@mcpfn/testing 0.0.1

package/dist/index.js

@@ -0,0 +1,1171 @@
+// src/assertions.ts
+import { UriTemplate } from "@modelcontextprotocol/sdk/shared/uriTemplate.js";
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var McpFnAssertionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpFnAssertionError";
+  }
+};
+async function assertManifestContract(client, manifest, options = {}) {
+  const actual = await client.listTools();
+  const actualByName = new Map(actual.map((tool) => [tool.name, tool]));
+  const manifestByName = new Map(manifest.tools.map((tool) => [tool.name, tool]));
+  const expectedNames = [...options.expectedToolNames ?? manifest.tools.map((tool) => tool.name)].sort();
+  const unknownExpectedNames = expectedNames.filter((name) => !manifestByName.has(name));
+  if (unknownExpectedNames.length) {
+    throw new McpFnAssertionError(
+      `Expected visible tools are absent from the manifest: ${stableJson(unknownExpectedNames)}`
+    );
+  }
+  const actualNames = actual.map((tool) => tool.name).sort();
+  if (stableJson(expectedNames) !== stableJson(actualNames)) {
+    throw new McpFnAssertionError(
+      `Tool inventory mismatch
+expected: ${stableJson(expectedNames)}
+actual:   ${stableJson(actualNames)}`
+    );
+  }
+  for (const name of expectedNames) {
+    const expected = manifestByName.get(name);
+    const tool = actualByName.get(expected.name);
+    const comparableExpected = {
+      name: expected.name,
+      description: expected.description,
+      inputSchema: expected.inputSchema,
+      outputSchema: expected.outputSchema,
+      annotations: expected.annotations,
+      execution: expected.execution,
+      icons: expected.icons,
+      title: expected.title,
+      _meta: expected.metadata
+    };
+    const comparableActual = {
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema,
+      outputSchema: tool.outputSchema,
+      annotations: tool.annotations,
+      execution: tool.execution,
+      icons: tool.icons,
+      title: tool.title,
+      _meta: tool._meta
+    };
+    if (stableJson(comparableExpected) !== stableJson(comparableActual)) {
+      throw new McpFnAssertionError(
+        `Contract mismatch for ${expected.name}
+expected: ${stableJson(comparableExpected)}
+actual:   ${stableJson(comparableActual)}`
+      );
+    }
+  }
+  const actualCapabilities = client.client.getServerCapabilities() ?? {};
+  if (stableJson(manifest.capabilities ?? {}) !== stableJson(actualCapabilities)) {
+    throw new McpFnAssertionError(
+      `Capability mismatch
+expected: ${stableJson(manifest.capabilities ?? {})}
+actual:   ${stableJson(actualCapabilities)}`
+    );
+  }
+  const actualResources = actualCapabilities.resources ? await client.listResources() : [];
+  const comparableResources = actualResources.map(({ _meta, ...resource }) => ({
+    ...resource,
+    metadata: _meta
+  }));
+  const staticResourceUris = new Set(
+    (manifest.resources ?? []).map((resource) => resource.uri)
+  );
+  const resourceTemplates = (manifest.resourceTemplates ?? []).map(
+    (template) => new UriTemplate(template.uriTemplate)
+  );
+  const comparableStaticResources = comparableResources.filter(
+    (resource) => staticResourceUris.has(resource.uri) || !resourceTemplates.some((template) => template.match(resource.uri))
+  );
+  const expectedResources = (manifest.resources ?? []).map(
+    ({ subscribable: _subscribable, ...resource }) => resource
+  );
+  if (stableJson(expectedResources) !== stableJson(comparableStaticResources)) {
+    throw new McpFnAssertionError(
+      `Resource inventory mismatch
+expected: ${stableJson(expectedResources)}
+actual:   ${stableJson(comparableStaticResources)}`
+    );
+  }
+  const actualTemplates = actualCapabilities.resources ? await client.listResourceTemplates() : [];
+  const comparableTemplates = actualTemplates.map(({ _meta, ...template }) => ({
+    ...template,
+    metadata: _meta
+  }));
+  const expectedTemplates = (manifest.resourceTemplates ?? []).map(
+    ({ subscribable: _subscribable, ...template }) => template
+  );
+  if (stableJson(expectedTemplates) !== stableJson(comparableTemplates)) {
+    throw new McpFnAssertionError(
+      `Resource template inventory mismatch
+expected: ${stableJson(expectedTemplates)}
+actual:   ${stableJson(comparableTemplates)}`
+    );
+  }
+  for (const resource of comparableResources) {
+    const expected = (manifest.resources ?? []).find(
+      (candidate) => candidate.uri === resource.uri
+    ) ?? (manifest.resourceTemplates ?? []).find(
+      (candidate) => new UriTemplate(candidate.uriTemplate).match(resource.uri)
+    );
+    const subscribable = expected?.subscribable === true;
+    if (subscribable) {
+      try {
+        await client.subscribeResource(resource.uri);
+        await client.unsubscribeResource(resource.uri);
+      } catch (error) {
+        throw new McpFnAssertionError(
+          `Resource subscription mismatch for ${resource.uri}: expected subscribe and unsubscribe to succeed (${error instanceof Error ? error.message : String(error)})`
+        );
+      }
+      continue;
+    }
+    let accepted = false;
+    try {
+      await client.subscribeResource(resource.uri);
+      accepted = true;
