\n id,\n description,\n details\n }))\n });\n return;\n }\n for (const [k, v] of Object.entries(captured.headers)) {\n res.setHeader(k, v);\n }\n res.setHeader(\n 'mcp-conformance',\n `pass; checks=${checks.filter((c) => c.status === 'SUCCESS').length}`\n );\n res.status(captured.status);\n res.end(captured.body.length ? captured.body : undefined);\n }\n\n app.all(/^\\/x\\/(.+)$/, async (req, res) => {\n const rest = req.params[0];\n const resolved = resolveStateless(rest);\n if (!resolved) {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (NOT_STATELESS.has(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' needs cross-request state and cannot run stateless — use /s/${candidate}/`\n });\n return;\n }\n if (getScenario(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, suffix } = resolved;\n\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n scenarioName,\n `${origin(req)}/x/${scenarioName}`\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n const captured = await runCaptured(\n inst.listener,\n req,\n (suffix === '/' ? inst.mcpPath || '/' : suffix) + search\n );\n finishStateless(res, inst.scenario, captured, scenarioName);\n });\n\n // RFC 8414 root well-known for stateless mounts that embed their own AS\n // (path-based issuer /x//): metadata lives at\n // /.well-known//x//.\n app.get(\n /^\\/\\.well-known\\/(oauth-authorization-server|openid-configuration)\\/x\\/(.+)$/,\n async (req, res) => {\n const doc = req.params[0];\n const resolved = resolveStateless(req.params[1]);\n if (!resolved) {\n res.status(404).json({ error: 'no scenario for this issuer path' });\n return;\n }\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n resolved.scenarioName,\n `${origin(req)}/x/${resolved.scenarioName}`\n );\n } catch {\n res.status(404).json({ error: 'no scenario for this issuer path' });\n return;\n }\n const rewritten =\n `/.well-known/${doc}` +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n const captured = await runCaptured(inst.listener, req, rewritten);\n finishStateless(res, inst.scenario, captured, resolved.scenarioName);\n }\n );\n\n // RFC 9728 root well-known for stateless mounts: PRM URL for MCP URL\n // /x//mcp is /.well-known/oauth-protected-resource/x//mcp.\n app.get(\n /^\\/\\.well-known\\/oauth-protected-resource\\/x\\/(.+)$/,\n async (req, res) => {\n const resolved = resolveStateless(req.params[0]);\n if (!resolved) {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n resolved.scenarioName,\n `${origin(req)}/x/${resolved.scenarioName}`\n );\n } catch {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n const captured = await runCaptured(inst.listener, req, rewritten);\n finishStateless(res, inst.scenario, captured, resolved.scenarioName);\n }\n );\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s///mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s///mcp —\n // i.e. at the *origin root*, not under the run prefix. We catch that here,\n // recover (scenario, run-id) from the path suffix, and re-dispatch to the\n // run's RS handler with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the run prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(/^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/, (req, res) => {\n const resolved = resolveRun(req.params[0]);\n if (!resolved?.runId || !RUN_ID_RE.test(resolved.runId)) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // getOrCreate, not get: on a multi-process host this may be the first\n // request this process sees for the run.\n let run;\n try {\n run = sessions.getOrCreate(resolved.scenarioName, resolved.runId, (id) =>\n runBaseUrl(req, resolved.scenarioName, id)\n );\n } catch {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n dispatch(run, run.listener, req, res, rewritten);\n });\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-run AS issuer is\n // /r/, so every path the client hits — endpoints\n // (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We extract the id, strip that segment, and\n // dispatch to the run's aux handler so it sees exactly the path\n // createAuthServer registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, async (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n // Find /r/ anywhere in the path and excise it.