[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_261":262,"_263":264},"routes/_app.x.$handle.$name",{"_95":94,"_31":44,"_103":85,"_26":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":24,"_118":119,"_120":24,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":-5,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":24},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","src/hosted/session.ts","latestPath","fileId","d48fd9ae-ad13-11f1-9b49-1607ee4eb77e","name","session.ts","fileType","script","content","/**\n * Session management for the hosted conformance server.\n *\n * A \"run\" is one isolated exercise of a scenario. Each run owns a fresh\n * Scenario instance and the RequestListener it returns from handler() — no\n * loopback port, no proxy. Runs are keyed by a path-embedded id so\n * correlation works for stateless-transport clients that never echo\n * mcp-session-id.\n */\n\nimport { randomBytes } from 'node:crypto';\nimport {\n Scenario,\n ConformanceCheck,\n RequestListener,\n AuthHandlerScenario,\n AuxOriginRole\n} from '../types.ts';\nimport { getScenario, scenarios } from '../scenarios/index.ts';\nimport type { RunStore } from './store.ts';\n\nexport interface HostedRun {\n id: string;\n scenarioName: string;\n scenario: Scenario;\n /** The mounted RS handler — invoke directly with (req, res). */\n listener: RequestListener;\n /** Aux-origin handlers (AS, IdP, …) for auth scenarios. */\n auxListeners?: Partial>;\n /** Sub-path under the run prefix where the MCP endpoint lives. */\n mcpPath: string;\n createdAt: number;\n lastSeenAt: number;\n context?: Record;\n}\n\nexport interface SessionManagerOptions {\n /** Idle ms after which a run is reaped. Default 5 minutes. */\n ttlMs?: number;\n sweepIntervalMs?: number;\n /**\n * Public origins of the relay deployments, keyed by role. Required for any\n * scenario that exposes `authHandlers()`. Each value is the relay's public\n * URL (no trailing slash); per-run AS issuer becomes `/r/`.\n */\n auxOrigins?: Partial>;\n /**\n * Optional persistence so runs survive being load-balanced across\n * processes (serverless isolates). Omit for a single long-lived process.\n */\n store?: RunStore;\n}\n\n/** Results view: the scenario a run belongs to plus its judged checks. */\nexport interface RunResults {\n scenarioName: string;\n checks: ConformanceCheck[];\n}\n\n/**\n * The scenario's raw event log — what it actually observed — as opposed to\n * getChecks(), which for most client scenarios also appends \"expected X,\n * never saw it\" FAILUREs (and mutates). Persisting the raw log per process\n * and judging the merged log once is what makes multi-process hosting work.\n */\nexport function rawChecksOf(scenario: Scenario): ConformanceCheck[] {\n if (scenario.rawChecks) return scenario.rawChecks();\n const bag = (scenario as unknown as { checks?: unknown }).checks;\n if (Array.isArray(bag)) return bag as ConformanceCheck[];\n return scenario.getChecks();\n}\n\n/**\n * Judge a merged raw log with the scenario's own end-of-run logic by loading\n * it into a fresh instance. Falls back to the raw log for scenarios that\n * don't keep a plain `checks` array.\n */\nexport function finalizeChecks(\n scenarioName: string,\n merged: ConformanceCheck[]\n): ConformanceCheck[] {\n const proto = getScenario(scenarioName);\n if (!proto) return merged;\n try {\n const Ctor = proto.constructor as new () => Scenario;\n const fresh = new Ctor() as unknown as {\n checks?: unknown;\n getChecks(): ConformanceCheck[];\n };\n if (!Array.isArray(fresh.checks)) return merged;\n fresh.checks = merged.map((c) => ({ ...c }));\n return fresh.getChecks();\n } catch {\n return merged;\n }\n}\n\nexport class SessionManager {\n private runs = new Map();\n private readonly ttlMs: number;\n private readonly auxOrigins: Partial>;\n private sweeper: ReturnType;\n readonly store: RunStore | undefined;\n private pending = new Set>();\n /** Identifies this process's rows in the store. */\n readonly writerId = randomBytes(4).toString('hex');\n\n constructor(opts: SessionManagerOptions = {}) {\n this.ttlMs = opts.ttlMs ?? 5 * 60_000;\n this.auxOrigins = opts.auxOrigins ?? {};\n this.store = opts.store;\n const sweepIntervalMs = opts.sweepIntervalMs ?? 30_000;\n this.sweeper = setInterval(() => this.sweep(), sweepIntervalMs);\n this.sweeper.unref?.();\n }\n\n /**\n * Get the run for (scenario, id), creating it on first reference. The id is\n * caller-chosen so URLs are predictable; pass undefined to mint one.\n */\n getOrCreate(\n scenarioName: string,\n id: string | undefined,\n baseUrlFor: (runId: string) => string\n ): HostedRun {\n if (id) {\n const existing = this.runs.get(id);\n if (existing && existing.scenarioName === scenarioName) {\n existing.lastSeenAt = Date.now();\n return existing;\n }\n // Same id reused for a different scenario → replace, don't merge checks.\n if (existing) void this.destroy(id);\n }\n\n const proto = getScenario(scenarioName);\n if (!proto) throw new UnknownScenarioError(scenarioName);\n\n const Ctor = proto.constructor as new () => Scenario;\n const scenario = new Ctor();\n const runId = id ?? randomBytes(6).toString('base64url');\n\n let listener: RequestListener;\n let auxListeners: HostedRun['auxListeners'];\n let context: Record | undefined;\n\n if (scenario instanceof AuthHandlerScenario) {\n // Multi-origin scenario: build RS + aux handlers from authHandlers().\n // Aux issuer is /r/ so the run-id is recoverable\n // from any RFC 8414 well-known path the client constructs from it.\n const missing = scenario.auxRoles.filter((r) => !this.auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n scenarioName,\n `needs aux origin(s) [${missing.join(', ')}] — start with --as-origin`\n );\n }\n const handlers = scenario.authHandlers({\n getRsBaseUrl: () => baseUrlFor(runId),\n getAuxBaseUrl: (role) => `${this.auxOrigins[role]}/r/${runId}`\n });\n listener = handlers.rs;\n auxListeners = handlers.aux;\n context = (\n scenario as unknown as {\n scenarioContext?: () => Record;\n }\n ).scenarioContext?.();\n } else if (scenario.handler) {\n listener = scenario.handler(() => baseUrlFor(runId));\n } else {\n throw new NotHostableError(scenarioName);\n }\n\n const steps = (scenario as Scenario).steps;\n if (steps) context = { ...context, steps };\n\n const run: HostedRun = {\n id: runId,\n scenarioName,\n scenario,\n listener,\n auxListeners,\n mcpPath: scenario.mcpPath ?? '',\n createdAt: Date.now(),\n lastSeenAt: Date.now(),\n context\n };\n this.runs.set(runId, run);\n void this.store?.saveRun(runId, scenarioName).catch(logStoreError);\n return run;\n }\n\n get(id: string): HostedRun | undefined {\n const r = this.runs.get(id);\n if (r) r.lastSeenAt = Date.now();\n return r;\n }\n\n /**\n * Like get(), but if this process has never seen the run and a store is\n * configured, rebuild it from persisted metadata. This is how an aux-origin\n * request or a results page lands correctly on a cold process.\n */\n async ensure(\n id: string,\n baseUrlFor: (scenarioName: string, runId: string) => string\n ): Promise {\n const local = this.get(id);\n if (local || !this.store) return local;\n let scenarioName: string | undefined;\n try {\n scenarioName = await this.store.loadRun(id);\n } catch (e) {\n logStoreError(e);\n }\n if (!scenarioName) return undefined;\n return this.getOrCreate(scenarioName, id, (rid) =>\n baseUrlFor(scenarioName, rid)\n );\n }\n\n /** Write this process's view of a run's checks through to the store. */\n persist(run: HostedRun): Promise {\n if (!this.store) return Promise.resolve();\n const p = this.store\n .saveChecks(\n run.id,\n this.writerId,\n rawChecksOf(run.scenario).map((c) => ({ ...c }))\n )\n .catch(logStoreError)\n .finally(() => this.pending.delete(p));\n this.pending.add(p);\n return p;\n }\n\n /**\n * Resolve once every in-flight persist() has settled. Serverless entry\n * points await this before handing back the response so the write isn't\n * abandoned when the isolate is frozen after responding.\n */\n async flush(): Promise {\n while (this.pending.size) await Promise.all(Array.from(this.pending));\n }\n\n /**\n * Judged checks for a run. Without a store this is the scenario's own\n * getChecks(). With a store it is every process's raw log merged (this\n * process's live log wins over its own persisted row) and re-judged once.\n */\n async results(id: string): Promise {\n const run = this.runs.get(id);\n if (!this.store) {\n return run\n ? { scenarioName: run.scenarioName, checks: run.scenario.getChecks() }\n : undefined;\n }\n let byWriter = new Map();\n try {\n byWriter = await this.store.loadChecks(id);\n } catch (e) {\n logStoreError(e);\n }\n if (run) byWriter.set(this.writerId, rawChecksOf(run.scenario));\n let scenarioName = run?.scenarioName;\n if (!scenarioName) {\n try {\n scenarioName = await this.store.loadRun(id);\n } catch (e) {\n logStoreError(e);\n }\n }\n if (!scenarioName) return undefined;\n const merged = Array.from(byWriter.values())\n .flat()\n .sort((a, b) => (a.timestamp ?? '').localeCompare(b.timestamp ?? ''));\n return { scenarioName, checks: finalizeChecks(scenarioName, merged) };\n }\n\n list(): HostedRun[] {\n return Array.from(this.runs.values());\n }\n\n async destroy(id: string, fromStore = true): Promise {\n const r = this.runs.get(id);\n if (fromStore) void this.store?.deleteRun(id).catch(logStoreError);\n if (!r) return;\n this.runs.delete(id);\n // handler() never started a server, but some scenarios hold timers/streams\n // that stop() cleans up. Safe to call even though start() wasn't.\n try {\n await r.scenario.stop();\n } catch {\n // best-effort\n }\n }\n\n async close(): Promise {\n clearInterval(this.sweeper);\n await Promise.all(\n Array.from(this.runs.keys()).map((id) => this.destroy(id, false))\n );\n }\n\n private sweep(): void {\n const now = Date.now();\n for (const [id, r] of this.runs) {\n // Local eviction only — the store has its own retention.