+      await client.unsubscribeResource(resource.uri).catch(() => void 0);
+    } catch {
+    }
+    if (accepted) {
+      throw new McpFnAssertionError(
+        `Resource subscription mismatch for ${resource.uri}: expected subscribe to be rejected`
+      );
+    }
+  }
+  const actualPrompts = actualCapabilities.prompts ? await client.listPrompts() : [];
+  const comparablePrompts = actualPrompts.map(({ _meta, ...prompt }) => ({
+    ...prompt,
+    metadata: _meta
+  }));
+  const expectedPrompts = (manifest.prompts ?? []).map(({ argumentsSchema: _schema, ...prompt }) => prompt);
+  if (stableJson(expectedPrompts) !== stableJson(comparablePrompts)) {
+    throw new McpFnAssertionError(
+      `Prompt inventory mismatch
+expected: ${stableJson(expectedPrompts)}
+actual:   ${stableJson(comparablePrompts)}`
+    );
+  }
+  return actual;
+}
+function assertStructuredTextParity(result) {
+  if (!result.structuredContent) {
+    throw new McpFnAssertionError("Tool result has no structuredContent");
+  }
+  const text = (result.content ?? []).find(
+    (entry) => !!entry && typeof entry === "object" && entry.type === "text" && typeof entry.text === "string"
+  )?.text;
+  if (!text) {
+    throw new McpFnAssertionError("Tool result has no text content");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new McpFnAssertionError("Tool text content is not JSON");
+  }
+  if (stableJson(parsed) !== stableJson(result.structuredContent)) {
+    throw new McpFnAssertionError(
+      "Tool text content and structuredContent are not equivalent"
+    );
+  }
+}
+
+// src/auth-core.ts
+var McpFnAuthAssertionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpFnAuthAssertionError";
+  }
+};
+function expectedStatus(response, expected, name) {
+  const statuses = Array.isArray(expected) ? expected : [expected];
+  if (!statuses.includes(response.status)) {
+    throw new McpFnAuthAssertionError(
+      `${name} expected HTTP ${statuses.join(" or ")}, received ${response.status}`
+    );
+  }
+}
+function parseBearerChallenge(header) {
+  if (!header) return void 0;
+  const matches = [...header.matchAll(/(?:^|,)\s*([A-Za-z][A-Za-z0-9_-]*)\s+/g)];
+  const selectedIndex = matches.findIndex((entry) => entry[1].toLowerCase() === "bearer");
+  if (selectedIndex < 0) return void 0;
+  const match = matches[selectedIndex];
+  const start = (match.index ?? 0) + match[0].length;
+  const end = matches[selectedIndex + 1]?.index ?? header.length;
+  const parameters = {};
+  const source = header.slice(start, end);
+  const pattern = /([A-Za-z][A-Za-z0-9_-]*)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^,\s]+))/g;
+  for (const entry of source.matchAll(pattern)) {
+    const quoted = entry[2]?.replace(/\\(["\\])/g, "$1");
+    parameters[entry[1]] = quoted ?? entry[3] ?? "";
+  }
+  return { scheme: match[1], parameters };
+}
+function assertBearerResourceChallenge(response, expectedMetadataUrl) {
+  const challenge = parseBearerChallenge(response.headers.get("www-authenticate"));
+  if (!challenge || challenge.scheme.toLowerCase() !== "bearer") {
+    throw new McpFnAuthAssertionError("Expected a Bearer WWW-Authenticate challenge");
+  }
+  const metadataUrl = challenge.parameters.resource_metadata;
+  if (!metadataUrl) {
+    throw new McpFnAuthAssertionError(
+      "Bearer challenge is missing the resource_metadata parameter"
+    );
+  }
+  try {
+    const parsed = new URL(metadataUrl);
+    if (!parsed.protocol || !parsed.host) throw new Error("not absolute");
+  } catch {
+    throw new McpFnAuthAssertionError(
+      `Bearer challenge has an invalid resource_metadata URL: ${metadataUrl}`
+    );
+  }
+  if (expectedMetadataUrl && metadataUrl !== expectedMetadataUrl) {
+    throw new McpFnAuthAssertionError(
+      `Expected resource_metadata=${expectedMetadataUrl}, received ${metadataUrl}`
+    );
+  }
+  return challenge;
+}
+function bearerCredential(token, kind = "oauth") {
+  return {
+    kind,
+    headers: { authorization: `Bearer ${token}` }
+  };
+}
+function apiKeyCredential(apiKey, options = {}) {
+  const headerName = options.headerName ?? "authorization";
+  const value = options.scheme === "" ? apiKey : `${options.scheme ?? "Bearer"} ${apiKey}`;
+  return { kind: "api-key", headers: { [headerName]: value } };
+}
+function invalidHeaders(options) {
+  return new Headers(options.invalidCredentialHeaders ?? {
+    authorization: `Bearer mcpfn-invalid-${options.kind}`
+  });
+}
+async function runOne(options, scenario, prepare, expected) {
+  let credential;
+  try {
+    credential = await prepare();
+    const headers = credential ? new Headers(credential.headers) : scenario.name === "invalid-credential" ? invalidHeaders(options) : new Headers();
+    const response = await options.target.request(headers, scenario);
+    expectedStatus(response, expected, scenario.name);
+    if (options.kind === "oauth" && scenario.name !== "valid-credential") {
+      assertBearerResourceChallenge(
+        response,
+        options.protectedResourceMetadataUrl
+      );
+    }
+    if (scenario.name === "valid-credential" && credential) {
+      await options.verifyAuthenticatedResponse?.(response.clone(), credential);
+    }
+    return {
+      name: scenario.name,
+      status: "passed",
+      responseStatus: response.status