\n const m = path.match(/^(.*?)\\/r\\/([A-Za-z0-9_-]{1,64})(\\/.*)?$/);\n if (!m) {\n res\n .status(404)\n .json({ error: 'aux request path missing /r/ segment' });\n return;\n }\n const [, prefix, runId, suffix = ''] = m;\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n\n // Stateless flows encode the scenario name (not a run-id) in the /r/\n // segment; per-flow OAuth state rides inside the artifacts themselves\n // (auth code, token), so a fresh instance per request is enough.\n const slugScenario = decodeStatelessSlug(runId);\n if (slugScenario !== undefined) {\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n slugScenario,\n `${origin(req)}/x/${slugScenario}`\n );\n } catch {\n res\n .status(404)\n .json({ error: `no stateless scenario '${slugScenario}'` });\n return;\n }\n const listener = inst.auxListeners?.[role];\n if (!listener) {\n res.status(404).json({ error: `no aux '${role}' handler` });\n return;\n }\n const captured = await runCaptured(\n listener,\n req,\n (prefix + suffix || '/') + search\n );\n finishStateless(res, inst.scenario, captured, slugScenario);\n return;\n }\n\n const run = await sessions.ensure(runId, (s, id) =>\n runBaseUrl(req, s, id)\n );\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for run` });\n return;\n }\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get('/results/:id.html', async (req, res) => {\n const r = await sessions.results(req.params.id);\n if (!r) {\n res\n .status(404)\n .type('html')\n .send(`

No run ${escapeId(req.params.id)}

`);\n return;\n }\n res\n .type('html')\n .send(renderResults(r.scenarioName, req.params.id, r.checks));\n });\n\n app.get('/results/:id', async (req, res) => {\n const r = await sessions.results(req.params.id);\n if (!r) {\n res.status(404).json({ error: 'unknown run' });\n return;\n }\n res.json(summarise(r.scenarioName, req.params.id, r.checks));\n });\n\n app.delete('/results/:id', async (req, res) => {\n await sessions.destroy(req.params.id);\n res.status(204).end();\n });\n\n // ---------- meta MCP server ----------\n\n app.post('/mcp', express.json(), async (req, res) => {\n const server = createMetaMcpServer(sessions, origin(req), (s, id) =>\n runBaseUrl(req, s, id)\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n transport.close();\n server.close();\n });\n });\n\n return { app, sessions };\n}\n\nfunction summarise(scenario: string, id: string, checks: ConformanceCheck[]) {\n const counts = { SUCCESS: 0, FAILURE: 0, WARNING: 0, SKIPPED: 0, INFO: 0 };\n for (const c of checks) counts[c.status]++;\n return {\n runId: id,\n scenario,\n summary: {\n passed: counts.SUCCESS,\n failed: counts.FAILURE,\n warnings: counts.WARNING,\n info: counts.INFO,\n skipped: counts.SKIPPED,\n total: checks.length\n },\n checks\n };\n}\n\nfunction createMetaMcpServer(\n sessions: SessionManager,\n publicOrigin: string,\n runBaseUrl: (scenario: string, runId: string) => string\n): Server {\n const server = new Server(\n { name: 'mcp-conformance-hosted', version: '0.2.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [\n {\n name: 'list_scenarios',\n description:\n 'List client-conformance scenarios this hosted instance can serve.',\n inputSchema: { type: 'object', properties: {} }\n },\n {\n name: 'start_run',\n description:\n 'Create a fresh run for a scenario and return the MCP URL to point ' +\n 'the client-under-test at, plus the results URL. The run-id is ' +\n 'embedded in the path so this works with stateless transports.',\n inputSchema: {\n type: 'object',\n properties: {\n scenario: {\n type: 'string',\n description: 'Scenario name, e.g. \"initialize\" or \"tools_call\".'\n },\n run_id: {\n type: 'string',\n description:\n 'Optional. Supply your own [A-Za-z0-9_-]{1,64} id; ' +\n 'otherwise one is generated.'