\n if (now - r.lastSeenAt > this.ttlMs) void this.destroy(id, false);\n }\n }\n}\n\nfunction logStoreError(e: unknown): void {\n console.error('[hosted] run store:', e instanceof Error ? e.message : e);\n}\n\nexport class UnknownScenarioError extends Error {\n constructor(name: string) {\n super(\n `Unknown scenario '${name}'. Available: ${Array.from(scenarios.keys()).join(', ')}`\n );\n }\n}\n\nexport class NotHostableError extends Error {\n constructor(name: string, why?: string) {\n super(\n `Scenario '${name}' cannot run hosted` +\n (why\n ? `: ${why}`\n : ` (no handler() or authHandlers() — typically backcompat scenarios that need root-of-origin endpoints).`)\n );\n }\n}\n\n/** Scenarios that can run hosted, partitioned by what they need. */\nexport function listHostableScenarios(\n withAuxOrigins: readonly AuxOriginRole[] = []\n): string[] {\n const have = new Set(withAuxOrigins);\n return Array.from(scenarios.entries())\n .filter(([, s]) => {\n if (typeof s.handler === 'function') return true;\n if (s instanceof AuthHandlerScenario) {\n return s.auxRoles.every((r) => have.has(r));\n }\n return false;\n })\n .map(([name]) => name);\n}\n","createdAt",["D",1789043610719],"branchVersion","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","id","7dcb6042-d92f-40c5-9cc8-0f661f96e58b","mcp-client-conformance",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":-5},"org",{"_95":94,"_96":97,"_98":-5,"_18":-5,"_99":100,"_101":24},"branch",{"_13":84,"_31":85,"_42":41,"_86":43,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":44,"_93":94},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mcpconformance","handle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":257,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":-5,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":258,"_79":259,"_81":260,"_83":24},"tree",[154,159],"files",[154,155,156,157,158,159,160,161,162,163,164,165,166,167],"counts",{"_143":61,"_144":140,"_145":61,"_146":147,"_148":149},"contents",[125,126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":137,"_31":138,"_29":139,"_130":-5,"_40":41,"_39":140,"_132":57,"_37":141,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_26":142},{"_42":127,"_31":128,"_29":129,"_130":-5,"_40":41,"_39":131,"_132":57,"_37":133,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_26":136},"5cce0b27-033f-470a-b737-03d5f9e5ce82","src","8ad4b564-52ff-48ed-87b5-c87084c02333","parentId",4,"latest",["D",1789043608031],"directory","label",[128],"1d9db0bc-0dd8-4297-a685-a96b8a23c76f","examples","00fb2c2e-dc3c-4b18-bbc1-2fdd7ae726cf",1,["D",1789043605188],[138],"pulls","branches","forks","envVars",{"_150":152,"_153":61},"connections",{"_150":61,"_151":61},"count","unfilledCount",2,"emptyCount",{"_42":137,"_31":138,"_29":139,"_130":-5,"_40":41,"_39":140,"_132":57,"_37":254,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_174":255,"_26":256},{"_42":250,"_31":200,"_29":230,"_130":139,"_40":41,"_39":140,"_132":57,"_37":251,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_174":252,"_26":253},{"_42":242,"_31":243,"_29":244,"_130":230,"_40":41,"_39":245,"_132":24,"_37":246,"_13":61,"_33":34,"_35":247,"_23":24,"_135":-5,"_174":248,"_26":249},{"_42":235,"_31":236,"_29":237,"_130":230,"_40":41,"_39":152,"_132":24,"_37":238,"_13":61,"_33":34,"_35":239,"_23":24,"_135":-5,"_174":240,"_26":241},{"_42":227,"_31":228,"_29":229,"_130":230,"_40":41,"_39":140,"_132":24,"_37":231,"_13":61,"_33":34,"_35":232,"_23":24,"_135":-5,"_174":233,"_26":234},{"_42":127,"_31":128,"_29":129,"_130":-5,"_40":41,"_39":131,"_132":57,"_37":224,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_174":225,"_26":226},{"_42":220,"_31":200,"_29":194,"_130":129,"_40":41,"_39":131,"_132":57,"_37":221,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_174":222,"_26":223},{"_42":212,"_31":213,"_29":214,"_130":194,"_40":41,"_39":215,"_132":24,"_37":216,"_13":61,"_33":34,"_35":217,"_23":24,"_135":-5,"_174":218,"_26":219},{"_42":205,"_31":206,"_29":207,"_130":194,"_40":41,"_39":131,"_132":24,"_37":208,"_13":61,"_33":34,"_35":209,"_23":24,"_135":-5,"_174":210,"_26":211},{"_42":201,"_31":32,"_29":30,"_130":194,"_40":41,"_39":14,"_132":24,"_37":202,"_13":61,"_33":34,"_35":36,"_23":24,"_135":-5,"_174":203,"_26":204},{"_42":191,"_31":192,"_29":193,"_130":194,"_40":41,"_39":195,"_132":24,"_37":196,"_13":61,"_33":34,"_35":197,"_23":24,"_135":-5,"_174":198,"_26":199},{"_42":187,"_31":186,"_29":180,"_130":129,"_40":41,"_39":181,"_132":57,"_37":188,"_13":61,"_33":134,"_35":-5,"_23":24,"_135":-5,"_174":189,"_26":190},{"_42":177,"_31":178,"_29":179,"_130":180,"_40":41,"_39":181,"_132":24,"_37":182,"_13":61,"_33":34,"_35":183,"_23":24,"_135":-5,"_174":184,"_26":185},{"_42":168,"_31":169,"_29":170,"_130":129,"_40":41,"_39":171,"_132":24,"_37":172,"_13":61,"_33":34,"_35":173,"_23":24,"_135":-5,"_174":175,"_26":176},"bfc973db-7e41-4d42-89bc-f0058548cd51","types.ts","d3a406d2-ad13-11f1-b31d-1607ee4eb77e",6,["D",1789043609182],"import type { Step } from './steps/index.ts';\n\nexport type CheckStatus =\n | 'SUCCESS'\n | 'FAILURE'\n | 'WARNING'\n | 'SKIPPED'\n | 'INFO';\n\nexport interface SpecReference {\n id: string;\n url?: string;\n}\n\nexport interface ConformanceCheck {\n id: string;\n name: string;\n description: string;\n status: CheckStatus;\n timestamp: string;\n specReferences?: SpecReference[];\n details?: Record;\n metadata?: Record;\n errorMessage?: string;\n logs?: string[];\n}\n\nexport const DATED_SPEC_VERSIONS = [\n '2025-03-26',\n '2025-06-18',\n '2025-11-25'\n] as const;\n\nexport type DatedSpecVersion = (typeof DATED_SPEC_VERSIONS)[number];\n\nexport const LATEST_SPEC_VERSION: DatedSpecVersion = '2025-11-25';\n\n/**\n * Wire `protocolVersion` for the in-progress spec. Mirrors\n * `LATEST_PROTOCOL_VERSION` in the spec repo's `schema/draft/schema.ts`;\n * bump when that constant changes.\n */\nexport const DRAFT_PROTOCOL_VERSION = 'DRAFT-2026-v1';\n\n// Wire protocolVersion strings the mock server will negotiate on initialize.\nexport const NEGOTIABLE_PROTOCOL_VERSIONS: readonly string[] = [\n '2025-06-18',\n LATEST_SPEC_VERSION,\n DRAFT_PROTOCOL_VERSION\n];\n\n/**\n * A spec revision the conformance suite can target via `--spec-version`.\n * Always a wire `protocolVersion` string. The CLI also accepts `'draft'` as\n * an alias for {@link DRAFT_PROTOCOL_VERSION}.\n */\nexport type SpecVersion = DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n\n// Scenarios may also be tagged 'extension' to mark them as off-timeline\n// (selectable via --suite extensions, never via --spec-version). See #256.\nexport type ScenarioSpecTag = SpecVersion | 'extension';\n\n/**\n * Known protocol extensions that this suite has scenarios for.\n * Values are SEP-2133 extension identifiers (the keys used in\n * `capabilities.extensions`).\n */\nexport const EXTENSION_IDS = [\n 'io.modelcontextprotocol/oauth-client-credentials',\n 'io.modelcontextprotocol/enterprise-managed-authorization'\n] as const;\nexport type ExtensionId = (typeof EXTENSION_IDS)[number];\n\n/**\n * Where a scenario's requirement comes from. Either the dated spec timeline\n * (`introducedIn`/`removedIn`) or a named protocol extension that lives\n * outside the spec release cycle. Extensions never match `--spec-version`.\n */\nexport type ScenarioSource =\n | {\n introducedIn: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n removedIn?: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n }\n | { extensionId: ExtensionId };\n\nexport interface ScenarioUrls {\n serverUrl: string;\n authUrl?: string;\n /**\n * Optional context to pass to the client via MCP_CONFORMANCE_CONTEXT env var.\n * This is a JSON-serializable object containing scenario-specific data like credentials.\n */\n context?: Record;\n}\n\n/** A Node-style request handler — what `http.createServer` accepts. */\nexport type RequestListener = (\n req: import('http').IncomingMessage,\n res: import('http').ServerResponse\n) => void;\n\nexport interface Scenario {\n name: string;\n description: string;\n source: ScenarioSource;\n /**\n * If true, a non-zero client exit code is expected and will not cause the test to fail.\n * Use this for scenarios where the client is expected to error (e.g., rejecting invalid auth).\n */\n allowClientError?: boolean;\n /**\n * Sub-path of the MCP endpoint relative to the handler root. The CLI runner\n * appends this to the listen URL; the hosted runner appends it to the\n * mounted prefix. Default: '' (handler root is the MCP endpoint).\n */\n mcpPath?: string;\n /**\n * Return the request handler without binding a port. The hosted runner\n * mounts this directly under a path prefix so scenarios can run on\n * serverless hosts that don't allow loopback listeners.\n *\n * `getBaseUrl` returns the public URL this handler is reachable at (no\n * trailing slash) — use it for scenarios that embed self-referential\n * absolute URLs in responses. Called lazily so `start()` can resolve it\n * after the OS assigns a port.\n *\n * Implementations should reset per-run state here, not in `start()`.\n * If omitted, the scenario only runs via `start()`/`stop()` (e.g. auth\n * scenarios that need a second origin).\n */\n handler?(getBaseUrl: () => string): RequestListener;\n start(): Promise;\n stop(): Promise;\n getChecks(): ConformanceCheck[];\n /**\n * Checks recorded so far WITHOUT end-of-flow finalization. Some scenarios'\n * `getChecks()` appends aggregate failures for flow steps never observed\n * (\"expected check missing\"); those judgments are only meaningful when one\n * instance saw the whole flow. Stateless mounting (`/x/...