+    };
+  } catch (error) {
+    return {
+      name: scenario.name,
+      status: "failed",
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    await credential?.dispose?.();
+  }
+}
+async function runAuthRegressionSuite(options) {
+  const issue = (overrides = {}) => options.provider.issue({
+    kind: options.kind,
+    scopes: options.requiredScopes,
+    resource: options.resource,
+    ...overrides
+  });
+  const results = [];
+  results.push(await runOne(
+    options,
+    { name: "missing-credential", kind: options.kind },
+    async () => void 0,
+    401
+  ));
+  results.push(await runOne(
+    options,
+    { name: "invalid-credential", kind: options.kind },
+    async () => void 0,
+    401
+  ));
+  results.push(await runOne(
+    options,
+    { name: "valid-credential", kind: options.kind },
+    () => issue(),
+    options.expectedAuthenticatedStatuses ?? [200, 201, 202, 204]
+  ));
+  const capabilities = options.provider.capabilities ?? {};
+  if (capabilities.scopes && options.requiredScopes?.length) {
+    results.push(await runOne(
+      options,
+      { name: "insufficient-scope", kind: options.kind },
+      () => issue({ scopes: [] }),
+      403
+    ));
+  }
+  if (capabilities.expiration) {
+    results.push(await runOne(
+      options,
+      { name: "expired-credential", kind: options.kind },
+      () => issue({ expiresInSeconds: -60 }),
+      401
+    ));
+  }
+  if (capabilities.resourceBinding && options.resource) {
+    results.push(await runOne(
+      options,
+      { name: "missing-resource", kind: options.kind },
+      () => issue({ resource: void 0 }),
+      401
+    ));
+  }
+  if (capabilities.resourceBinding && options.wrongResource) {
+    results.push(await runOne(
+      options,
+      { name: "wrong-resource", kind: options.kind },
+      () => issue({ resource: options.wrongResource }),
+      401
+    ));
+  }
+  if (capabilities.revocation && options.provider.revoke) {
+    results.push(await runOne(
+      options,
+      { name: "revoked-credential", kind: options.kind },
+      async () => {
+        const credential = await issue();
+        await options.provider.revoke?.(credential);
+        return credential;
+      },
+      401
+    ));
+  }
+  return results;
+}
+async function assertAuthRegressionSuite(options) {
+  const results = await runAuthRegressionSuite(options);
+  const failures = results.filter((result) => result.status === "failed");
+  if (failures.length) {
+    throw new McpFnAuthAssertionError(
+      failures.map((failure) => `${failure.name}: ${failure.error}`).join("\n")
+    );
+  }
+  return results;
+}
+function createFetchAuthTarget(options) {
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  if (!fetchImplementation) {
+    throw new Error("A fetch implementation is required");
+  }
+  return {
+    async request(authHeaders, scenario) {
+      const configured = typeof options.requestInit === "function" ? options.requestInit(scenario) : options.requestInit ?? {};
+      const headers = new Headers(configured.headers);
+      headers.set("accept", "application/json, text/event-stream");
+      headers.set("content-type", "application/json");
+      authHeaders.forEach((value, name) => headers.set(name, value));
+      return fetchImplementation(options.url, {
+        method: "POST",
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: `mcpfn-auth-${scenario.name}`,
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-11-25",
+            capabilities: {},
+            clientInfo: { name: "mcpfn-auth-test", version: "1.0.0" }
+          }
+        }),
+        ...configured,
+        headers
+      });
+    }
+  };
+}
+var MCPFN_OAUTH_EXTENSION_GRANTS = {
+  jwtBearer: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+  deviceCode: "urn:ietf:params:oauth:grant-type:device_code",
+  generic: "urn:example:params:oauth:grant-type:extension"
+};
+function createOAuthClientMetadataFixture(options) {
+  return {
+    ...options.extraMetadata,
+    client_id: new URL(options.clientId).toString(),
+    client_name: options.clientName ?? "McpFn OAuth test client",
+    redirect_uris: [...new Set(options.redirectUris.map((uri) => new URL(uri).toString()))],
+    response_types: ["code"],
+    grant_types: [
+      "authorization_code",
+      "refresh_token",
+      ...new Set(options.extraGrantTypes ?? [])
+    ],
+    token_endpoint_auth_method: "none"
+  };
+}
+function createOAuthClientMetadataVariants(baseUrl, redirectUri = new URL("/callback", baseUrl).toString()) {
+  const base = new URL(baseUrl);
+  const fixture = (name, extraGrantTypes = []) => createOAuthClientMetadataFixture({
+    clientId: new URL(`/client-metadata/${name}`, base).toString(),
+    redirectUris: [redirectUri],
+    clientName: `McpFn ${name} client`,
+    extraGrantTypes
+  });
+  return {
+    basic: fixture("basic"),
+    jwtBearerExtension: fixture("jwt-bearer-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.jwtBearer]),
+    deviceCodeExtension: fixture("device-code-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.deviceCode]),
+    genericExtension: fixture("generic-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.generic])
+  };
+}