\n }\n },\n required: ['scenario']\n }\n },\n {\n name: 'get_results',\n description:\n 'Fetch the conformance checks recorded for a run. Same shape as ' +\n 'GET /results/.',\n inputSchema: {\n type: 'object',\n properties: { run_id: { type: 'string' } },\n required: ['run_id']\n }\n }\n ]\n }));\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n const args = (request.params.arguments ?? {}) as Record;\n switch (request.params.name) {\n case 'list_scenarios':\n return text(\n JSON.stringify(\n listHostableScenarios().map((name) => ({\n name,\n description: getScenario(name)!.description\n })),\n null,\n 2\n )\n );\n\n case 'start_run': {\n if (args.run_id && !RUN_ID_RE.test(args.run_id)) {\n return errorText(`invalid run_id (must match ${RUN_ID_RE})`);\n }\n try {\n const run = sessions.getOrCreate(args.scenario, args.run_id, (id) =>\n runBaseUrl(args.scenario, id)\n );\n return text(\n JSON.stringify(\n {\n runId: run.id,\n mcpUrl: `${runBaseUrl(run.scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${publicOrigin}/results/${run.id}`,\n resultsHtmlUrl: `${publicOrigin}/results/${run.id}.html`,\n context: contextFor(run)\n },\n null,\n 2\n )\n );\n } catch (e) {\n if (\n e instanceof UnknownScenarioError ||\n e instanceof NotHostableError\n ) {\n return errorText(e.message);\n }\n throw e;\n }\n }\n\n case 'get_results': {\n const r = await sessions.results(args.run_id);\n if (!r) return errorText(`no run '${args.run_id}'`);\n return text(\n JSON.stringify(\n summarise(r.scenarioName, args.run_id, r.checks),\n null,\n 2\n )\n );\n }\n\n default:\n return errorText(`unknown tool ${request.params.name}`);\n }\n }\n );\n\n return server;\n}\n\n/**\n * The context blob a client-under-test needs (pre-registered credentials\n * etc.), tagged with the scenario name the way the CLI runner's\n * MCP_CONFORMANCE_CONTEXT is, so it can be passed through verbatim.\n */\nfunction contextFor(run: HostedRun): Record | undefined {\n return run.context ? { name: run.scenarioName, ...run.context } : undefined;\n}\n\nfunction escapeId(id: string): string {\n return id.replace(/[^A-Za-z0-9_-]/g, '');\n}\n\nfunction text(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }] };\n}\n\nfunction errorText(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }], isError: true };\n}\n","createdAt",["D",1789043608031],"branchVersion","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86",{"_31":46,"_33":45,"_35":47,"_37":-5,"_39":48,"_41":14,"_42":43,"_25":26},"src","8ad4b564-52ff-48ed-87b5-c87084c02333","directory",["D",1789043608031],{"_31":51,"_33":52,"_35":47,"_37":-5,"_39":53,"_41":14,"_42":43,"_25":26},"src/hosted","11abc952-e3be-41e6-ac33-6929c3af1284","hosted",["D",1789043608031],"id","7dcb6042-d92f-40c5-9cc8-0f661f96e58b","mcp-client-conformance",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_107":106,"_114":-5},"org",{"_107":106,"_108":109,"_110":-5,"_18":-5,"_111":112,"_113":26},"branch",{"_13":96,"_33":97,"_54":43,"_98":55,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":56,"_105":106},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mcpconformance","handle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_54":55,"_33":56,"_39":212,"_58":-5,"_59":26,"_60":61,"_62":61,"_63":-5,"_64":-5,"_18":65,"_66":67,"_68":69,"_70":-5,"_71":-5,"_72":73,"_74":75,"_76":-5,"_77":-5,"_78":-5,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":213,"_91":214,"_93":215,"_95":26},"tree",[162,167],"files",[162,163,164,165,166,167,168,169],"counts",{"_151":73,"_152":148,"_153":73,"_154":155,"_156":157},"contents",[137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_54":145,"_33":146,"_31":147,"_140":-5,"_42":43,"_41":148,"_141":69,"_39":149,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_28":150},{"_54":139,"_33":45,"_31":46,"_140":-5,"_42":43,"_41":14,"_141":69,"_39":142,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_28":144},"5cce0b27-033f-470a-b737-03d5f9e5ce82","parentId","latest",["D",1789043608031],"label",[45],"1d9db0bc-0dd8-4297-a685-a96b8a23c76f","examples","00fb2c2e-dc3c-4b18-bbc1-2fdd7ae726cf",1,["D",1789043605188],[146],"pulls","branches","forks","envVars",{"_158":160,"_161":73},"connections",{"_158":73,"_159":73},"count","unfilledCount",2,"emptyCount",{"_54":145,"_33":146,"_31":147,"_140":-5,"_42":43,"_41":148,"_141":69,"_39":209,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_172