`) judges each\n * request on its own content, so it reads this view when present.\n */\n rawChecks?(): ConformanceCheck[];\n /**\n * Client-side choreography as data (see src/steps). When present the\n * runner includes it in MCP_CONFORMANCE_CONTEXT as `steps`, so a client\n * with no bespoke handler for this scenario can still drive it.\n */\n readonly steps?: readonly Step[];\n}\n\n/**\n * Convenience: implement `handler()` + `mcpPath` and get `start()`/`stop()`\n * for free. Covers every scenario that just needs one HTTP origin.\n */\nexport abstract class HandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '';\n\n private _server: import('http').Server | null = null;\n private _baseUrl = '';\n\n abstract handler(getBaseUrl: () => string): RequestListener;\n abstract getChecks(): ConformanceCheck[];\n\n async start(): Promise {\n const http = await import('node:http');\n const listener = this.handler(() => this._baseUrl);\n return new Promise((resolve, reject) => {\n this._server = http.createServer(listener);\n this._server.on('error', reject);\n this._server.listen(0, () => {\n const addr = this._server!.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._baseUrl = `http://localhost:${addr.port}`;\n resolve({ serverUrl: `${this._baseUrl}${this.mcpPath}` });\n });\n });\n }\n\n async stop(): Promise {\n if (!this._server) return;\n await new Promise((resolve) => {\n // closeAllConnections so hung SSE streams don't keep the process alive\n this._server!.closeAllConnections?.();\n this._server!.close(() => resolve());\n });\n this._server = null;\n }\n}\n\n/**\n * Named extra origins a multi-origin scenario needs beyond the resource\n * server. `as` is the OAuth authorization server; `as2`/`idp` cover the\n * three-origin scenarios (authorization-server-migration, EMA).\n */\nexport type AuxOriginRole = 'as' | 'as2' | 'idp';\n\nexport interface AuthHandlerContext {\n /** Public URL of the resource-server mount (no trailing slash). */\n getRsBaseUrl: () => string;\n /**\n * Public URL of an aux origin for this run (no trailing slash). When\n * hosted, this is `/r/` so the run-id is recoverable\n * from any path the client constructs from it (RFC 8414 well-known\n * insertion, endpoint paths, etc.).\n */\n getAuxBaseUrl: (role: AuxOriginRole) => string;\n}\n\nexport interface AuthHandlers {\n /** Resource-server handler — serves /mcp and PRM. */\n rs: RequestListener;\n /** Aux-origin handlers keyed by role. */\n aux: Partial>;\n}\n\n/**\n * Convenience: implement `authHandlers()` and get `start()`/`stop()` for\n * free. `start()` binds one ephemeral localhost port per origin, exactly as\n * the auth scenarios did with `ServerLifecycle` before; the hosted runner\n * mounts the same handlers behind path prefixes + an AS relay instead.\n */\nexport abstract class AuthHandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '/mcp';\n\n /** Aux origins this scenario needs. Override for 3-origin scenarios. */\n readonly auxRoles: readonly AuxOriginRole[] = ['as'];\n\n private _servers: import('http').Server[] = [];\n private _urls: { rs: string; aux: Partial> } = {\n rs: '',\n aux: {}\n };\n\n abstract authHandlers(ctx: AuthHandlerContext): AuthHandlers;\n abstract getChecks(): ConformanceCheck[];\n\n /** Optional context to pass to the client (credentials etc). */\n protected scenarioContext?(): Record;\n\n async start(): Promise {\n const http = await import('node:http');\n const handlers = this.authHandlers({\n getRsBaseUrl: () => this._urls.rs,\n getAuxBaseUrl: (role) => {\n const u = this._urls.aux[role];\n if (!u) throw new Error(`aux role '${role}' not started`);\n return u;\n }\n });\n\n const listen = (h: RequestListener): Promise =>\n new Promise((resolve, reject) => {\n const srv = http.createServer(h);\n srv.on('error', reject);\n srv.listen(0, () => {\n const addr = srv.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._servers.push(srv);\n resolve(`http://localhost:${addr.port}`);\n });\n });\n\n // Aux origins must come up first — RS handlers reference their URLs.\n for (const role of this.auxRoles) {\n const h = handlers.aux[role];\n if (!h) throw new Error(`authHandlers() missing aux role '${role}'`);\n this._urls.aux[role] = await listen(h);\n }\n this._urls.rs = await listen(handlers.rs);\n\n return {\n serverUrl: `${this._urls.rs}${this.mcpPath}`,\n ...(this.scenarioContext && { context: this.scenarioContext() })\n };\n }\n\n async stop(): Promise {\n await Promise.all(\n this._servers.map(\n (s) =>\n new Promise((resolve) => {\n s.closeAllConnections?.();\n s.close(() => resolve());\n })\n )\n );\n this._servers = [];\n this._urls = { rs: '', aux: {} };\n }\n}\n\nexport interface ClientScenario {\n name: string;\n description: string;\n source: ScenarioSource;\n run(serverUrl: string): Promise;\n}\n\nexport interface ClientScenarioForAuthorizationServer {\n name: string;\n description: string;\n source: ScenarioSource;\n run(serverUrl: string): Promise;\n}\n","children",[],[128,169],"02b35dc0-c3dc-4996-a3e2-53e4a1a0b205","index.ts","d3f3dc70-ad13-11f1-8f33-1607ee4eb77e","13d18508-400e-4bdc-9c25-c860c1b600e8",7,["D",1789043609699],"import {\n Scenario,\n ClientScenario,\n ClientScenarioForAuthorizationServer,\n ScenarioSource,\n SpecVersion,\n DatedSpecVersion,\n ScenarioSpecTag,\n DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n} from '../types.ts';\nimport { InitializeScenario } from './client/initialize.ts';\nimport { ToolsCallScenario } from './client/tools_call.ts';\nimport { StatelessGauntletScenario } from './client/stateless-gauntlet.ts';\nimport { AuthCheckerScenario } from './client/auth-checker.ts';\nimport { ElicitationClientDefaultsScenario } from './client/elicitation-defaults.ts';\nimport { SSERetryScenario } from './client/sse-retry.ts';\nimport { RequestMetadataScenario } from './client/request-metadata.ts';\nimport { MRTRClientScenario } from './client/mrtr-client.ts';\n\n// Import all new server test scenarios\nimport { ServerInitializeScenario } from './server/lifecycle.ts';\nimport { ServerStatelessScenario } from './server/stateless.ts';\n\nimport {\n PingScenario,\n LoggingSetLevelScenario,\n CompletionCompleteScenario\n} from './server/utils.ts';\n\nimport {\n ToolsListScenario,\n ToolsCallSimpleTextScenario,\n ToolsCallImageScenario,\n ToolsCallMultipleContentTypesScenario,\n ToolsCallWithLoggingScenario,\n ToolsCallErrorScenario,\n ToolsCallWithProgressScenario,\n ToolsCallSamplingScenario,\n ToolsCallElicitationScenario,\n ToolsCallAudioScenario,\n ToolsCallEmbeddedResourceScenario\n} from './server/tools.ts';\n\nimport { JsonSchema2020_12Scenario } from './server/json-schema-2020-12.ts';\n\nimport { ElicitationDefaultsScenario } from './server/elicitation-defaults.ts';\nimport { ElicitationEnumsScenario } from './server/elicitation-enums.ts';\nimport { ServerSSEPollingScenario } from './server/sse-polling.ts';\nimport { ServerSSEMultipleStreamsScenario } from './server/sse-multiple-streams.ts';\n\nimport {\n ResourcesListScenario,\n ResourcesReadTextScenario,\n ResourcesReadBinaryScenario,\n ResourcesTemplateReadScenario,\n ResourcesSubscribeScenario,\n ResourcesUnsubscribeScenario,\n ResourcesNotFoundErrorScenario\n} from './server/resources.ts';\n\nimport {\n PromptsListScenario,\n PromptsGetSimpleScenario,\n PromptsGetWithArgsScenario,\n PromptsGetEmbeddedResourceScenario,\n PromptsGetWithImageScenario\n} from './server/prompts.ts';\n\nimport { DNSRebindingProtectionScenario } from './server/dns-rebinding.ts';\nimport { CachingScenario } from './server/caching.ts';\n\n// InputRequiredResult scenarios from (SEP-2322)\nimport {\n InputRequiredResultBasicElicitationScenario,\n InputRequiredResultBasicSamplingScenario,\n InputRequiredResultBasicListRootsScenario,\n InputRequiredResultRequestStateScenario,\n InputRequiredResultMultipleInputRequestsScenario,\n InputRequiredResultMultiRoundScenario,\n InputRequiredResultMissingInputResponseScenario,\n InputRequiredResultNonToolRequestScenario,\n InputRequiredResultResultTypeScenario,\n InputRequiredResultUnsupportedMethodsScenario,\n InputRequiredResultTamperedStateScenario,\n InputRequiredResultCapabilityCheckScenario,\n InputRequiredResultIgnoreExtraParamsScenario,\n InputRequiredResultValidateInputScenario\n} from './server/input-required-result.ts';\n\nimport {\n HttpHeaderValidationScenario,\n HttpCustomHeaderServerValidationScenario\n} from './server/http-standard-headers.ts';\n\nimport {\n authScenariosList,\n backcompatScenariosList,\n draftScenariosList,\n extensionScenariosList\n} from './client/auth/index.ts';\nimport { listMetadataScenarios } from './client/auth/discovery-metadata.ts';\nimport { AuthorizationServerMetadataEndpointScenario } from './authorization-server/authorization-server-metadata.ts';\n\nimport { HttpStandardHeadersScenario } from './client/http-standard-headers.ts';\nimport {\n HttpCustomHeadersScenario,\n HttpInvalidToolHeadersScenario\n} from './client/http-custom-headers.ts';\nimport { JsonSchemaRefDerefScenario } from './client/json-schema-ref-deref.ts';\n\n// Pending client scenarios (not yet fully tested/implemented)\nconst pendingClientScenariosList: ClientScenario[] = [\n // JSON Schema 2020-12 (SEP-1613)\n // This test is pending until the SDK includes PR #1135 which preserves\n // $schema, $defs, and additionalProperties fields in tool schemas.