+function assertAuthorizationCodeClientMetadata(metadata, expectedClientId) {
+  if (expectedClientId && metadata.client_id !== new URL(expectedClientId).toString()) {
+    throw new McpFnAuthAssertionError("OAuth client metadata client_id does not match its document URL");
+  }
+  if (!metadata.response_types.includes("code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support response_type=code");
+  }
+  if (!metadata.grant_types.includes("authorization_code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support authorization_code");
+  }
+  if (!metadata.redirect_uris.length) {
+    throw new McpFnAuthAssertionError("OAuth client metadata must declare at least one redirect URI");
+  }
+  return metadata;
+}
+
+// src/mock-oauth-server.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { createServer } from "http";
+function base64Url(value) {
+  return value.toString("base64url");
+}
+function createPkcePair() {
+  const verifier = base64Url(randomBytes(48));
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    method: "S256"
+  };
+}
+function uniqueScopes(value) {
+  return [...new Set((value ?? "").split(/\s+/).filter(Boolean))].sort();
+}
+function json(status, body) {
+  return Response.json(body, {
+    status,
+    headers: { "cache-control": "no-store" }
+  });
+}
+function oauthError(status, error, description) {
+  return json(status, { error, error_description: description });
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function formValue(form, name) {
+  const value = form.get(name);
+  return value === null || value === "" ? void 0 : value;
+}
+var McpFnMockOAuthAuthorizationServer = class {
+  issuer;
+  clientId;
+  redirectUris;
+  scopesSupported;
+  clientMetadata;
+  codes = /* @__PURE__ */ new Map();
+  accessTokens = /* @__PURE__ */ new Map();
+  refreshTokens = /* @__PURE__ */ new Map();
+  callbacks = [];
+  clock;
+  accessTokenLifetimeSeconds;
+  authorizationCodeLifetimeSeconds;
+  refreshTokenLifetimeSeconds;
+  constructor(options) {
+    this.issuer = new URL(options.issuer);
+    this.issuer.pathname = this.issuer.pathname.replace(/\/?$/, "/");
+    this.clientId = options.clientId ?? "mcpfn-playwright";
+    this.redirectUris = options.redirectUris?.map((uri) => new URL(uri).toString()) ?? [
+      new URL("callback", this.issuer).toString()
+    ];
+    this.scopesSupported = [...new Set(options.scopesSupported ?? ["mcp:read", "mcp:write"])].sort();
+    this.clock = options.clock ?? Date.now;
+    this.accessTokenLifetimeSeconds = options.accessTokenLifetimeSeconds ?? 300;
+    this.authorizationCodeLifetimeSeconds = options.authorizationCodeLifetimeSeconds ?? 120;
+    this.refreshTokenLifetimeSeconds = options.refreshTokenLifetimeSeconds ?? 3600;
+    this.clientMetadata = createOAuthClientMetadataVariants(
+      this.issuer,
+      this.redirectUris[0]
+    );
+  }
+  get metadataUrl() {
+    return new URL(".well-known/oauth-authorization-server", this.issuer).toString();
+  }
+  get authorizationEndpoint() {
+    return new URL("authorize", this.issuer).toString();
+  }
+  get tokenEndpoint() {
+    return new URL("token", this.issuer).toString();
+  }
+  get revocationEndpoint() {
+    return new URL("revoke", this.issuer).toString();
+  }
+  get callbackUrl() {
+    return this.redirectUris[0];
+  }
+  clientMetadataUrl(variant) {
+    return this.clientMetadata[variant].client_id;
+  }
+  authorizationUrl(input) {
+    const url = new URL(this.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId ?? this.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri ?? this.callbackUrl);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("scope", (input.scopes ?? ["mcp:read"]).join(" "));
+    if (input.state) url.searchParams.set("state", input.state);
+    if (input.resource) url.searchParams.set("resource", input.resource);
+    for (const [name, value] of Object.entries(input.extraParameters ?? {})) {
+      url.searchParams.set(name, value);
+    }
+    return url.toString();
+  }
+  latestCallback() {
+    return this.callbacks.at(-1);
+  }
+  expireAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (record) record.expiresAt = this.nowSeconds() - 1;
+  }
+  revokeToken(token) {
+    const access = this.accessTokens.get(token);
+    if (access) access.revoked = true;
+    const refresh = this.refreshTokens.get(token);
+    if (refresh) refresh.revoked = true;
+  }
+  async verifyAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      throw new Error("Invalid access token");
+    }
+    return {
+      token,
+      clientId: record.clientId,
+      scopes: record.scopes,
+      expiresAt: record.expiresAt,
+      ...record.resource ? { resource: new URL(record.resource) } : {}
+    };
+  }
+  async handle(request) {
+    const url = new URL(request.url);
+    const path2 = url.pathname.replace(this.issuer.pathname.replace(/\/$/, ""), "") || "/";
+    if (request.method === "GET" && path2 === "/.well-known/oauth-authorization-server") {
+      return json(200, {
+        issuer: this.issuer.toString(),
+        authorization_endpoint: this.authorizationEndpoint,
+        token_endpoint: this.tokenEndpoint,
+        revocation_endpoint: this.revocationEndpoint,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: this.scopesSupported
+      });
