[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_197":198,"_199":200},"routes/_app.x.$handle.$name",{"_105":104,"_33":56,"_113":95,"_28":114,"_13":14,"_115":-5,"_11":116,"_117":118,"_119":120,"_121":122,"_123":124,"_22":-5,"_125":-5,"_126":-5,"_127":26,"_128":129,"_130":26,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_54":55,"_33":56,"_38":57,"_58":-5,"_59":26,"_60":61,"_62":61,"_63":-5,"_64":-5,"_18":65,"_66":-5,"_67":26,"_68":-5,"_69":-5,"_70":71,"_72":73,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":26},"version",2,"changes",[19,20,21],"aiChatInfo","userId",{"_22":50,"_24":-7,"_25":26,"_27":26,"_28":51,"_30":51},{"_22":43,"_24":-7,"_25":26,"_27":26,"_28":44,"_30":44},{"_22":23,"_24":-7,"_25":26,"_27":26,"_28":29,"_30":29},"file",{"_31":32,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":14,"_41":42,"_25":26},"previous","deleted",false,"deletedHere","path","src/hosted","latestPath","fileId","c962419b-89c2-42ca-bb90-1cccfe244f57","name","hosted","fileType","directory","content","createdAt",["D",1780062355087],"branchVersion","branchId","b62d0bb8-5b64-11f1-a2b2-ee650bb23af1",{"_31":45,"_33":46,"_35":47,"_37":48,"_38":49,"_40":14,"_41":42,"_25":26},"src/hosted/server.ts","b70c0f02-5b64-11f1-8713-ee650bb23af1","server.ts","script","/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * URL scheme (run-id is path-embedded so stateless-transport clients work):\n *\n * ALL /s//[/] Mounted scenario handler. The run\n * is created lazily on first hit;\n * pick any you like.\n * GET /s/ Convenience: mints a fresh run-id\n * and returns {mcpUrl, resultsUrl}.\n * GET /results/ JSON {summary, checks}\n * GET /results/.html Pretty HTML report\n * GET /scenarios JSON list of hostable scenarios\n * GET / Landing page\n * POST /mcp Meta-MCP: list_scenarios,\n * start_run, get_results\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each run gets a fresh Scenario instance.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { timingSafeEqual } from 'node:crypto';\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n CallToolResult\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport {\n SessionManager,\n HostedRun,\n UnknownScenarioError,\n NotHostableError,\n listHostableScenarios\n} from './session.ts';\nimport { renderLanding, renderResults } from './html.ts';\nimport { getScenario } from '../scenarios/index.ts';\nimport { ConformanceCheck, AuxOriginRole } from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become hostable; their per-run AS issuer is\n * `/r/`. See examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n}\n\n/** Only allow run-ids that are safe in a single path segment. */\nconst RUN_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({ ttlMs: opts.ttlMs, auxOrigins });\n const app = express();\n const hostable = new Set(listHostableScenarios(haveAux));\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n function runBaseUrl(req: Request, scenario: string, runId: string): string {\n return `${origin(req)}/s/${scenario}/${runId}`;\n }\n\n /**\n * Resolve \"//\" against the hostable set.\n * Scenario names may contain '/', so try progressively longer prefixes.\n * Returns undefined if no hostable scenario matches the prefix.\n */\n function resolveRun(rest: string):\n | {\n scenarioName: string;\n runId: string | undefined;\n suffix: string;\n }\n | undefined {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate)) {\n const runId = segments[i] || undefined;\n const suffix = '/' + segments.slice(i + 1).join('/');\n return { scenarioName: candidate, runId, suffix };\n }\n }\n return undefined;\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the run-prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string\n ) {\n res.setHeader(\n 'link',\n `<${origin(req)}/results/${run.id}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n listener(req, res);\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res.type('html').send(renderLanding(origin(req), Array.from(hostable)));\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n Array.from(hostable).map((name) => {\n const s = getScenario(name)!;\n return {\n name,\n description: s.description,\n source: s.source,\n mcpPath: s.mcpPath ?? ''\n };\n })\n );\n });\n\n // ---------- scenario mounting ----------\n //\n // We can't pre-register an express route per (scenario, run-id) because\n // run-ids are open-ended. Instead a single catch-all route resolves the\n // run, rewrites req.url to strip the /s// prefix, and hands\n // off to the run's listener — exactly what app.use(prefix, fn) would do,\n // but with a dynamic prefix.