\n new JsonSchema2020_12Scenario(),\n\n // On hold until server-side SSE improvements are made\n // https://github.com/modelcontextprotocol/typescript-sdk/pull/1129\n new ServerSSEPollingScenario(),\n\n // HTTP Standardization (SEP-2243)\n // Pending until the everything-server fully implements SEP-2243\n // header validation (case-insensitive names, whitespace trimming, -32001 error code)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario()\n];\n\n// All client scenarios\nconst allClientScenariosList: ClientScenario[] = [\n // Lifecycle scenarios\n new ServerInitializeScenario(),\n new ServerStatelessScenario(),\n\n // Utilities scenarios\n new LoggingSetLevelScenario(),\n new PingScenario(),\n new CompletionCompleteScenario(),\n\n // Tools scenarios\n new ToolsListScenario(),\n new ToolsCallSimpleTextScenario(),\n new ToolsCallImageScenario(),\n new ToolsCallAudioScenario(),\n new ToolsCallEmbeddedResourceScenario(),\n new ToolsCallMultipleContentTypesScenario(),\n new ToolsCallWithLoggingScenario(),\n new ToolsCallErrorScenario(),\n new ToolsCallWithProgressScenario(),\n new ToolsCallSamplingScenario(),\n new ToolsCallElicitationScenario(),\n\n // JSON Schema 2020-12 support (SEP-1613)\n new JsonSchema2020_12Scenario(),\n\n // Elicitation scenarios (SEP-1034)\n new ElicitationDefaultsScenario(),\n\n // SSE Polling scenarios (SEP-1699)\n new ServerSSEPollingScenario(),\n new ServerSSEMultipleStreamsScenario(),\n\n // Elicitation scenarios (SEP-1330) - pending\n new ElicitationEnumsScenario(),\n\n // Resources scenarios\n new ResourcesListScenario(),\n new ResourcesReadTextScenario(),\n new ResourcesReadBinaryScenario(),\n new ResourcesTemplateReadScenario(),\n new ResourcesSubscribeScenario(),\n new ResourcesUnsubscribeScenario(),\n\n // Resources error handling (SEP-2164)\n new ResourcesNotFoundErrorScenario(),\n\n // Prompts scenarios\n new PromptsListScenario(),\n new PromptsGetSimpleScenario(),\n new PromptsGetWithArgsScenario(),\n new PromptsGetEmbeddedResourceScenario(),\n new PromptsGetWithImageScenario(),\n\n // Security scenarios\n new DNSRebindingProtectionScenario(),\n\n // Caching scenarios (SEP-2549)\n new CachingScenario(),\n // HTTP Standardization scenarios (SEP-2243)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario(),\n\n // InputRequiredResult scenarios (SEP-2322)\n new InputRequiredResultBasicElicitationScenario(),\n new InputRequiredResultBasicSamplingScenario(),\n new InputRequiredResultBasicListRootsScenario(),\n new InputRequiredResultRequestStateScenario(),\n new InputRequiredResultMultipleInputRequestsScenario(),\n new InputRequiredResultMultiRoundScenario(),\n new InputRequiredResultMissingInputResponseScenario(),\n new InputRequiredResultNonToolRequestScenario(),\n new InputRequiredResultResultTypeScenario(),\n new InputRequiredResultUnsupportedMethodsScenario(),\n new InputRequiredResultTamperedStateScenario(),\n new InputRequiredResultCapabilityCheckScenario(),\n new InputRequiredResultIgnoreExtraParamsScenario(),\n new InputRequiredResultValidateInputScenario()\n];\n\n// Scenarios that test requirements introduced in the in-progress draft spec.\n// They run via `--suite draft` (or `--suite all`) and are excluded from the\n// default `active` suite until the draft is published as a dated release.\nconst draftClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n );\n\n// Active client scenarios (excludes pending and draft)\nconst activeClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n !pendingClientScenariosList.some(\n (pending) => pending.name === scenario.name\n ) &&\n !draftClientScenariosList.some((draft) => draft.name === scenario.name)\n );\n\n// Client scenarios map - built from list\nexport const clientScenarios = new Map(\n allClientScenariosList.map((scenario) => [scenario.name, scenario])\n);\n\n// All client scenarios for authorization server\nconst allClientScenariosListForAuthorizationServer: ClientScenario[] = [\n // Authorization server scenarios\n new AuthorizationServerMetadataEndpointScenario()\n];\n\n// Client scenarios map for authorization server - built from list\nexport const clientScenariosForAuthorizationServer = new Map<\n string,\n ClientScenario\n>(\n allClientScenariosListForAuthorizationServer.map((scenario) => [\n scenario.name,\n scenario\n ])\n);\n\n// All client test scenarios (core + backcompat + extensions)\nconst scenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n new RequestMetadataScenario(),\n ...authScenariosList,\n ...backcompatScenariosList,\n ...draftScenariosList,\n ...extensionScenariosList,\n\n // MRTR client conformance (SEP-2322)\n new MRTRClientScenario(),\n\n // HTTP Standardization scenarios (SEP-2243)\n new HttpStandardHeadersScenario(),\n new HttpCustomHeadersScenario(),\n new HttpInvalidToolHeadersScenario(),\n\n // JSON Schema network $ref dereferencing (SEP-2106)\n new JsonSchemaRefDerefScenario(),\n\n // Stateless gauntlet — single server, validating tools, no run-id needed\n new StatelessGauntletScenario(),\n\n // Auth re-auth chain checker — token encodes progress through the rungs\n new AuthCheckerScenario()\n];\n\n// Core scenarios (tier 1 requirements)\nconst coreScenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n ...authScenariosList\n];\n\n// Scenarios map - built from list\nexport const scenarios = new Map(\n scenariosList.map((scenario) => [scenario.name, scenario])\n);\n\nexport function registerScenario(name: string, scenario: Scenario): void {\n scenarios.set(name, scenario);\n}\n\nexport function getScenario(name: string): Scenario | undefined {\n return scenarios.get(name);\n}\n\nexport function getClientScenario(name: string): ClientScenario | undefined {\n return clientScenarios.get(name);\n}\n\nexport function getClientScenarioForAuthorizationServer(\n name: string\n): ClientScenarioForAuthorizationServer | undefined {\n return clientScenariosForAuthorizationServer.get(name);\n}\n\nexport function listScenarios(): string[] {\n return Array.from(scenarios.keys());\n}\n\nexport function listClientScenarios(): string[] {\n return Array.from(clientScenarios.keys());\n}\n\nexport function listActiveClientScenarios(): string[] {\n return activeClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listPendingClientScenarios(): string[] {\n return pendingClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listAuthScenarios(): string[] {\n return authScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listCoreScenarios(): string[] {\n return coreScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listExtensionScenarios(): string[] {\n return extensionScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listBackcompatScenarios(): string[] {\n return backcompatScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listClientScenariosForAuthorizationServer(): string[] {\n return Array.from(clientScenariosForAuthorizationServer.keys());\n}\n\n// All client-testing scenarios that target the draft spec, derived from the\n// declared `source.introducedIn` rather than a hand-maintained list (covers\n// both the auth draft scenarios and the non-auth ones, e.g. SEP-2243/2575).\nconst draftSpecScenariosList: Scenario[] = scenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n);\n\nexport function listDraftScenarios(): string[] {\n return draftSpecScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listDraftClientScenarios(): string[] {\n return draftClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport { listMetadataScenarios };\n\n// All valid spec versions, used by the CLI to validate --spec-version input.\n// 'extension' is intentionally excluded — extension scenarios are off-timeline\n// and selected via `--suite extensions`, not `--spec-version`.\nexport const ALL_SPEC_VERSIONS: SpecVersion[] = [\n ...DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n];\n\nexport function resolveSpecVersion(value: string): SpecVersion {\n if (value === 'draft') return DRAFT_PROTOCOL_VERSION;\n if (ALL_SPEC_VERSIONS.includes(value as SpecVersion)) {\n return value as SpecVersion;\n }\n console.error(`Unknown spec version: ${value}`);\n console.error(\n `Valid versions: ${ALL_SPEC_VERSIONS.join(', ')} (or 'draft' as an alias for ${DRAFT_PROTOCOL_VERSION})`\n );\n process.exit(1);\n}\n\nfunction versionIndex(\n v: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION\n): number {\n return ALL_SPEC_VERSIONS.indexOf(v);\n}\n\n// Off-timeline sources (extensions etc.) are never selected by --spec-version.\nfunction matchesSpecVersion(\n source: ScenarioSource,\n version: SpecVersion\n): boolean {\n if ('extensionId' in source) return false;\n return (\n versionIndex(source.introducedIn) <= versionIndex(version) &&\n (source.removedIn === undefined ||\n versionIndex(version) < versionIndex(source.removedIn))\n );\n}\n\nexport function listScenariosForSpec(version: SpecVersion): string[] {\n return scenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForSpec(version: SpecVersion): string[] {\n return allClientScenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForAuthorizationServerForSpec(\n version: SpecVersion\n): string[] {\n return allClientScenariosListForAuthorizationServer\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function getScenarioSpecVersions(\n name: string\n): ScenarioSpecTag[] | undefined {\n const s =\n scenarios.get(name) ??\n clientScenarios.get(name) ??\n clientScenariosForAuthorizationServer.get(name);\n if (!s) return undefined;\n if ('extensionId' in s.source) return ['extension'];\n const result: ScenarioSpecTag[] = [];\n for (const v of ALL_SPEC_VERSIONS) {\n if (matchesSpecVersion(s.source, v)) result.push(v);\n }\n return result;\n}\n\nexport type { SpecVersion, ScenarioSpecTag };\n",[],[128,186,178],"scenarios","b6f6630c-f135-467b-8460-f1158f0e04dd",["D",1789043609699],[166],[128,186],"81fddb85-7958-40f1-8486-9040150bea52","store.ts","d343f09e-ad13-11f1-892b-1607ee4eb77e","11abc952-e3be-41e6-ac33-6929c3af1284",5,["D",1789043608531],"/**\n * Run persistence for the hosted conformance server.\n *\n * A long-lived Node process keeps every run in memory and needs none of this.