":210,"_28":211},{"_54":205,"_33":52,"_31":185,"_140":147,"_42":43,"_41":148,"_141":69,"_39":206,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_172":207,"_28":208},{"_54":197,"_33":198,"_31":199,"_140":185,"_42":43,"_41":200,"_141":26,"_39":201,"_13":73,"_35":36,"_37":202,"_25":26,"_143":-5,"_172":203,"_28":204},{"_54":190,"_33":191,"_31":192,"_140":185,"_42":43,"_41":160,"_141":26,"_39":193,"_13":73,"_35":36,"_37":194,"_25":26,"_143":-5,"_172":195,"_28":196},{"_54":182,"_33":183,"_31":184,"_140":185,"_42":43,"_41":148,"_141":26,"_39":186,"_13":73,"_35":36,"_37":187,"_25":26,"_143":-5,"_172":188,"_28":189},{"_54":139,"_33":45,"_31":46,"_140":-5,"_42":43,"_41":14,"_141":69,"_39":179,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_172":180,"_28":181},{"_54":175,"_33":52,"_31":51,"_140":46,"_42":43,"_41":14,"_141":69,"_39":176,"_13":73,"_35":47,"_37":-5,"_25":26,"_143":-5,"_172":177,"_28":178},{"_54":170,"_33":34,"_31":32,"_140":51,"_42":43,"_41":14,"_141":26,"_39":171,"_13":73,"_35":36,"_37":38,"_25":26,"_143":-5,"_172":173,"_28":174},"9dfe4842-b567-4fbf-95e3-81576c7acf0a",["D",1789043608031],"children",[],[45,52,34],"eed5a261-eb58-445c-86c0-d3d5aef33e35",["D",1789043608031],[169],[45,52],["D",1789043608031],[168],[45],"3fea48ed-b846-446a-88ff-ade7b701cf22","valtown.ts","d143119e-ad13-11f1-80b9-1607ee4eb77e","33e15d6c-9b64-4c7e-ad30-c57b58f95711",["D",1789043605188],"/**\n * MCP conformance — val.town deployment.\n *\n * The hosted runner mounts each scenario's `handler()` (a Node\n * `RequestListener`) under `/s//`. On val.town the entry\n * point is a fetch handler, so we bridge web Request→Node req/res once and\n * reuse the *real* scenario implementations from the package — no\n * reimplementation, no loopback port.\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown.ts\";\n * export default handler;\n *\n * or copy this file in directly. Requires a runtime with Node-compat\n * (`node:http`, `node:stream`) — val.town, Deno Deploy, Bun all qualify.\n *\n * Limitation: scenarios that rely on long-lived SSE streams or connection-\n * close timing (`sse-retry`) won't behave correctly through a buffered\n * Request→Response bridge. They're filtered out below.\n */\n\nimport { createHostedApp } from '../../src/hosted/server.ts';\nimport { toFetchHandler } from './fetch-bridge.ts';\nimport { SqliteRunStore } from './valtown-store.ts';\n\nconst NOT_FETCH_SAFE = new Set(['sse-retry']);\n\n// Auth scenarios need a second public origin (RFC 8414 well-known is\n// origin-rooted). Deploy examples/hosted/valtown-relay.ts as a separate val\n// and point CONFORMANCE_AS_ORIGIN at it; both vals share\n// CONFORMANCE_RELAY_SECRET so /__aux can't be hit directly.\nconst { app, sessions } = createHostedApp({\n auxOrigins: {\n as: process.env.CONFORMANCE_AS_ORIGIN,\n as2: process.env.CONFORMANCE_AS2_ORIGIN,\n idp: process.env.CONFORMANCE_IDP_ORIGIN\n },\n relaySecret: process.env.CONFORMANCE_RELAY_SECRET,\n // val.town spreads one run's requests over several isolates; persist to\n // the account's SQLite so /results is the union of what they all saw.\n store: process.env.valtown ? new SqliteRunStore() : undefined\n});\n\nconst bridge = toFetchHandler(app);\n\nexport default async function (request: Request): Promise {\n const url = new URL(request.url);\n\n // Short-circuit scenarios that need true streaming.\n const m = url.pathname.match(/^\\/s\\/([^/]+)/);\n if (m && NOT_FETCH_SAFE.has(m[1])) {\n return Response.json(\n {\n error: `scenario '${m[1]}' relies on SSE stream lifecycle and is not available via the fetch bridge`\n },\n { status: 501 }\n );\n }\n\n const response = await bridge(request);\n // The bridge buffers until end(), by which point the scenario has recorded\n // its checks and the write-through has started; finish it before the\n // isolate is allowed to go idle.\n await sessions.flush();\n return response;\n}\n",[],[146,52,183],"b14b49be-62d3-4e6f-832e-253eafc52650","valtown-store.ts","d1ffa5b6-ad13-11f1-8f33-1607ee4eb77e",["D",1789043606355],"/**\n * RunStore backed by val.town's per-account SQLite (REST API).