\n\n app.all(/^\\/s\\/(.+)$/, (req, res, next) => {\n const rest = req.params[0]; // \"//\"\n const resolved = resolveRun(rest);\n if (!resolved) {\n // Distinguish \"exists but not hostable\" from \"unknown\"\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n if (getScenario(segments.slice(0, i).join('/'))) {\n res.status(501).json({\n error: `scenario '${segments.slice(0, i).join('/')}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, runId, suffix } = resolved;\n\n // GET /s/ with no run-id → mint one and tell the caller where\n // to point their client.\n if (!runId) {\n if (req.method !== 'GET') {\n res.status(400).json({\n error:\n 'Missing run-id. Use /s//, or GET /s/ to mint one.'\n });\n return;\n }\n try {\n const run = sessions.getOrCreate(scenarioName, undefined, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n res.json({\n runId: run.id,\n mcpUrl: `${runBaseUrl(req, scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${origin(req)}/results/${run.id}`,\n resultsHtmlUrl: `${origin(req)}/results/${run.id}.html`,\n context: run.context\n });\n } catch (e) {\n next(e);\n }\n return;\n }\n\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n\n let run;\n try {\n run = sessions.getOrCreate(scenarioName, runId, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n dispatch(\n run,\n run.listener,\n req,\n res,\n suffix === '/' ? run.mcpPath || '/' : suffix\n );\n });\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s///mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s///mcp —\n // i.e. at the *origin root*, not under the run prefix. We catch that here,\n // recover (scenario, run-id) from the path suffix, and re-dispatch to the\n // run's RS handler with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the run prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(/^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/, (req, res) => {\n const resolved = resolveRun(req.params[0]);\n if (!resolved?.runId || !RUN_ID_RE.test(resolved.runId)) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n const run = sessions.get(resolved.runId);\n if (!run) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n dispatch(run, run.listener, req, res, rewritten);\n });\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-run AS issuer is\n // /r/, so every path the client hits — endpoints\n // (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We extract the id, strip that segment, and\n // dispatch to the run's aux handler so it sees exactly the path\n // createAuthServer registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n // Find /r/ anywhere in the path and excise it.\n const m = path.match(/^(.*?)\\/r\\/([A-Za-z0-9_-]{1,64})(\\/.*)?$/);\n if (!m) {\n res\n .status(404)\n .json({ error: 'aux request path missing /r/ segment' });\n return;\n }\n const [, prefix, runId, suffix = ''] = m;\n const run = sessions.get(runId);\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for run` });\n return;\n }\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get('/results/:id.html', (req, res) => {\n const run = sessions.get(req.params.id);\n const checks = sessions.results(req.params.id);\n if (!run || !checks) {\n res\n .status(404)\n .type('html')\n .send(`

No run ${req.params.id}