\n * Serverless hosts (val.town, Deno Deploy, …) load-balance one run's requests\n * across short-lived isolates, so the isolate that answers GET /results is\n * often not the one that saw the MCP traffic. A RunStore lets each isolate\n * write through what it observed and lets any isolate serve a merged view:\n *\n * - run metadata (id → scenario) so an isolate that never saw the run can\n * still rebuild its handlers (aux-origin requests, results pages);\n * - checks, keyed by (run, writer): each isolate owns its own row and\n * replaces it wholesale after every request, so concurrent writers never\n * clobber each other and no append ordering is needed.\n *\n * The merged log is re-judged at results time by a fresh scenario instance\n * (see SessionManager.results), which is what turns \"isolate B never saw a\n * tools/call\" from a false FAILURE into the union of what A and B saw.\n */\n\nimport type { ConformanceCheck } from '../types.ts';\n\nexport interface RunStore {\n saveRun(id: string, scenarioName: string): Promise;\n /** Scenario name for a run id, or undefined if no isolate ever saw it. */\n loadRun(id: string): Promise;\n saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise;\n /** All writers' check lists for a run, keyed by writer id. */\n loadChecks(id: string): Promise>;\n deleteRun(id: string): Promise;\n}\n\n/** In-process store — used by tests to exercise the merge path. */\nexport class MemoryRunStore implements RunStore {\n private runs = new Map();\n private checks = new Map>();\n\n async saveRun(id: string, scenarioName: string): Promise {\n if (!this.runs.has(id)) this.runs.set(id, scenarioName);\n }\n async loadRun(id: string): Promise {\n return this.runs.get(id);\n }\n async saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise {\n let byWriter = this.checks.get(id);\n if (!byWriter) this.checks.set(id, (byWriter = new Map()));\n byWriter.set(\n writer,\n checks.map((c) => ({ ...c }))\n );\n }\n async loadChecks(id: string): Promise> {\n return new Map(this.checks.get(id) ?? []);\n }\n async deleteRun(id: string): Promise {\n this.runs.delete(id);\n this.checks.delete(id);\n }\n}\n",[],[128,200,192],"hosted","3032af6f-d845-4901-918a-2db95b6f2b50",["D",1789043610719],[],[128,200,32],"9dfe4842-b567-4fbf-95e3-81576c7acf0a","server.ts","d2f92186-ad13-11f1-b27a-1607ee4eb77e",["D",1789043608031],"/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * URL scheme (run-id is path-embedded so stateless-transport clients work):\n *\n * ALL /s//[/] Mounted scenario handler. The run\n * is created lazily on first hit;\n * pick any you like.\n * GET /s/ Convenience: mints a fresh run-id\n * and returns {mcpUrl, resultsUrl}.\n * GET /results/ JSON {summary, checks}\n * GET /results/.html Pretty HTML report\n * GET /scenarios JSON list of hostable scenarios\n * GET / Landing page\n * POST /mcp Meta-MCP: list_scenarios,\n * start_run, get_results\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each run gets a fresh Scenario instance.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { ServerResponse } from 'node:http';\nimport { timingSafeEqual } from 'node:crypto';\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n CallToolResult\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport {\n SessionManager,\n HostedRun,\n UnknownScenarioError,\n NotHostableError,\n listHostableScenarios\n} from './session.ts';\nimport { renderLanding, renderResults } from './html.ts';\nimport type { RunStore } from './store.ts';\nimport { getScenario } from '../scenarios/index.ts';\nimport {\n ConformanceCheck,\n AuxOriginRole,\n AuthHandlerScenario,\n RequestListener,\n Scenario\n} from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become hostable; their per-run AS issuer is\n * `/r/`. See examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n /**\n * Persist runs so a deployment that load-balances one run's requests\n * across processes (serverless isolates) still serves complete results.\n * See ./store.ts. Omit for a single long-lived process.\n */\n store?: RunStore;\n}\n\n/** Only allow run-ids that are safe in a single path segment. */\nconst RUN_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\n// ---------------------------------------------------------------------------\n// Stateless (\"/x\") mounting support.\n//\n// /x/ mounts a scenario with NO run-id and NO results polling: a\n// fresh scenario instance judges each request on its own content, and if the\n// request itself violates a conformance requirement the response is replaced\n// with a 400 explaining which checks failed. This only behaves sensibly for\n// scenarios whose checks are per-request (no cross-request memory) — which\n// is also exactly what serverless hosts with multiple isolates can support.\n// ---------------------------------------------------------------------------\n\n/** Scenarios whose checks need cross-request or timing state — excluded. */\nconst NOT_STATELESS = new Set(['sse-retry']);\n\n/**\n * The aux relay correlates flows by a /r/ in the path. In stateless\n * mode that segment encodes the scenario name instead of a run-id\n * ('auth/metadata-default' → 'x--auth--metadata-default'); run-ids can't\n * collide with it because '--' never appears in minted ids and the prefix is\n * reserved.\n */\nconst STATELESS_SLUG_PREFIX = 'x--';\nfunction statelessSlug(scenarioName: string): string {\n return STATELESS_SLUG_PREFIX + scenarioName.split('/').join('--');\n}\nfunction decodeStatelessSlug(segment: string): string | undefined {\n if (!segment.startsWith(STATELESS_SLUG_PREFIX)) return undefined;\n return segment.slice(STATELESS_SLUG_PREFIX.length).split('--').join('/');\n}\n\ninterface CapturedResponse {\n status: number;\n headers: Record;\n body: Buffer;\n}\n\n/**\n * Run a scenario listener against a buffered response so the outcome can be\n * judged (and replaced) after the handler finishes. Same interception\n * surface the valtown bridge uses: writeHead/setHeader/write/end and the\n * statusCode property — everything express and the SDK transport touch.\n */\nfunction runCaptured(\n listener: RequestListener,\n req: Request,\n rewrittenUrl: string\n): Promise {\n return new Promise((resolve, reject) => {\n const headers: Record = {};\n const chunks: Buffer[] = [];\n let status = 200;\n\n const fake = new ServerResponse(req) as ServerResponse;\n const captureHeaders = (\n h?: Record\n ): void => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n }\n };\n fake.setHeader = ((k: string, v: string | string[] | number) => {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n return fake;\n }) as ServerResponse['setHeader'];\n fake.getHeader = (k: string) => headers[k.toLowerCase()];\n fake.removeHeader = (k: string) => {\n delete headers[k.toLowerCase()];\n };\n fake.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return fake;\n }) as ServerResponse['writeHead'];\n fake.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n fake.flushHeaders = () => {};\n Object.defineProperty(fake, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n fake.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve({ status, headers, body: Buffer.concat(chunks) });\n return fake;\n }) as ServerResponse['end'];\n\n req.url = rewrittenUrl;\n try {\n listener(req, fake);\n } catch (e) {\n reject(e instanceof Error ? e : new Error(String(e)));\n }\n });\n}\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({\n ttlMs: opts.ttlMs,\n auxOrigins,\n store: opts.store\n });\n const app = express();\n const hostable = new Set(listHostableScenarios(haveAux));\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n function runBaseUrl(req: Request, scenario: string, runId: string): string {\n return `${origin(req)}/s/${scenario}/${runId}`;\n }\n\n /**\n * Resolve \"//\" against the hostable set.\n * Scenario names may contain '/', so try progressively longer prefixes.\n * Returns undefined if no hostable scenario matches the prefix.\n */\n function resolveRun(rest: string):\n | {\n scenarioName: string;\n runId: string | undefined;\n suffix: string;\n }\n | undefined {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate)) {\n const runId = segments[i] || undefined;\n const suffix = '/' + segments.slice(i + 1).join('/');\n return { scenarioName: candidate, runId, suffix };\n }\n }\n return undefined;\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the run-prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string\n ) {\n res.setHeader(\n 'link',\n `<${origin(req)}/results/${run.id}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n if (sessions.store) {\n // Write this process's view through once the scenario has answered\n // (hosted scenarios record their checks before calling end()).\n // Serverless entry points should await sessions.flush() before\n // returning the response so this write isn't abandoned.\n const end = res.end;\n res.end = function (this: Response, ...args: unknown[]) {\n const out = (end as (...a: unknown[]) => Response).apply(this, args);\n void sessions.persist(run);\n return out;\n } as Response['end'];\n }\n listener(req, res);\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res\n .type('html')\n .send(\n renderLanding(\n origin(req),\n Array.from(hostable),\n (name) => getScenario(name)?.steps\n )\n );\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n Array.from(hostable).map((name) => {\n const s = getScenario(name)!;\n return {\n name,\n description: s.description,\n source: s.source,\n mcpPath: s.mcpPath ?? '',\n ...(s.steps && { steps: s.steps })\n };\n })\n );\n });\n\n // ---------- scenario mounting ----------\n //\n // We can't pre-register an express route per (scenario, run-id) because\n // run-ids are open-ended. Instead a single catch-all route resolves the\n // run, rewrites req.url to strip the /s// prefix, and hands\n // off to the run's listener — exactly what app.use(prefix, fn) would do,\n // but with a dynamic prefix.