\n *\n * val.town injects an API token into every val as the `valtown` env var; the\n * SQLite API is `POST /v1/sqlite/execute {statement:{sql,args}}`. Two tables,\n * created lazily once per isolate. Old runs are swept on new-run creation,\n * throttled per isolate, so the database stays bounded without a cron.\n */\n\nimport type { ConformanceCheck } from '../../src/types.ts';\nimport type { RunStore } from '../../src/hosted/store.ts';\n\nconst API = 'https://api.val.town/v1/sqlite/execute';\n\nexport interface SqliteRunStoreOptions {\n token?: string;\n /** Runs older than this are swept. Default 6h. */\n retentionMs?: number;\n /** Cap on checks persisted per (run, writer). Default 1000. */\n maxChecks?: number;\n}\n\ntype Row = unknown[];\n\nexport class SqliteRunStore implements RunStore {\n private readonly token: string;\n private readonly retentionMs: number;\n private readonly maxChecks: number;\n private ready: Promise | undefined;\n private lastSweep = 0;\n\n constructor(opts: SqliteRunStoreOptions = {}) {\n const token = opts.token ?? process.env.valtown;\n if (!token)\n throw new Error('SqliteRunStore: no val.town token (env valtown)');\n this.token = token;\n this.retentionMs =\n opts.retentionMs ??\n Number(process.env.CONFORMANCE_RUN_RETENTION_MS ?? 6 * 3600_000);\n this.maxChecks = opts.maxChecks ?? 1000;\n }\n\n private async exec(sql: string, args: unknown[] = []): Promise {\n const res = await fetch(API, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${this.token}`,\n 'Content-Type': 'application/json'\n },\n body: JSON.stringify({ statement: { sql, args } })\n });\n if (!res.ok) {\n throw new Error(\n `sqlite ${res.status}: ${(await res.text()).slice(0, 200)}`\n );\n }\n const body = (await res.json()) as { rows?: Row[] };\n return body.rows ?? [];\n }\n\n private init(): Promise {\n this.ready ??= (async () => {\n await this.exec(\n `CREATE TABLE IF NOT EXISTS hosted_runs_v2 (\n id TEXT PRIMARY KEY, scenario TEXT NOT NULL, created_at INTEGER NOT NULL)`\n );\n await this.exec(\n `CREATE TABLE IF NOT EXISTS hosted_checks_v2 (\n run_id TEXT NOT NULL, writer TEXT NOT NULL, checks TEXT NOT NULL,\n updated_at INTEGER NOT NULL, PRIMARY KEY (run_id, writer))`\n );\n })().catch((e) => {\n this.ready = undefined;\n throw e;\n });\n return this.ready;\n }\n\n async saveRun(id: string, scenarioName: string): Promise {\n await this.init();\n await this.exec(\n `INSERT INTO hosted_runs_v2 (id, scenario, created_at) VALUES (?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET scenario = excluded.scenario`,\n [id, scenarioName, Date.now()]\n );\n void this.sweep().catch(() => {});\n }\n\n async loadRun(id: string): Promise {\n await this.init();\n const rows = await this.exec(\n `SELECT scenario FROM hosted_runs_v2 WHERE id = ?`,\n [id]\n );\n return rows[0]?.[0] as string | undefined;\n }\n\n async saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise {\n await this.init();\n await this.exec(\n `INSERT INTO hosted_checks_v2 (run_id, writer, checks, updated_at)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(run_id, writer) DO UPDATE\n SET checks = excluded.checks, updated_at = excluded.updated_at`,\n [id, writer, JSON.stringify(checks.slice(-this.maxChecks)), Date.now()]\n );\n }\n\n async loadChecks(id: string): Promise> {\n await this.init();\n const rows = await this.exec(\n `SELECT writer, checks FROM hosted_checks_v2 WHERE run_id = ?`,\n [id]\n );\n const out = new Map();\n for (const [writer, checks] of rows) {\n try {\n out.set(writer as string, JSON.parse(checks as string));\n } catch {\n // corrupt row — ignore\n }\n }\n return out;\n }\n\n async deleteRun(id: string): Promise {\n await this.init();\n await this.exec(`DELETE FROM hosted_checks_v2 WHERE run_id = ?`, [id]);\n await this.exec(`DELETE FROM hosted_runs_v2 WHERE id = ?`, [id]);\n }\n\n private async sweep(): Promise {\n const now = Date.now();\n if (now - this.lastSweep < 5 * 60_000) return;\n this.lastSweep = now;\n const cutoff = now - this.retentionMs;\n await this.exec(\n `DELETE FROM hosted_checks_v2 WHERE run_id IN\n (SELECT id FROM hosted_runs_v2 WHERE created_at < ?)