+    }
+    if (request.method === "GET" && path2.startsWith("/client-metadata/")) {
+      const metadata = Object.values(this.clientMetadata).find((candidate) => new URL(candidate.client_id).pathname === url.pathname);
+      return metadata ? json(200, metadata) : json(404, { error: "not_found" });
+    }
+    if (request.method === "GET" && path2 === "/authorize") {
+      return this.authorize(url);
+    }
+    if (request.method === "POST" && path2 === "/token") {
+      return this.token(await request.text());
+    }
+    if (request.method === "POST" && path2 === "/revoke") {
+      return this.revoke(await request.text());
+    }
+    if (request.method === "GET" && path2 === "/callback") {
+      const parameters = Object.fromEntries(url.searchParams);
+      this.callbacks.push({ url: url.toString(), parameters });
+      return new Response(
+        `<!doctype html><html><body><main><h1>OAuth callback received</h1><pre>${escapeHtml(JSON.stringify(parameters, null, 2))}</pre></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8" } }
+      );
+    }
+    return json(404, { error: "not_found" });
+  }
+  nowSeconds() {
+    return Math.floor(this.clock() / 1e3);
+  }
+  resolveClient(clientId) {
+    if (clientId === this.clientId) {
+      return { clientId, redirectUris: this.redirectUris };
+    }
+    const metadata = Object.values(this.clientMetadata).find((candidate) => candidate.client_id === clientId);
+    if (!metadata) return void 0;
+    assertAuthorizationCodeClientMetadata(metadata, clientId);
+    return { clientId, redirectUris: metadata.redirect_uris };
+  }
+  authorize(url) {
+    const clientId = url.searchParams.get("client_id") ?? "";
+    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+    const client = this.resolveClient(clientId);
+    if (!client) return oauthError(400, "invalid_client", "Unknown OAuth client");
+    if (!client.redirectUris.includes(redirectUri)) {
+      return oauthError(400, "invalid_request", "redirect_uri is not registered");
+    }
+    if (url.searchParams.get("response_type") !== "code") {
+      return this.authorizationRedirect(url, redirectUri, "unsupported_response_type");
+    }
+    const codeChallenge = url.searchParams.get("code_challenge");
+    if (!codeChallenge || url.searchParams.get("code_challenge_method") !== "S256") {
+      return this.authorizationRedirect(url, redirectUri, "invalid_request", "PKCE S256 is required");
+    }
+    const requestedScopes = uniqueScopes(url.searchParams.get("scope"));
+    if (requestedScopes.some((scope) => !this.scopesSupported.includes(scope))) {
+      return this.authorizationRedirect(url, redirectUri, "invalid_scope");
+    }
+    const decision = url.searchParams.get("decision");
+    if (!decision) {
+      const hidden = [...url.searchParams].filter(([name]) => name !== "decision").map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("");
+      return new Response(
+        `<!doctype html><html><body><main><h1>Authorize MCP client</h1><p>${escapeHtml(clientId)}</p><form method="get" action="${escapeHtml(this.authorizationEndpoint)}">${hidden}<button name="decision" value="approve">Approve</button><button name="decision" value="deny">Deny</button></form></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } }
+      );
+    }
+    if (decision === "deny") {
+      return this.authorizationRedirect(url, redirectUri, "access_denied");
+    }
+    if (decision !== "approve") {
+      return oauthError(400, "invalid_request", "Unknown authorization decision");
+    }
+    const code = `mcpfn_code_${randomUUID()}`;
+    this.codes.set(code, {
+      clientId,
+      redirectUri,
+      codeChallenge,
+      scopes: requestedScopes,
+      resource: url.searchParams.get("resource") ?? void 0,
+      expiresAt: this.nowSeconds() + this.authorizationCodeLifetimeSeconds,
+      used: false
+    });
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("code", code);
+    const state = url.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  authorizationRedirect(requestUrl, redirectUri, error, description) {
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("error", error);
+    if (description) callback.searchParams.set("error_description", description);
+    const state = requestUrl.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  token(source) {
+    const form = new URLSearchParams(source);
+    const grantType = formValue(form, "grant_type");
+    if (grantType === "authorization_code") return this.exchangeAuthorizationCode(form);
+    if (grantType === "refresh_token") return this.exchangeRefreshToken(form);
+    return oauthError(400, "unsupported_grant_type", "The grant type is not supported");
+  }
+  exchangeAuthorizationCode(form) {
+    const code = formValue(form, "code");
+    const record = code ? this.codes.get(code) : void 0;
+    if (!record || record.used || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Authorization code is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId || formValue(form, "redirect_uri") !== record.redirectUri) {
+      return oauthError(400, "invalid_grant", "Authorization code binding does not match");
+    }
+    const verifier = formValue(form, "code_verifier");