\n\n app.all(/^\\/s\\/(.+)$/, (req, res, next) => {\n const rest = req.params[0]; // \"//\"\n const resolved = resolveRun(rest);\n if (!resolved) {\n // Distinguish \"exists but not hostable\" from \"unknown\"\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n if (getScenario(segments.slice(0, i).join('/'))) {\n res.status(501).json({\n error: `scenario '${segments.slice(0, i).join('/')}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, runId, suffix } = resolved;\n\n // GET /s/ with no run-id → mint one and tell the caller where\n // to point their client.\n if (!runId) {\n if (req.method !== 'GET') {\n res.status(400).json({\n error:\n 'Missing run-id. Use /s//, or GET /s/ to mint one.'\n });\n return;\n }\n try {\n const run = sessions.getOrCreate(scenarioName, undefined, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n res.json({\n runId: run.id,\n mcpUrl: `${runBaseUrl(req, scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${origin(req)}/results/${run.id}`,\n resultsHtmlUrl: `${origin(req)}/results/${run.id}.html`,\n context: contextFor(run)\n });\n } catch (e) {\n next(e);\n }\n return;\n }\n\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n\n let run;\n try {\n run = sessions.getOrCreate(scenarioName, runId, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n dispatch(\n run,\n run.listener,\n req,\n res,\n suffix === '/' ? run.mcpPath || '/' : suffix\n );\n });\n\n // ---------- stateless mounting (no run-id, fail-fast) ----------\n //\n // /x/[/] judges every request on its own content with a\n // fresh scenario instance. A request that records a FAILURE check gets a\n // 400 explaining what went wrong instead of the scenario's response — the\n // client-under-test finds out immediately, no results polling, no mint.\n\n interface StatelessInstance {\n scenario: Scenario;\n listener: RequestListener;\n auxListeners?: Partial>;\n mcpPath: string;\n }\n\n function instantiateStateless(\n scenarioName: string,\n baseUrl: string\n ): StatelessInstance {\n const proto = getScenario(scenarioName);\n if (!proto) throw new UnknownScenarioError(scenarioName);\n const Ctor = proto.constructor as new () => Scenario;\n const scenario = new Ctor();\n\n if (scenario instanceof AuthHandlerScenario) {\n const missing = scenario.auxRoles.filter((r) => !auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n scenarioName,\n `needs aux origin(s) [${missing.join(', ')}] — start with --as-origin`\n );\n }\n const handlers = scenario.authHandlers({\n getRsBaseUrl: () => baseUrl,\n getAuxBaseUrl: (role) =>\n `${auxOrigins[role]}/r/${statelessSlug(scenarioName)}`\n });\n return {\n scenario,\n listener: handlers.rs,\n auxListeners: handlers.aux,\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n if (scenario.handler) {\n return {\n scenario,\n listener: scenario.handler(() => baseUrl),\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n throw new NotHostableError(scenarioName);\n }\n\n /**\n * Resolve \"/\" (no run-id segment) against the\n * hostable set, longest scenario-name prefix first.\n */\n function resolveStateless(\n rest: string\n ): { scenarioName: string; suffix: string } | undefined {\n const segments = rest.split('/');\n for (let i = segments.length; i >= 1; i--) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate) && !NOT_STATELESS.has(candidate)) {\n return {\n scenarioName: candidate,\n suffix: '/' + segments.slice(i).join('/')\n };\n }\n }\n return undefined;\n }\n\n /** Emit the captured response, or replace it with a 400 on FAILUREs. */\n function finishStateless(\n res: Response,\n scenario: Scenario,\n captured: CapturedResponse,\n scenarioName: string\n ): void {\n const checks = scenario.rawChecks?.() ?? scenario.getChecks();\n const failures = checks.filter((c) => c.status === 'FAILURE');\n if (failures.length > 0) {\n res.status(400).json({\n error: 'conformance failure',\n scenario: scenarioName,\n failures: failures.map(({ id, description, details }) => ({\n id,\n description,\n details\n }))\n });\n return;\n }\n for (const [k, v] of Object.entries(captured.headers)) {\n res.setHeader(k, v);\n }\n res.setHeader(\n 'mcp-conformance',\n `pass; checks=${checks.filter((c) => c.status === 'SUCCESS').length}`\n );\n res.status(captured.status);\n res.end(captured.body.length ? captured.body : undefined);\n }\n\n app.all(/^\\/x\\/(.+)$/, async (req, res) => {\n const rest = req.params[0];\n const resolved = resolveStateless(rest);\n if (!resolved) {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (NOT_STATELESS.has(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' needs cross-request state and cannot run stateless — use /s/${candidate}/`\n });\n return;\n }\n if (getScenario(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, suffix } = resolved;\n\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n scenarioName,\n `${origin(req)}/x/${scenarioName}`\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n const captured = await runCaptured(\n inst.listener,\n req,\n (suffix === '/' ? inst.mcpPath || '/' : suffix) + search\n );\n finishStateless(res, inst.scenario, captured, scenarioName);\n });\n\n // RFC 8414 root well-known for stateless mounts that embed their own AS\n // (path-based issuer /x//): metadata lives at\n // /.well-known//x//.\n app.get(\n /^\\/\\.well-known\\/(oauth-authorization-server|openid-configuration)\\/x\\/(.+)$/,\n async (req, res) => {\n const doc = req.params[0];\n const resolved = resolveStateless(req.params[1]);\n if (!resolved) {\n res.status(404).json({ error: 'no scenario for this issuer path' });\n return;\n }\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n resolved.scenarioName,\n `${origin(req)}/x/${resolved.scenarioName}`\n );\n } catch {\n res.status(404).json({ error: 'no scenario for this issuer path' });\n return;\n }\n const rewritten =\n `/.well-known/${doc}` +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n const captured = await runCaptured(inst.listener, req, rewritten);\n finishStateless(res, inst.scenario, captured, resolved.scenarioName);\n }\n );\n\n // RFC 9728 root well-known for stateless mounts: PRM URL for MCP URL\n // /x//mcp is /.well-known/oauth-protected-resource/x//mcp.\n app.get(\n /^\\/\\.well-known\\/oauth-protected-resource\\/x\\/(.+)$/,\n async (req, res) => {\n const resolved = resolveStateless(req.params[0]);\n if (!resolved) {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n resolved.scenarioName,\n `${origin(req)}/x/${resolved.scenarioName}`\n );\n } catch {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n const captured = await runCaptured(inst.listener, req, rewritten);\n finishStateless(res, inst.scenario, captured, resolved.scenarioName);\n }\n );\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s///mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s///mcp —\n // i.e. at the *origin root*, not under the run prefix. We catch that here,\n // recover (scenario, run-id) from the path suffix, and re-dispatch to the\n // run's RS handler with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the run prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(/^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/, (req, res) => {\n const resolved = resolveRun(req.params[0]);\n if (!resolved?.runId || !RUN_ID_RE.test(resolved.runId)) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // getOrCreate, not get: on a multi-process host this may be the first\n // request this process sees for the run.\n let run;\n try {\n run = sessions.getOrCreate(resolved.scenarioName, resolved.runId, (id) =>\n runBaseUrl(req, resolved.scenarioName, id)\n );\n } catch {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n dispatch(run, run.listener, req, res, rewritten);\n });\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-run AS issuer is\n // /r/, so every path the client hits — endpoints\n // (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We extract the id, strip that segment, and\n // dispatch to the run's aux handler so it sees exactly the path\n // createAuthServer registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, async (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n // Find /r/ anywhere in the path and excise it.\n const m = path.match(/^(.*?)\\/r\\/([A-Za-z0-9_-]{1,64})(\\/.*)?$/);\n if (!m) {\n res\n .status(404)\n .json({ error: 'aux request path missing /r/ segment' });\n return;\n }\n const [, prefix, runId, suffix = ''] = m;\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n\n // Stateless flows encode the scenario name (not a run-id) in the /r/\n // segment; per-flow OAuth state rides inside the artifacts themselves\n // (auth code, token), so a fresh instance per request is enough.\n const slugScenario = decodeStatelessSlug(runId);\n if (slugScenario !== undefined) {\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n slugScenario,\n `${origin(req)}/x/${slugScenario}`\n );\n } catch {\n res\n .status(404)\n .json({ error: `no stateless scenario '${slugScenario}'` });\n return;\n }\n const listener = inst.auxListeners?.[role];\n if (!listener) {\n res.status(404).json({ error: `no aux '${role}' handler` });\n return;\n }\n const captured = await runCaptured(\n listener,\n req,\n (prefix + suffix || '/') + search\n );\n finishStateless(res, inst.scenario, captured, slugScenario);\n return;\n }\n\n const run = await sessions.ensure(runId, (s, id) =>\n runBaseUrl(req, s, id)\n );\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for run` });\n return;\n }\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get('/results/:id.html', async (req, res) => {\n const r = await sessions.results(req.params.id);\n if (!r) {\n res\n .status(404)\n .type('html')\n .send(`