`);\n return;\n }\n res.type('html').send(renderResults(run.scenarioName, run.id, checks));\n });\n\n app.get('/results/:id', (req, res) => {\n const run = sessions.get(req.params.id);\n const checks = sessions.results(req.params.id);\n if (!run || !checks) {\n res.status(404).json({ error: 'unknown run' });\n return;\n }\n res.json(summarise(run.scenarioName, run.id, checks));\n });\n\n app.delete('/results/:id', async (req, res) => {\n await sessions.destroy(req.params.id);\n res.status(204).end();\n });\n\n // ---------- meta MCP server ----------\n\n app.post('/mcp', express.json(), async (req, res) => {\n const server = createMetaMcpServer(sessions, origin(req), (s, id) =>\n runBaseUrl(req, s, id)\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n transport.close();\n server.close();\n });\n });\n\n return { app, sessions };\n}\n\nfunction summarise(scenario: string, id: string, checks: ConformanceCheck[]) {\n const counts = { SUCCESS: 0, FAILURE: 0, WARNING: 0, SKIPPED: 0, INFO: 0 };\n for (const c of checks) counts[c.status]++;\n return {\n runId: id,\n scenario,\n summary: {\n passed: counts.SUCCESS,\n failed: counts.FAILURE,\n warnings: counts.WARNING,\n info: counts.INFO,\n skipped: counts.SKIPPED,\n total: checks.length\n },\n checks\n };\n}\n\nfunction createMetaMcpServer(\n sessions: SessionManager,\n publicOrigin: string,\n runBaseUrl: (scenario: string, runId: string) => string\n): Server {\n const server = new Server(\n { name: 'mcp-conformance-hosted', version: '0.2.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [\n {\n name: 'list_scenarios',\n description:\n 'List client-conformance scenarios this hosted instance can serve.',\n inputSchema: { type: 'object', properties: {} }\n },\n {\n name: 'start_run',\n description:\n 'Create a fresh run for a scenario and return the MCP URL to point ' +\n 'the client-under-test at, plus the results URL. The run-id is ' +\n 'embedded in the path so this works with stateless transports.',\n inputSchema: {\n type: 'object',\n properties: {\n scenario: {\n type: 'string',\n description: 'Scenario name, e.g. \"initialize\" or \"tools_call\".'\n },\n run_id: {\n type: 'string',\n description:\n 'Optional. Supply your own [A-Za-z0-9_-]{1,64} id; ' +\n 'otherwise one is generated.'\n }\n },\n required: ['scenario']\n }\n },\n {\n name: 'get_results',\n description:\n 'Fetch the conformance checks recorded for a run. Same shape as ' +\n 'GET /results/.',\n inputSchema: {\n type: 'object',\n properties: { run_id: { type: 'string' } },\n required: ['run_id']\n }\n }\n ]\n }));\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n const args = (request.params.arguments ?? {}) as Record;\n switch (request.params.name) {\n case 'list_scenarios':\n return text(\n JSON.stringify(\n listHostableScenarios().map((name) => ({\n name,\n description: getScenario(name)!.description\n })),\n null,\n 2\n )\n );\n\n case 'start_run': {\n if (args.run_id && !RUN_ID_RE.test(args.run_id)) {\n return errorText(`invalid run_id (must match ${RUN_ID_RE})`);\n }\n try {\n const run = sessions.getOrCreate(args.scenario, args.run_id, (id) =>\n runBaseUrl(args.scenario, id)\n );\n return text(\n JSON.stringify(\n {\n runId: run.id,\n mcpUrl: `${runBaseUrl(run.scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${publicOrigin}/results/${run.id}`,\n resultsHtmlUrl: `${publicOrigin}/results/${run.id}.html`,\n context: run.context\n },\n null,\n 2\n )\n );\n } catch (e) {\n if (\n e instanceof UnknownScenarioError ||\n e instanceof NotHostableError\n ) {\n return errorText(e.message);\n }\n throw e;\n }\n }\n\n case 'get_results': {\n const run = sessions.get(args.run_id);\n const checks = sessions.results(args.run_id);\n if (!run || !checks) return errorText(`no run '${args.run_id}'`);\n return text(\n JSON.stringify(summarise(run.scenarioName, run.id, checks), null, 2)\n );\n }\n\n default:\n return errorText(`unknown tool ${request.params.name}`);\n }\n }\n );\n\n return server;\n}\n\nfunction text(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }] };\n}\n\nfunction errorText(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }], isError: true };\n}\n",["D",1780062355087],{"_31":52,"_33":51,"_35":36,"_37":-5,"_38":53,"_40":14,"_41":42,"_25":26},"src","724673a5-9883-491f-af30-67377464f321",["D",1780062355087],"id","b6283b42-5b64-11f1-a2b2-ee650bb23af1","mcp-conformance",["D",1780062353614],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_105":104,"_112":108},"org",{"_105":104,"_106":-5,"_107":108,"_18":65,"_109":110,"_111":26},"branch",{"_13":94,"_33":95,"_54":42,"_96":55,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":56,"_103":104},"isOwned",108,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_54":55,"_33":56,"_38":193,"_58":-5,"_59":26,"_60":61,"_62":61,"_63":-5,"_64":-5,"_18":65,"_66":-5,"_67":26,"_68":-5,"_69":-5,"_70":71,"_72":73,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":194,"_89":195,"_91":196,"_93":26},"tree",[160,163],"files",[160,161,162,163,164,165],"counts",{"_150":71,"_151":147,"_152":71,"_153":154,"_155":156},"contents",[135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_54":144,"_33":145,"_31":146,"_138":-5,"_41":42,"_40":147,"_139":140,"_38":148,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_28":149},{"_54":137,"_33":51,"_31":52,"_138":-5,"_41":42,"_40":14,"_139":140,"_38":141,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_28":143},"b70c7d16-5b64-11f1-8713-ee650bb23af1","parentId","latest",true,["D",1780062355087],"label",[51],"b6abbca6-5b64-11f1-bb92-ee650bb23af1","examples","52dfe22a-3fc8-4d4b-b364-a3c11b4e7425",1,["D",1780062354427],[145],"pulls","branches","forks","envVars",{"_157":14,"_159":71},"connections",{"_157":71,"_158":71},"count","unfilledCount","emptyCount",{"_54":144,"_33":145,"_31":146,"_138":-5,"_41":42,"_40":147,"_139":140,"_38":190,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_168":191,"_28":192},{"_54":186,"_33":34,"_31":181,"_138":146,"_41":42,"_40":147,"_139":140,"_38":187,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_168":188,"_28":189},{"_54":178,"_33":179,"_31":180,"_138":181,"_41":42,"_40":147,"_139":26,"_38":182,"_13":71,"_35":47,"_37":183,"_25":26,"_142":-5,"_168":184,"_28":185},{"_54":137,"_33":51,"_31":52,"_138":-5,"_41":42,"_40":14,"_139":140,"_38":175,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_168":176,"_28":177},{"_54":171,"_33":34,"_31":32,"_138":52,"_41":42,"_40":14,"_139":140,"_38":172,"_13":71,"_35":36,"_37":-5,"_25":26,"_142":-5,"_168":173,"_28":174},{"_54":166,"_33":46,"_31":45,"_138":32,"_41":42,"_40":14,"_139":26,"_38":167,"_13":71,"_35":47,"_37":48,"_25":26,"_142":-5,"_168":169,"_28":170},"b70c0e4e-5b64-11f1-8713-ee650bb23af1",["D",1780062355087],"children",[],[51,34,46],"b70c7fc8-5b64-11f1-8713-ee650bb23af1",["D",1780062355087],[165],[51,34],["D",1780062355087],[164],[51],"b6ab618e-5b64-11f1-bb92-ee650bb23af1","valtown.ts","b6ab6260-5b64-11f1-bb92-ee650bb23af1","cc09b591-ab36-47d7-a7a0-618641fcafb7",["D",1780062354427],"/**\n * MCP conformance — val.town deployment.\n *\n * The hosted runner mounts each scenario's `handler()` (a Node\n * `RequestListener`) under `/s//`. On val.town the entry\n * point is a fetch handler, so we bridge web Request→Node req/res once and\n * reuse the *real* scenario implementations from the package — no\n * reimplementation, no loopback port.\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown.ts\";\n * export default handler;\n *\n * or copy this file in directly. Requires a runtime with Node-compat\n * (`node:http`, `node:stream`) — val.town, Deno Deploy, Bun all qualify.\n *\n * Limitation: scenarios that rely on long-lived SSE streams or connection-\n * close timing (`sse-retry`) won't behave correctly through a buffered\n * Request→Response bridge. They're filtered out below.\n */\n\nimport { IncomingMessage, ServerResponse } from 'node:http';\nimport { Socket } from 'node:net';\nimport { createHostedApp } from '../../src/hosted/server.ts';\n\nconst NOT_FETCH_SAFE = new Set(['sse-retry']);\n\n// Auth scenarios need a second public origin (RFC 8414 well-known is\n// origin-rooted). Deploy examples/hosted/valtown-relay.ts as a separate val\n// and point CONFORMANCE_AS_ORIGIN at it; both vals share\n// CONFORMANCE_RELAY_SECRET so /__aux can't be hit directly.