+    const challenge = verifier ? createHash("sha256").update(verifier).digest("base64url") : void 0;
+    if (challenge !== record.codeChallenge) {
+      return oauthError(400, "invalid_grant", "PKCE verification failed");
+    }
+    record.used = true;
+    return json(200, this.issueTokenSet(record));
+  }
+  exchangeRefreshToken(form) {
+    const refreshToken = formValue(form, "refresh_token");
+    const record = refreshToken ? this.refreshTokens.get(refreshToken) : void 0;
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Refresh token is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId) {
+      return oauthError(400, "invalid_grant", "Refresh token client binding does not match");
+    }
+    const requestedScopes = form.has("scope") ? uniqueScopes(form.get("scope")) : record.scopes;
+    if (requestedScopes.some((scope) => !record.scopes.includes(scope))) {
+      return oauthError(400, "invalid_scope", "Refresh cannot increase granted scopes");
+    }
+    record.revoked = true;
+    return json(200, this.issueTokenSet({ ...record, scopes: requestedScopes }));
+  }
+  issueTokenSet(input) {
+    const accessToken = `mcpfn_access_${randomUUID()}`;
+    const refreshToken = `mcpfn_refresh_${randomUUID()}`;
+    this.accessTokens.set(accessToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.accessTokenLifetimeSeconds,
+      revoked: false
+    });
+    this.refreshTokens.set(refreshToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.refreshTokenLifetimeSeconds,
+      revoked: false
+    });
+    return {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.accessTokenLifetimeSeconds,
+      refresh_token: refreshToken,
+      scope: input.scopes.join(" "),
+      ...input.resource ? { resource: input.resource } : {}
+    };
+  }
+  revoke(source) {
+    const token = new URLSearchParams(source).get("token");
+    if (token) this.revokeToken(token);
+    return new Response(null, { status: 200 });
+  }
+};
+async function toRequest(req, origin) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (value !== void 0) {
+      headers.set(name, value);
+    }
+  }
+  const body = chunks.length ? Buffer.concat(chunks) : void 0;
+  const init = {
+    method: req.method,
+    headers,
+    ...body ? { body, duplex: "half" } : {}
+  };
+  return new Request(new URL(req.url ?? "/", origin), init);
+}
+async function writeResponse(res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach((value, name) => res.setHeader(name, value));
+  res.end(Buffer.from(await response.arrayBuffer()));
+}
+async function startMockOAuthAuthorizationServer(options = {}) {
+  let oauth;
+  let origin = "";
+  const server = createServer(async (req, res) => {
+    try {
+      if (!oauth) throw new Error("Mock OAuth server is not initialized");
+      await writeResponse(res, await oauth.handle(await toRequest(req, origin)));
+    } catch {
+      res.statusCode = 500;
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify({
+        error: "server_error",
+        error_description: "Internal Server Error"
+      }));
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, options.hostname ?? "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  origin = `http://${address.address.includes(":") ? `[${address.address}]` : address.address}:${address.port}`;
+  oauth = new McpFnMockOAuthAuthorizationServer({ ...options, issuer: origin });
+  return {
+    origin,
+    oauth,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+}
+
+// src/client.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import {
+  CallToolResultSchema,
+  CreateTaskResultSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var McpFnTestClient = class _McpFnTestClient {
+  client;
+  server;
+  closed = false;
+  constructor(client, server) {
+    this.client = client;
+    this.server = server;
+  }
+  static async connect(server, info = { name: "mcpfn-test-client", version: "1.0.0" }, options = {}) {
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const client = new Client(info, { capabilities: options.capabilities ?? {} });
+    await options.configure?.(client);
+    await server.connect(serverTransport);
+    await client.connect(clientTransport);
+    return new _McpFnTestClient(client, server);
+  }
+  async listTools() {
+    const values = [];
+    let cursor;
+    do {
+      const page = await this.client.listTools(cursor ? { cursor } : void 0);
+      values.push(...page.tools);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return values;
+  }
+  async callTool(name, args = {}) {
+    return await this.client.callTool({ name, arguments: args });
+  }
+  async createToolTask(name, args = {}, options = {}) {
+    return this.client.request(
+      {
+        method: "tools/call",
+        params: { name, arguments: args, task: options }
+      },
+      CreateTaskResultSchema
+    );
+  }
+  getTask(taskId) {
+    return this.client.experimental.tasks.getTask(taskId);
+  }
+  getTaskResult(taskId) {
+    return this.client.experimental.tasks.getTaskResult(
+      taskId,
+      CallToolResultSchema
+    );
+  }
+  listTasks(cursor) {
+    return this.client.experimental.tasks.listTasks(cursor);
+  }
+  cancelTask(taskId) {
+    return this.client.experimental.tasks.cancelTask(taskId);
+  }
+  async listResources() {