No run ${escapeId(req.params.id)}

`);\n return;\n }\n res\n .type('html')\n .send(renderResults(r.scenarioName, req.params.id, r.checks));\n });\n\n app.get('/results/:id', async (req, res) => {\n const r = await sessions.results(req.params.id);\n if (!r) {\n res.status(404).json({ error: 'unknown run' });\n return;\n }\n res.json(summarise(r.scenarioName, req.params.id, r.checks));\n });\n\n app.delete('/results/:id', async (req, res) => {\n await sessions.destroy(req.params.id);\n res.status(204).end();\n });\n\n // ---------- meta MCP server ----------\n\n app.post('/mcp', express.json(), async (req, res) => {\n const server = createMetaMcpServer(sessions, origin(req), (s, id) =>\n runBaseUrl(req, s, id)\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n transport.close();\n server.close();\n });\n });\n\n return { app, sessions };\n}\n\nfunction summarise(scenario: string, id: string, checks: ConformanceCheck[]) {\n const counts = { SUCCESS: 0, FAILURE: 0, WARNING: 0, SKIPPED: 0, INFO: 0 };\n for (const c of checks) counts[c.status]++;\n return {\n runId: id,\n scenario,\n summary: {\n passed: counts.SUCCESS,\n failed: counts.FAILURE,\n warnings: counts.WARNING,\n info: counts.INFO,\n skipped: counts.SKIPPED,\n total: checks.length\n },\n checks\n };\n}\n\nfunction createMetaMcpServer(\n sessions: SessionManager,\n publicOrigin: string,\n runBaseUrl: (scenario: string, runId: string) => string\n): Server {\n const server = new Server(\n { name: 'mcp-conformance-hosted', version: '0.2.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [\n {\n name: 'list_scenarios',\n description:\n 'List client-conformance scenarios this hosted instance can serve.',\n inputSchema: { type: 'object', properties: {} }\n },\n {\n name: 'start_run',\n description:\n 'Create a fresh run for a scenario and return the MCP URL to point ' +\n 'the client-under-test at, plus the results URL. The run-id is ' +\n 'embedded in the path so this works with stateless transports.',\n inputSchema: {\n type: 'object',\n properties: {\n scenario: {\n type: 'string',\n description: 'Scenario name, e.g. \"initialize\" or \"tools_call\".'\n },\n run_id: {\n type: 'string',\n description:\n 'Optional. Supply your own [A-Za-z0-9_-]{1,64} id; ' +\n 'otherwise one is generated.'\n }\n },\n required: ['scenario']\n }\n },\n {\n name: 'get_results',\n description:\n 'Fetch the conformance checks recorded for a run. Same shape as ' +\n 'GET /results/.',\n inputSchema: {\n type: 'object',\n properties: { run_id: { type: 'string' } },\n required: ['run_id']\n }\n }\n ]\n }));\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n const args = (request.params.arguments ?? {}) as Record;\n switch (request.params.name) {\n case 'list_scenarios':\n return text(\n JSON.stringify(\n listHostableScenarios().map((name) => ({\n name,\n description: getScenario(name)!.description\n })),\n null,\n 2\n )\n );\n\n case 'start_run': {\n if (args.run_id && !RUN_ID_RE.test(args.run_id)) {\n return errorText(`invalid run_id (must match ${RUN_ID_RE})`);\n }\n try {\n const run = sessions.getOrCreate(args.scenario, args.run_id, (id) =>\n runBaseUrl(args.scenario, id)\n );\n return text(\n JSON.stringify(\n {\n runId: run.id,\n mcpUrl: `${runBaseUrl(run.scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${publicOrigin}/results/${run.id}`,\n resultsHtmlUrl: `${publicOrigin}/results/${run.id}.html`,\n context: contextFor(run)\n },\n null,\n 2\n )\n );\n } catch (e) {\n if (\n e instanceof UnknownScenarioError ||\n e instanceof NotHostableError\n ) {\n return errorText(e.message);\n }\n throw e;\n }\n }\n\n case 'get_results': {\n const r = await sessions.results(args.run_id);\n if (!r) return errorText(`no run '${args.run_id}'`);\n return text(\n JSON.stringify(\n summarise(r.scenarioName, args.run_id, r.checks),\n null,\n 2\n )\n );\n }\n\n default:\n return errorText(`unknown tool ${request.params.name}`);\n }\n }\n );\n\n return server;\n}\n\n/**\n * The context blob a client-under-test needs (pre-registered credentials\n * etc.), tagged with the scenario name the way the CLI runner's\n * MCP_CONFORMANCE_CONTEXT is, so it can be passed through verbatim.\n */\nfunction contextFor(run: HostedRun): Record | undefined {\n return run.context ? { name: run.scenarioName, ...run.context } : undefined;\n}\n\nfunction escapeId(id: string): string {\n return id.replace(/[^A-Za-z0-9_-]/g, '');\n}\n\nfunction text(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }] };\n}\n\nfunction errorText(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }], isError: true };\n}\n",[],[128,200,206],"a0d22a5e-a386-49ca-a95a-bb7150aff68d","html.ts","d43ddbd6-ad13-11f1-9006-1607ee4eb77e",8,["D",1789043610188],"import { ConformanceCheck, CheckStatus } from '../types.ts';\n\nconst STATUS_STYLE: Record = {\n SUCCESS: 'background:#d1fae5;color:#065f46',\n FAILURE: 'background:#fee2e2;color:#991b1b',\n WARNING: 'background:#fef3c7;color:#92400e',\n SKIPPED: 'background:#e5e7eb;color:#374151',\n INFO: 'background:#dbeafe;color:#1e40af'\n};\n\nconst css = `\n body{font:14px/1.5 ui-sans-serif,system-ui,sans-serif;max-width:960px;\n margin:2rem auto;padding:0 1rem;color:#111}\n code,pre{font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace}\n pre{background:#f6f8fa;padding:.75rem;border-radius:6px;overflow:auto}\n .pill{display:inline-block;padding:2px 8px;border-radius:10px;\n font-size:11px;font-weight:600}\n .check{border:1px solid #e5e7eb;border-radius:6px;padding:.75rem;\n margin:.5rem 0}\n .check h3{margin:0 0 .25rem;font-size:14px}\n details>summary{cursor:pointer;color:#6b7280;font-size:12px}\n table{border-collapse:collapse;width:100%}\n td,th{text-align:left;padding:.4rem .6rem;border-bottom:1px solid #eee}\n a{color:#2563eb}\n`;\n\nfunction esc(s: string): string {\n return s.replace(\n /[&<>\"]/g,\n (c) => ({ '&': '&', '<': '<', '>': '>', '\"': '"' })[c]!\n );\n}\n\nexport function renderLanding(\n origin: string,\n scenarios: string[],\n stepsFor: (name: string) => readonly unknown[] | undefined = () => undefined\n): string {\n const rows = scenarios\n .map((n) => {\n const steps = stepsFor(n);\n const steer = steps\n ? `

steps (${steps.length})

` +\n `

${esc(JSON.stringify(steps, null, 1))}

`\n : 'bespoke';\n return (\n `${esc(n)}` +\n `${esc(origin)}/s/${esc(n)}/<run-id>` +\n `${steer}` +\n `mint`\n );\n })\n .join('');\n return `\nMCP Conformance — hosted\n

MCP Conformance — hosted

Point your MCP client at /s/<scenario>/<run-id>.\nPick any <run-id> (e.g. local-1) — the run is\ncreated on first request, and because the id is in the path it works with\nstateless transports too. Then GET\n/results/<run-id> (append .html for a\nreport).

Too lazy to pick an id? GET /s/<scenario> mints one and\nreturns {mcpUrl, resultsUrl}.

This server is also an MCP server at ${esc(origin)}/mcp with\nlist_scenarios / start_run /\nget_results tools.

Generic steering: scenarios with a steps column need no\nscenario-specific client code — the mint response (and /scenarios)\ncarries context.steps, a closed op list\n(tools/list, tools/call, wait,\ndisconnect) that a dumb client can interpret. Pass the\ncontext object verbatim as MCP_CONFORMANCE_CONTEXT.

Scenarios (${scenarios.length})

\n${rows}

name	MCP URL pattern	client

Example

$ npx @modelcontextprotocol/inspector ${esc(origin)}/s/initialize/demo\n$ curl ${esc(origin)}/results/demo | jq .summary

`;\n}\n\nexport function renderResults(\n scenario: string,\n sessionId: string,\n checks: ConformanceCheck[]\n): string {\n const items = checks\n .map((c) => {\n const pill = `${c.status}`;\n const refs = (c.specReferences ?? [])\n .map((r) =>\n r.url\n ? `${esc(r.id)}`\n : `${esc(r.id)}`\n )\n .join(' · ');\n const details =\n c.details || c.errorMessage\n ? `

details

${esc(\n              JSON.stringify(\n                { errorMessage: c.errorMessage, ...c.details },\n                null,\n                2\n              )\n            )}

`\n : '';\n return `

${pill} `${esc(c.id)}` — ${esc(\n c.name\n )}

${esc(c.description)}

${refs}

${details}

`;\n })\n .join('');\n const passed = checks.filter((c) => c.status === 'SUCCESS').length;\n const failed = checks.filter((c) => c.status === 'FAILURE').length;\n return `\n${esc(scenario)} — ${sessionId}\n

`${esc(scenario)}`

session ${esc(sessionId)} — ${passed} passed, ${failed} failed,\n${checks.length} total