\nconst { app } = createHostedApp({\n auxOrigins: {\n as: process.env.CONFORMANCE_AS_ORIGIN,\n as2: process.env.CONFORMANCE_AS2_ORIGIN,\n idp: process.env.CONFORMANCE_IDP_ORIGIN\n },\n relaySecret: process.env.CONFORMANCE_RELAY_SECRET\n});\n\nexport default async function (request: Request): Promise {\n const url = new URL(request.url);\n\n // Short-circuit scenarios that need true streaming.\n const m = url.pathname.match(/^\\/s\\/([^/]+)/);\n if (m && NOT_FETCH_SAFE.has(m[1])) {\n return Response.json(\n {\n error: `scenario '${m[1]}' relies on SSE stream lifecycle and is not available via the fetch bridge`\n },\n { status: 501 }\n );\n }\n\n // --- web Request → Node IncomingMessage ---\n const body = request.body\n ? Buffer.from(await request.arrayBuffer())\n : undefined;\n // Express's req.protocol/req.ip read socket.encrypted/.remoteAddress, and\n // IncomingMessage._destroy calls socket.destroy(), so a real (unconnected)\n // Socket with the encrypted flag patched on is the path of least surprise.\n const socket = Object.assign(new Socket(), { encrypted: false });\n const nodeReq = new IncomingMessage(socket);\n nodeReq.method = request.method;\n nodeReq.url = url.pathname + url.search;\n nodeReq.httpVersion = '1.1';\n nodeReq.httpVersionMajor = 1;\n nodeReq.httpVersionMinor = 1;\n nodeReq.headers = Object.fromEntries(request.headers);\n nodeReq.headers.host ??= url.host;\n if (body?.length) nodeReq.headers['content-length'] = String(body.length);\n // The SDK's StreamableHTTPServerTransport converts Node→Web via\n // @hono/node-server, which reads rawHeaders (the [k,v,k,v,...] array),\n // not the parsed headers object. Deno's node:http compat exposes\n // rawHeaders as a getter-only accessor, so shadow it with an own\n // property instead of assigning.\n Object.defineProperty(nodeReq, 'rawHeaders', {\n value: Object.entries(nodeReq.headers).flat() as string[],\n writable: true,\n configurable: true\n });\n if (body?.length) nodeReq.push(body);\n nodeReq.push(null);\n\n // --- Node ServerResponse → web Response ---\n // Intercept the user-facing write surface (writeHead/setHeader/write/end)\n // so we never touch ServerResponse's socket-coupled internals. This is the\n // approach serverless-http and light-my-request take.\n const nodeRes = new ServerResponse(nodeReq);\n const chunks: Buffer[] = [];\n let status = 200;\n const headers = new Headers();\n\n const captureHeaders = (h?: Record) => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n }\n };\n nodeRes.setHeader = ((k: string, v: string | string[] | number) => {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n return nodeRes;\n }) as ServerResponse['setHeader'];\n nodeRes.getHeader = (k: string) => headers.get(k.toLowerCase()) ?? undefined;\n nodeRes.removeHeader = (k: string) => headers.delete(k);\n nodeRes.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return nodeRes;\n }) as ServerResponse['writeHead'];\n nodeRes.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n nodeRes.flushHeaders = () => {};\n Object.defineProperty(nodeRes, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n\n return new Promise((resolve) => {\n nodeRes.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve(\n new Response(chunks.length ? Buffer.concat(chunks) : null, {\n status,\n headers\n })\n );\n return nodeRes;\n }) as ServerResponse['end'];\n\n app(nodeReq, nodeRes);\n });\n}\n",[],[145,34,179],"b6abc1a6-5b64-11f1-bb92-ee650bb23af1",["D",1780062354427],[162],[145,34],["D",1780062354427],[161],[145],["D",1780062353614],{"_105":104,"_112":108},{"_105":104,"_106":-5,"_107":108,"_18":65,"_109":110,"_111":26},{"_13":94,"_33":95,"_54":42,"_96":55,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":56,"_103":104},"ctx",{"_87":-5,"_132":230,"_231":232,"_233":234,"_235":26,"_236":26,"_237":26,"_238":140,"_239":-5,"_240":-7,"_241":-7,"_242":71,"_243":26,"_244":26,"_245":-5,"_246":26,"_247":26,"_248":26,"_249":-5},"ENV",{"_201":202,"_203":204,"_205":95,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2