+    const values = [];
+    let cursor;
+    do {
+      const page = await this.client.listResources(cursor ? { cursor } : void 0);
+      values.push(...page.resources);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return values;
+  }
+  async listResourceTemplates() {
+    const values = [];
+    let cursor;
+    do {
+      const page = await this.client.listResourceTemplates(cursor ? { cursor } : void 0);
+      values.push(...page.resourceTemplates);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return values;
+  }
+  readResource(uri) {
+    return this.client.readResource({ uri });
+  }
+  async subscribeResource(uri) {
+    await this.client.subscribeResource({ uri });
+  }
+  async unsubscribeResource(uri) {
+    await this.client.unsubscribeResource({ uri });
+  }
+  async listPrompts() {
+    const values = [];
+    let cursor;
+    do {
+      const page = await this.client.listPrompts(cursor ? { cursor } : void 0);
+      values.push(...page.prompts);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return values;
+  }
+  getPrompt(name, args) {
+    return this.client.getPrompt({ name, ...args ? { arguments: args } : {} });
+  }
+  complete(params) {
+    return this.client.complete(params);
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    await this.client.close().catch(() => void 0);
+    await this.server.close().catch(() => void 0);
+  }
+};
+
+// src/conformance.ts
+import { spawn } from "child_process";
+import { existsSync } from "fs";
+import path from "path";
+var OFFICIAL_CONFORMANCE_VERSION = "0.1.16";
+function npxInvocation(args) {
+  if (process.platform !== "win32") return { command: "npx", args };
+  const npmExecPath = process.env.npm_execpath;
+  const candidates = [
+    npmExecPath ? path.join(path.dirname(npmExecPath), "npx-cli.js") : void 0,
+    path.resolve(path.dirname(process.execPath), "node_modules/npm/bin/npx-cli.js"),
+    path.resolve(path.dirname(process.execPath), "../lib/node_modules/npm/bin/npx-cli.js")
+  ].filter((candidate) => Boolean(candidate));
+  const npxCli = candidates.find((candidate) => existsSync(candidate));
+  if (!npxCli) {
+    throw new Error("Unable to locate npm's npx-cli.js for the official MCP conformance runner");
+  }
+  return { command: process.execPath, args: [npxCli, ...args] };
+}
+function buildOfficialConformanceArgs(options) {
+  const args = [
+    "--yes",
+    `@modelcontextprotocol/conformance@${OFFICIAL_CONFORMANCE_VERSION}`,
+    "server",
+    "--url",
+    options.url
+  ];
+  if (options.suite) args.push("--suite", options.suite);
+  if (options.scenario) args.push("--scenario", options.scenario);
+  if (options.expectedFailures) {
+    args.push("--expected-failures", options.expectedFailures);
+  }
+  if (options.outputDir) args.push("--output-dir", options.outputDir);
+  if (options.specVersion) args.push("--spec-version", options.specVersion);
+  if (options.verbose) args.push("--verbose");
+  return args;
+}
+async function runOfficialConformance(options) {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+  if (nodeMajor < 22) {
+    throw new Error(
+      `Official MCP conformance ${OFFICIAL_CONFORMANCE_VERSION} requires Node.js 22 or newer; current runtime is ${process.versions.node}`
+    );
+  }
+  const args = buildOfficialConformanceArgs(options);
+  const invocation = npxInvocation(args);
+  return await new Promise((resolve, reject) => {
+    const child = spawn(invocation.command, invocation.args, {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        PATH: [path.dirname(process.execPath), process.env.PATH].filter(Boolean).join(path.delimiter)
+      },
+      stdio: options.stdio === "inherit" ? "inherit" : "pipe"
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      resolve({ exitCode: code ?? 1, stdout, stderr });
+    });
+  });
+}
+
+// src/host-profiles.ts
+import {
+  MCP_APP_EXTENSION_ID
+} from "@mcpfn/core";
+var MCPFN_HOST_PROFILES = {
+  toolsOnly: {
+    id: "mcpfn/tools-only",
+    name: "Tools-only MCP host",
+    protocolVersions: ["2025-03-26", "2025-06-18", "2025-11-25"],
+    serverFeatures: ["tools"]
+  },
+  fullProtocol: {
+    id: "mcpfn/full-protocol",
+    name: "Full protocol MCP host",
+    protocolVersions: ["2025-03-26", "2025-06-18", "2025-11-25"],
+    serverFeatures: ["tools", "resources", "prompts", "completions", "tasks", "logging"],
+    clientFeatures: { sampling: true, elicitation: ["form", "url"], roots: true }
+  },
+  mcpApps: {
+    id: "mcpfn/mcp-apps",
+    name: "Full protocol host with MCP Apps",
+    protocolVersions: ["2025-11-25"],
+    serverFeatures: ["tools", "resources", "prompts", "completions", "tasks", "logging"],
+    clientFeatures: { sampling: true, elicitation: ["form", "url"], roots: true },
+    extensions: [MCP_APP_EXTENSION_ID]
+  }
+};
+function checkHostCompatibility(manifest, profile) {
+  const issues = [];
+  if (manifest.protocolVersions?.length && !manifest.protocolVersions.some((version) => profile.protocolVersions.includes(version))) {
+    issues.push({
+      severity: "incompatible",
+      code: "protocol-version-mismatch",
+      path: "protocolVersions",
+      message: `${profile.name} and ${manifest.server.name} have no protocol version in common`
+    });