${items}`;\n}\n",[],[128,200,213],"eed5a261-eb58-445c-86c0-d3d5aef33e35",["D",1789043608031],[161,162,163,164],[128,200],["D",1789043608031],[160,165,167],[128],"3fea48ed-b846-446a-88ff-ade7b701cf22","valtown.ts","d143119e-ad13-11f1-80b9-1607ee4eb77e","33e15d6c-9b64-4c7e-ad30-c57b58f95711",["D",1789043605188],"/**\n * MCP conformance — val.town deployment.\n *\n * The hosted runner mounts each scenario's `handler()` (a Node\n * `RequestListener`) under `/s//`. On val.town the entry\n * point is a fetch handler, so we bridge web Request→Node req/res once and\n * reuse the *real* scenario implementations from the package — no\n * reimplementation, no loopback port.\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown.ts\";\n * export default handler;\n *\n * or copy this file in directly. Requires a runtime with Node-compat\n * (`node:http`, `node:stream`) — val.town, Deno Deploy, Bun all qualify.\n *\n * Limitation: scenarios that rely on long-lived SSE streams or connection-\n * close timing (`sse-retry`) won't behave correctly through a buffered\n * Request→Response bridge. They're filtered out below.\n */\n\nimport { createHostedApp } from '../../src/hosted/server.ts';\nimport { toFetchHandler } from './fetch-bridge.ts';\nimport { SqliteRunStore } from './valtown-store.ts';\n\nconst NOT_FETCH_SAFE = new Set(['sse-retry']);\n\n// Auth scenarios need a second public origin (RFC 8414 well-known is\n// origin-rooted). Deploy examples/hosted/valtown-relay.ts as a separate val\n// and point CONFORMANCE_AS_ORIGIN at it; both vals share\n// CONFORMANCE_RELAY_SECRET so /__aux can't be hit directly.\nconst { app, sessions } = createHostedApp({\n auxOrigins: {\n as: process.env.CONFORMANCE_AS_ORIGIN,\n as2: process.env.CONFORMANCE_AS2_ORIGIN,\n idp: process.env.CONFORMANCE_IDP_ORIGIN\n },\n relaySecret: process.env.CONFORMANCE_RELAY_SECRET,\n // val.town spreads one run's requests over several isolates; persist to\n // the account's SQLite so /results is the union of what they all saw.\n store: process.env.valtown ? new SqliteRunStore() : undefined\n});\n\nconst bridge = toFetchHandler(app);\n\nexport default async function (request: Request): Promise {\n const url = new URL(request.url);\n\n // Short-circuit scenarios that need true streaming.\n const m = url.pathname.match(/^\\/s\\/([^/]+)/);\n if (m && NOT_FETCH_SAFE.has(m[1])) {\n return Response.json(\n {\n error: `scenario '${m[1]}' relies on SSE stream lifecycle and is not available via the fetch bridge`\n },\n { status: 501 }\n );\n }\n\n const response = await bridge(request);\n // The bridge buffers until end(), by which point the scenario has recorded\n // its checks and the write-through has started; finish it before the\n // isolate is allowed to go idle.\n await sessions.flush();\n return response;\n}\n",[],[138,200,228],"b14b49be-62d3-4e6f-832e-253eafc52650","valtown-store.ts","d1ffa5b6-ad13-11f1-8f33-1607ee4eb77e",["D",1789043606355],"/**\n * RunStore backed by val.town's per-account SQLite (REST API).\n *\n * val.town injects an API token into every val as the `valtown` env var; the\n * SQLite API is `POST /v1/sqlite/execute {statement:{sql,args}}`. Two tables,\n * created lazily once per isolate. Old runs are swept on new-run creation,\n * throttled per isolate, so the database stays bounded without a cron.\n */\n\nimport type { ConformanceCheck } from '../../src/types.ts';\nimport type { RunStore } from '../../src/hosted/store.ts';\n\nconst API = 'https://api.val.town/v1/sqlite/execute';\n\nexport interface SqliteRunStoreOptions {\n token?: string;\n /** Runs older than this are swept. Default 6h. */\n retentionMs?: number;\n /** Cap on checks persisted per (run, writer). Default 1000. */\n maxChecks?: number;\n}\n\ntype Row = unknown[];\n\nexport class SqliteRunStore implements RunStore {\n private readonly token: string;\n private readonly retentionMs: number;\n private readonly maxChecks: number;\n private ready: Promise | undefined;\n private lastSweep = 0;\n\n constructor(opts: SqliteRunStoreOptions = {}) {\n const token = opts.token ?? process.env.valtown;\n if (!token)\n throw new Error('SqliteRunStore: no val.town token (env valtown)');\n this.token = token;\n this.retentionMs =\n opts.retentionMs ??\n Number(process.env.CONFORMANCE_RUN_RETENTION_MS ?? 6 * 3600_000);\n this.maxChecks = opts.maxChecks ?? 1000;\n }\n\n private async exec(sql: string, args: unknown[] = []): Promise {\n const res = await fetch(API, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${this.token}`,\n 'Content-Type': 'application/json'\n },\n body: JSON.stringify({ statement: { sql, args } })\n });\n if (!res.ok) {\n throw new Error(\n `sqlite ${res.status}: ${(await res.text()).slice(0, 200)}`\n );\n }\n const body = (await res.json()) as { rows?: Row[] };\n return body.rows ?? [];\n }\n\n private init(): Promise {\n this.ready ??= (async () => {\n await this.exec(\n `CREATE TABLE IF NOT EXISTS hosted_runs_v2 (\n id TEXT PRIMARY KEY, scenario TEXT NOT NULL, created_at INTEGER NOT NULL)`\n );\n await this.exec(\n `CREATE TABLE IF NOT EXISTS hosted_checks_v2 (\n run_id TEXT NOT NULL, writer TEXT NOT NULL, checks TEXT NOT NULL,\n updated_at INTEGER NOT NULL, PRIMARY KEY (run_id, writer))`\n );\n })().catch((e) => {\n this.ready = undefined;\n throw e;\n });\n return this.ready;\n }\n\n async saveRun(id: string, scenarioName: string): Promise {\n await this.init();\n await this.exec(\n `INSERT INTO hosted_runs_v2 (id, scenario, created_at) VALUES (?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET scenario = excluded.scenario`,\n [id, scenarioName, Date.now()]\n );\n void this.sweep().catch(() => {});\n }\n\n async loadRun(id: string): Promise {\n await this.init();\n const rows = await this.exec(\n `SELECT scenario FROM hosted_runs_v2 WHERE id = ?`,\n [id]\n );\n return rows[0]?.[0] as string | undefined;\n }\n\n async saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise {\n await this.init();\n await this.exec(\n `INSERT INTO hosted_checks_v2 (run_id, writer, checks, updated_at)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(run_id, writer) DO UPDATE\n SET checks = excluded.checks, updated_at = excluded.updated_at`,\n [id, writer, JSON.stringify(checks.slice(-this.maxChecks)), Date.now()]\n );\n }\n\n async loadChecks(id: string): Promise> {\n await this.init();\n const rows = await this.exec(\n `SELECT writer, checks FROM hosted_checks_v2 WHERE run_id = ?`,\n [id]\n );\n const out = new Map();\n for (const [writer, checks] of rows) {\n try {\n out.set(writer as string, JSON.parse(checks as string));\n } catch {\n // corrupt row — ignore\n }\n }\n return out;\n }\n\n async deleteRun(id: string): Promise {\n await this.init();\n await this.exec(`DELETE FROM hosted_checks_v2 WHERE run_id = ?`, [id]);\n await this.exec(`DELETE FROM hosted_runs_v2 WHERE id = ?`, [id]);\n }\n\n private async sweep(): Promise {\n const now = Date.now();\n if (now - this.lastSweep < 5 * 60_000) return;\n this.lastSweep = now;\n const cutoff = now - this.retentionMs;\n await this.exec(\n `DELETE FROM hosted_checks_v2 WHERE run_id IN\n (SELECT id FROM hosted_runs_v2 WHERE created_at < ?)`,\n [cutoff]\n );\n await this.exec(`DELETE FROM hosted_runs_v2 WHERE created_at < ?`, [\n cutoff\n ]);\n }\n}\n",[],[138,200,236],"3c480d6a-84b6-44ba-8074-7a713ef574d2","fetch-bridge.ts","d2578a38-ad13-11f1-ad25-1607ee4eb77e",3,["D",1789043606991],"/**\n * Web fetch ↔ Node bridge: adapt a Node RequestListener (express app) to a\n * fetch-style handler for serverless runtimes (val.town, Deno Deploy, Bun).\n *\n * Intercepts the user-facing write surface (writeHead/setHeader/write/end)\n * so we never touch ServerResponse's socket-coupled internals — the approach\n * serverless-http and light-my-request take.\n */\n\nimport { IncomingMessage, ServerResponse } from 'node:http';\nimport { Socket } from 'node:net';\n\ntype NodeListener = (req: IncomingMessage, res: ServerResponse) => void;\n\nexport function toFetchHandler(\n listener: NodeListener\n): (request: Request) => Promise {\n return async (request: Request): Promise => {\n const url = new URL(request.url);\n\n // --- web Request → Node IncomingMessage ---\n const body = request.body\n ? Buffer.from(await request.arrayBuffer())\n : undefined;\n // Express's req.protocol/req.ip read socket.encrypted/.remoteAddress,\n // and IncomingMessage._destroy calls socket.destroy(), so a real\n // (unconnected) Socket with the encrypted flag patched on is the path\n // of least surprise.\n const socket = Object.assign(new Socket(), { encrypted: false });\n const nodeReq = new IncomingMessage(socket);\n nodeReq.method = request.method;\n nodeReq.url = url.pathname + url.search;\n nodeReq.httpVersion = '1.1';\n nodeReq.httpVersionMajor = 1;\n nodeReq.httpVersionMinor = 1;\n nodeReq.headers = Object.fromEntries(request.headers);\n nodeReq.headers.host ??= url.host;\n if (body?.length) nodeReq.headers['content-length'] = String(body.length);\n // The SDK's StreamableHTTPServerTransport converts Node→Web via\n // @hono/node-server, which reads rawHeaders (the [k,v,k,v,...] array),\n // not the parsed headers object. Deno's node:http compat exposes\n // rawHeaders as a getter-only accessor, so shadow it with an own\n // property instead of assigning.\n Object.defineProperty(nodeReq, 'rawHeaders', {\n value: Object.entries(nodeReq.headers).flat() as string[],\n writable: true,\n configurable: true\n });\n if (body?.length) nodeReq.push(body);\n nodeReq.push(null);\n\n // --- Node ServerResponse → web Response ---\n const nodeRes = new ServerResponse(nodeReq);\n const chunks: Buffer[] = [];\n let status = 200;\n const headers = new Headers();\n\n const captureHeaders = (h?: Record) => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n }\n };\n nodeRes.setHeader = ((k: string, v: string | string[] | number) => {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n return nodeRes;\n }) as ServerResponse['setHeader'];\n nodeRes.getHeader = (k: string) =>\n headers.get(k.toLowerCase()) ?? undefined;\n nodeRes.removeHeader = (k: string) => headers.delete(k);\n nodeRes.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return nodeRes;\n }) as ServerResponse['writeHead'];\n nodeRes.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n nodeRes.flushHeaders = () => {};\n Object.defineProperty(nodeRes, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n\n return new Promise((resolve) => {\n nodeRes.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve(\n new Response(chunks.length ? Buffer.concat(chunks) : null, {\n status,\n headers\n })\n );\n return nodeRes;\n }) as ServerResponse['end'];\n\n listener(nodeReq, nodeRes);\n });\n };\n}\n",[],[138,200,243],"e0d4ff66-2d0b-4b92-9d52-7466f5cd524c",["D",1789043605188],[156,157,158],[138,200],["D",1789043605188],[155],[138],["D",1789043604380],{"_95":94,"_102":-5},{"_95":94,"_96":97,"_98":-5,"_18":-5,"_99":100,"_101":24},{"_13":84,"_31":85,"_42":41,"_86":43,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":44,"_93":94},"ctx",{"_77":-5,"_122":294,"_295":296,"_297":298,"_299":24,"_300":24,"_301":24,"_302":57,"_303":-5,"_304":-7,"_305":-7,"_306":61,"_307":24,"_308":24,"_309":-5,"_310":24,"_311":24,"_312":24,"_313":-5},"ENV",{"_265":266,"_267":268,"_269":85,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

MCP Conformance — hosted

Scenarios (${scenarios.length})

Example

${pill} ${esc(c.id)} — ${esc(\n c.name\n )}

${esc(scenario)}

${pill} `${esc(c.id)}` — ${esc(\n c.name\n )}

`${esc(scenario)}`

Diff · v9