`,\n [cutoff]\n );\n await this.exec(`DELETE FROM hosted_runs_v2 WHERE created_at < ?`, [\n cutoff\n ]);\n }\n}\n",[],[146,52,191],"3c480d6a-84b6-44ba-8074-7a713ef574d2","fetch-bridge.ts","d2578a38-ad13-11f1-ad25-1607ee4eb77e",3,["D",1789043606991],"/**\n * Web fetch ↔ Node bridge: adapt a Node RequestListener (express app) to a\n * fetch-style handler for serverless runtimes (val.town, Deno Deploy, Bun).\n *\n * Intercepts the user-facing write surface (writeHead/setHeader/write/end)\n * so we never touch ServerResponse's socket-coupled internals — the approach\n * serverless-http and light-my-request take.\n */\n\nimport { IncomingMessage, ServerResponse } from 'node:http';\nimport { Socket } from 'node:net';\n\ntype NodeListener = (req: IncomingMessage, res: ServerResponse) => void;\n\nexport function toFetchHandler(\n listener: NodeListener\n): (request: Request) => Promise {\n return async (request: Request): Promise => {\n const url = new URL(request.url);\n\n // --- web Request → Node IncomingMessage ---\n const body = request.body\n ? Buffer.from(await request.arrayBuffer())\n : undefined;\n // Express's req.protocol/req.ip read socket.encrypted/.remoteAddress,\n // and IncomingMessage._destroy calls socket.destroy(), so a real\n // (unconnected) Socket with the encrypted flag patched on is the path\n // of least surprise.\n const socket = Object.assign(new Socket(), { encrypted: false });\n const nodeReq = new IncomingMessage(socket);\n nodeReq.method = request.method;\n nodeReq.url = url.pathname + url.search;\n nodeReq.httpVersion = '1.1';\n nodeReq.httpVersionMajor = 1;\n nodeReq.httpVersionMinor = 1;\n nodeReq.headers = Object.fromEntries(request.headers);\n nodeReq.headers.host ??= url.host;\n if (body?.length) nodeReq.headers['content-length'] = String(body.length);\n // The SDK's StreamableHTTPServerTransport converts Node→Web via\n // @hono/node-server, which reads rawHeaders (the [k,v,k,v,...] array),\n // not the parsed headers object. Deno's node:http compat exposes\n // rawHeaders as a getter-only accessor, so shadow it with an own\n // property instead of assigning.\n Object.defineProperty(nodeReq, 'rawHeaders', {\n value: Object.entries(nodeReq.headers).flat() as string[],\n writable: true,\n configurable: true\n });\n if (body?.length) nodeReq.push(body);\n nodeReq.push(null);\n\n // --- Node ServerResponse → web Response ---\n const nodeRes = new ServerResponse(nodeReq);\n const chunks: Buffer[] = [];\n let status = 200;\n const headers = new Headers();\n\n const captureHeaders = (h?: Record) => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n }\n };\n nodeRes.setHeader = ((k: string, v: string | string[] | number) => {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n return nodeRes;\n }) as ServerResponse['setHeader'];\n nodeRes.getHeader = (k: string) =>\n headers.get(k.toLowerCase()) ?? undefined;\n nodeRes.removeHeader = (k: string) => headers.delete(k);\n nodeRes.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return nodeRes;\n }) as ServerResponse['writeHead'];\n nodeRes.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n nodeRes.flushHeaders = () => {};\n Object.defineProperty(nodeRes, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n\n return new Promise((resolve) => {\n nodeRes.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve(\n new Response(chunks.length ? Buffer.concat(chunks) : null, {\n status,\n headers\n })\n );\n return nodeRes;\n }) as ServerResponse['end'];\n\n listener(nodeReq, nodeRes);\n });\n };\n}\n",[],[146,52,198],"e0d4ff66-2d0b-4b92-9d52-7466f5cd524c",["D",1789043605188],[164,165,166],[146,52],["D",1789043605188],[163],[146],["D",1789043604380],{"_107":106,"_114":-5},{"_107":106,"_108":109,"_110":-5,"_18":-5,"_111":112,"_113":26},{"_13":96,"_33":97,"_54":43,"_98":55,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":56,"_105":106},"ctx",{"_89":-5,"_134":249,"_250":251,"_252":253,"_254":26,"_255":26,"_256":26,"_257":69,"_258":-5,"_259":-7,"_260":-7,"_261":73,"_262":26,"_263":26,"_264":-5,"_265":26,"_266":26,"_267":26,"_268":-5},"ENV",{"_220":221,"_222":223,"_224":97,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v4