+  }
+  const supportedServerFeatures = new Set(profile.serverFeatures);
+  for (const feature of Object.keys(manifest.capabilities ?? {})) {
+    if (feature === "experimental" || supportedServerFeatures.has(feature)) continue;
+    issues.push({
+      severity: "degraded",
+      code: "server-feature-unavailable",
+      path: `capabilities.${feature}`,
+      message: `${profile.name} will not expose the server's ${feature} feature`
+    });
+  }
+  const required = manifest.clientRequirements;
+  if (required?.sampling && !profile.clientFeatures?.sampling) {
+    issues.push({
+      severity: "incompatible",
+      code: "sampling-required",
+      path: "clientRequirements.sampling",
+      message: `${manifest.server.name} requires client sampling`
+    });
+  }
+  if (required?.roots && !profile.clientFeatures?.roots) {
+    issues.push({
+      severity: "incompatible",
+      code: "roots-required",
+      path: "clientRequirements.roots",
+      message: `${manifest.server.name} requires client roots`
+    });
+  }
+  for (const mode of required?.elicitation ?? []) {
+    if (!profile.clientFeatures?.elicitation?.includes(mode)) {
+      issues.push({
+        severity: "incompatible",
+        code: "elicitation-required",
+        path: `clientRequirements.elicitation.${mode}`,
+        message: `${manifest.server.name} requires ${mode} elicitation`
+      });
+    }
+  }
+  const extensions = new Set(profile.extensions ?? []);
+  for (const [extension, configuration] of Object.entries(manifest.extensions ?? {})) {
+    if (extensions.has(extension)) continue;
+    const requiredExtension = configuration && typeof configuration === "object" && configuration.required === true;
+    issues.push({
+      severity: requiredExtension ? "incompatible" : "degraded",
+      code: "extension-unavailable",
+      path: `extensions.${extension}`,
+      message: `${profile.name} does not support ${extension}`
+    });
+  }
+  if (!extensions.has(MCP_APP_EXTENSION_ID)) {
+    for (const tool of manifest.tools) {
+      const ui = tool.metadata?.ui;
+      if (ui?.visibility?.length && !ui.visibility.includes("model")) {
+        issues.push({
+          severity: "incompatible",
+          code: "app-only-tool-unavailable",
+          path: `tools.${tool.name}.metadata.ui.visibility`,
+          message: `${tool.name} is app-only but ${profile.name} does not support MCP Apps`
+        });
+      }
+    }
+  }
+  issues.sort((left, right) => left.path.localeCompare(right.path) || left.code.localeCompare(right.code));
+  const status = issues.some((issue) => issue.severity === "incompatible") ? "incompatible" : issues.length ? "degraded" : "compatible";
+  return { status, compatible: status !== "incompatible", issues };
+}
+
+// src/scenarios.ts
+async function runScenarios(client, scenarios) {
+  const results = [];
+  for (const scenario of scenarios) {
+    const startedAt = performance.now();
+    try {
+      const result = await client.callTool(scenario.tool, scenario.arguments);
+      if (result.isError && scenario.expect?.isError === void 0) {
+        throw new McpFnAssertionError(
+          "Tool returned isError=true without an explicit expect.isError=true assertion"
+        );
+      }
+      if (scenario.expect?.isError !== void 0 && Boolean(result.isError) !== scenario.expect.isError) {
+        throw new McpFnAssertionError(
+          `Expected isError=${scenario.expect.isError}, received ${Boolean(result.isError)}`
+        );
+      }
+      if (scenario.expect && Object.prototype.hasOwnProperty.call(scenario.expect, "structuredContent") && stableJson(result.structuredContent) !== stableJson(scenario.expect.structuredContent)) {
+        throw new McpFnAssertionError(
+          `Structured result mismatch
+expected: ${stableJson(scenario.expect.structuredContent)}
+actual:   ${stableJson(result.structuredContent)}`
+        );
+      }
+      if (scenario.expect?.structuredTextParity) {
+        assertStructuredTextParity(result);
+      }
+      await scenario.verify?.(result);
+      results.push({
+        name: scenario.name,
+        tool: scenario.tool,
+        status: "passed",
+        durationMs: performance.now() - startedAt
+      });
+    } catch (error) {
+      results.push({
+        name: scenario.name,
+        tool: scenario.tool,
+        status: "failed",
+        durationMs: performance.now() - startedAt,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return results;
+}
+export {
+  MCPFN_HOST_PROFILES,
+  MCPFN_OAUTH_EXTENSION_GRANTS,
+  McpFnAssertionError,
+  McpFnAuthAssertionError,
+  McpFnMockOAuthAuthorizationServer,
+  McpFnTestClient,
+  OFFICIAL_CONFORMANCE_VERSION,
+  apiKeyCredential,
+  assertAuthRegressionSuite,
+  assertAuthorizationCodeClientMetadata,
+  assertBearerResourceChallenge,
+  assertManifestContract,
+  assertStructuredTextParity,
+  bearerCredential,
+  buildOfficialConformanceArgs,
+  checkHostCompatibility,
+  createFetchAuthTarget,
+  createOAuthClientMetadataFixture,
+  createOAuthClientMetadataVariants,
+  createPkcePair,
+  parseBearerChallenge,
+  runAuthRegressionSuite,
+  runOfficialConformance,
+  runScenarios,
+  stableJson,
+  startMockOAuthAuthorizationServer
+};
+//# sourceMappingURL=index.js.map