import { expect, it } from "@effect/vitest";import * as Cloudflare from "alchemy/Cloudflare";import * as TestCore from "alchemy/Test/Core";import { installLocalhostDns } from "alchemy/Util/LocalhostDns";import { Effect } from "effect"; import { makeTestBearer } from "./test-bearer";import McpAlchemyTestWorker from "./test-worker-resource"; const testOptions = {  providers: Cloudflare.providers(),  dev: true,} satisfies TestCore.MakeOptions; installLocalhostDns(); const BASE = "https://test-resource.example.com";const JSON_AND_SSE = "application/json, text/event-stream"; const nextOrgId = (() => {  let seq = 0;  return () => `org_mcp_alchemy_${++seq}_${crypto.randomUUID().slice(0, 8)}`;})(); const nextAccountId = (() => {  let seq = 0;  return () => `user_mcp_alchemy_${++seq}_${crypto.randomUUID().slice(0, 8)}`;})(); const initializeRequest = {  jsonrpc: "2.0" as const,  id: 1,  method: "initialize",  params: {    protocolVersion: "2025-03-26",    capabilities: {},    clientInfo: { name: "mcp-alchemy-e2e", version: "0.0.1" },  },}; const toolsListRequest = {  jsonrpc: "2.0" as const,  id: 2,  method: "tools/list",  params: {},}; const initializedNotification = {  jsonrpc: "2.0" as const,  method: "notifications/initialized",}; const mcpUrl = (baseUrl: string) => new URL("/mcp", baseUrl); const mcpPost = (  baseUrl: string,  init: {    readonly bearer?: string;    readonly sessionId?: string | null;    readonly body: unknown;  },) => {  const headers: Record<string, string> = {    accept: JSON_AND_SSE,    "content-type": "application/json",  };  if (init.bearer) headers.authorization = `Bearer ${init.bearer}`;  if (init.sessionId) headers["mcp-session-id"] = init.sessionId;  return fetch(mcpUrl(baseUrl), {    method: "POST",    headers,    body: JSON.stringify(init.body),  });}; const seedOrg = (baseUrl: string, id: string, name = "MCP Alchemy Org") =>  fetch(new URL("/__test__/seed-org", baseUrl), {    method: "POST",    headers: { "content-type": "application/json" },    body: JSON.stringify({ id, name }),  }); const newSessionId = (baseUrl: string) =>  fetch(new URL("/__test__/new-session-id", baseUrl)).then(    (response) => response.json() as Promise<{ sessionId: string }>,  ); const readJson = (response: Response) => response.json() as Promise<Record<string, unknown>>; const withAlchemyProvider = (  name: string,  fn: (stack: TestCore.ScratchStack) => Effect.Effect<void, any, any>,) => {  const scratch = TestCore.scratchStack(testOptions, name);  return TestCore.toEffect(TestCore.withProviders(fn(scratch), testOptions, scratch.name), {    ...testOptions,    state: scratch.state,  });}; const destroyScratch = (stack: TestCore.ScratchStack) =>  stack.destroy().pipe(Effect.catchCause(() => Effect.void)); it.live(  "covers MCP HTTP behavior through an Alchemy local Worker",  () =>    withAlchemyProvider("covers MCP HTTP behavior through an Alchemy local Worker", (stack) =>      Effect.gen(function* () {        yield* destroyScratch(stack);        const worker = yield* Effect.acquireRelease(stack.deploy(McpAlchemyTestWorker), () =>          destroyScratch(stack),        );         const baseUrl = worker.url;        expect(baseUrl).toEqual(expect.any(String));         const preflight = yield* Effect.promise(() =>          fetch(mcpUrl(baseUrl!), {            method: "OPTIONS",            headers: {              origin: "https://claude.ai",              "access-control-request-method": "POST",              "access-control-request-headers": "authorization, content-type, mcp-session-id",            },          }),        );        expect(preflight.status).toBe(204);        expect(preflight.headers.get("access-control-allow-origin")).toBe("*");        expect(preflight.headers.get("access-control-allow-methods")).toBe(          "GET, POST, DELETE, OPTIONS",        );        expect(preflight.headers.get("access-control-allow-headers") ?? "").toContain(          "mcp-session-id",        );         const metadata = yield* Effect.promise(() =>          fetch(new URL("/.well-known/oauth-protected-resource/mcp", baseUrl)),        );        expect(metadata.status).toBe(200);        expect(yield* Effect.promise(() => readJson(metadata))).toEqual({          resource: `${BASE}/mcp`,          authorization_servers: ["https://test-authkit.example.com"],          bearer_methods_supported: ["header"],          scopes_supported: [],        });         const unauthorized = yield* Effect.promise(() =>          mcpPost(baseUrl!, { body: initializeRequest }),        );        expect(unauthorized.status).toBe(401);        expect(unauthorized.headers.get("www-authenticate") ?? "").toContain(          `${BASE}/.well-known/oauth-protected-resource/mcp`,        );        expect(yield* Effect.promise(() => readJson(unauthorized))).toEqual({          error: "unauthorized",        });         const noOrg = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: makeTestBearer(nextAccountId(), null),            body: initializeRequest,          }),        );        expect(noOrg.status).toBe(403);        expect(yield* Effect.promise(() => readJson(noOrg))).toMatchObject({          jsonrpc: "2.0",          error: { code: -32001 },        });         const transientAuth = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: "test-system-error",            body: toolsListRequest,          }),        );        expect(transientAuth.status).toBe(503);        expect(yield* Effect.promise(() => readJson(transientAuth))).toMatchObject({          jsonrpc: "2.0",          error: { code: -32001 },        });         const { sessionId: staleSessionId } = yield* Effect.promise(() => newSessionId(baseUrl!));        const stale = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: makeTestBearer(nextAccountId(), nextOrgId()),            sessionId: staleSessionId,            body: toolsListRequest,          }),        );        expect(stale.status).toBe(404);        expect(yield* Effect.promise(() => readJson(stale))).toMatchObject({          jsonrpc: "2.0",          error: { code: -32001 },        });         const orgId = nextOrgId();        const accountId = nextAccountId();        const seeded = yield* Effect.promise(() => seedOrg(baseUrl!, orgId));        expect(seeded.status).toBe(204);         const initialized = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: makeTestBearer(accountId, orgId),            body: initializeRequest,          }),        );        expect(initialized.status).toBe(200);        const sessionId = initialized.headers.get("mcp-session-id");        expect(sessionId).toEqual(expect.any(String));        yield* Effect.promise(() => initialized.text());         const notification = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: makeTestBearer(accountId, orgId),            sessionId,            body: initializedNotification,          }),        );        expect(notification.status).toBe(202);        expect(notification.headers.get("content-type")).toBeNull();        expect(yield* Effect.promise(() => notification.text())).toBe("");         const attacker = yield* Effect.promise(() =>          mcpPost(baseUrl!, {            bearer: makeTestBearer(nextAccountId(), nextOrgId()),            sessionId,            body: toolsListRequest,          }),        );        expect(attacker.status).toBe(403);        expect(yield* Effect.promise(() => readJson(attacker))).toMatchObject({          jsonrpc: "2.0",          error: { code: -32003 },        });      }),    ),  180_000,);