Add client credentials support to everything-client (#89)

* Add client credentials support to everything-client

- Add ConformanceContextSchema with discriminated union for auth contexts
- Add runClientCredentialsJwt and runClientCredentialsBasic handlers
- Update runner to include scenario name in context for discriminated union parsing
- Update test helpers to set env vars for inline client runners
- Fix JWT audience validation to match SDK behavior (no trailing slash)
- Remove client credentials scenarios from skip list

* Accept both trailing slash forms for JWT audience per RFC 3986

Per RFC 3986, URLs with and without trailing slash are equivalent.
The MCP spec recommends (SHOULD) the form without trailing slash, but
since it's not a MUST, the conformance test should accept both forms
for interoperability with clients like Pydantic that normalize URLs.

* Remove .vscode from tracking and add to gitignore

* Address review feedback

- Remove unused issuerUrl variable and comment
- Simplify audience array to exactly 2 values with clearer naming
- Add comment explaining strip-then-add-back logic
- Rename ConformanceContextSchema to ClientConformanceContextSchema

* Remove dist from tracking and add to gitignore

* Fix .gitignore formatting

* Add getHandler to everything-client for cleaner test imports

Instead of importing individual handlers, tests can now import getHandler
and look up handlers by scenario name.

* Use getHandler exclusively, remove goodClient import

- Add CIMD support to runAuthClient in everything-client
- Add auth fallback to getHandler for unregistered auth/* scenarios
- Remove goodClient import from test file

* Remove runAuthClient fallback, register all auth scenarios explicitly

src/scenarios/client/auth/client-credentials.ts

@@ -50,10 +50,6 @@ export class ClientCredentialsJwtScenario implements Scenario {
       tokenEndpointAuthMethodsSupported: ['private_key_jwt'],
       tokenEndpointAuthSigningAlgValuesSupported: ['ES256'],
       onTokenRequest: async ({ grantType, body, timestamp, authBaseUrl }) => {
-        // Per RFC 7523bis, the audience MUST be the issuer identifier
-        const issuerUrl = authBaseUrl.endsWith('/')
-          ? authBaseUrl
-          : `${authBaseUrl}/`;
         if (grantType !== 'client_credentials') {
           this.checks.push({
             id: 'client-credentials-grant-type',
@@ -97,9 +93,16 @@ export class ClientCredentialsJwtScenario implements Scenario {
 
         // Verify JWT signature and claims using the generated public key
         try {
-          // Per RFC 7523bis, audience MUST be the issuer identifier
+          // Per RFC 7523bis, audience MUST be the issuer identifier.
+          // Per RFC 3986, URLs with and without trailing slash are equivalent,
+          // so we accept both forms for interoperability (e.g. Pydantic normalizes
+          // URLs by adding trailing slashes).
+          // Strip any trailing slashes first, then accept both the bare form
+          // and the form with exactly one trailing slash.
+          const withoutSlash = authBaseUrl.replace(/\/+$/, '');
+          const withSlash = `${withoutSlash}/`;
           const { payload } = await jose.jwtVerify(clientAssertion, publicKey, {
-            audience: issuerUrl,
+            audience: [withoutSlash, withSlash],
             clockTolerance: 30
           });
 

src/scenarios/client/auth/index.test.ts

@@ -3,13 +3,13 @@ import {
   runClientAgainstScenario,
   InlineClientRunner
 } from './test_helpers/testClient';
-import { runClient as goodClient } from '../../../../examples/clients/typescript/auth-test';
 import { runClient as badPrmClient } from '../../../../examples/clients/typescript/auth-test-bad-prm';
 import { runClient as noCimdClient } from '../../../../examples/clients/typescript/auth-test-no-cimd';
 import { runClient as ignoreScopeClient } from '../../../../examples/clients/typescript/auth-test-ignore-scope';
 import { runClient as partialScopesClient } from '../../../../examples/clients/typescript/auth-test-partial-scopes';
 import { runClient as ignore403Client } from '../../../../examples/clients/typescript/auth-test-ignore-403';
 import { runClient as noRetryLimitClient } from '../../../../examples/clients/typescript/auth-test-no-retry-limit';
+import { getHandler } from '../../../../examples/clients/typescript/everything-client';
 import { setLogLevel } from '../../../../examples/clients/typescript/helpers/logger';
 
 beforeAll(() => {
@@ -17,10 +17,7 @@ beforeAll(() => {
 });
 
 const skipScenarios = new Set<string>([
-  // Client credentials scenarios require SDK support for client_credentials grant
-  // Pending typescript-sdk implementation
-  'auth/client-credentials-jwt',
-  'auth/client-credentials-basic'
+  // Add scenarios that should be skipped here
 ]);
 
 const allowClientErrorScenarios = new Set<string>([
@@ -36,7 +33,11 @@ describe('Client Auth Scenarios', () => {
         // TODO: skip in a native way?
         return;
       }
-      const runner = new InlineClientRunner(goodClient);
+      const clientFn = getHandler(scenario.name);
+      if (!clientFn) {
+        throw new Error(`No handler registered for scenario: ${scenario.name}`);
+      }
+      const runner = new InlineClientRunner(clientFn);
       await runClientAgainstScenario(runner, scenario.name, {
         allowClientError: allowClientErrorScenarios.has(scenario.name)
       });

src/scenarios/client/auth/test_helpers/testClient.ts

@@ -107,6 +107,16 @@ export async function runClientAgainstScenario(
   const serverUrl = urls.serverUrl;
 
   try {
+    // Set environment variables for inline clients
+    // These mirror what src/runner/client.ts does for spawned processes
+    process.env.MCP_CONFORMANCE_SCENARIO = scenarioName;
+    if (urls.context) {
+      process.env.MCP_CONFORMANCE_CONTEXT = JSON.stringify({
+        name: scenarioName,
+        ...urls.context
+      });
+    }
+
     // Run the client
     try {
       await runner.run(serverUrl);
@@ -166,6 +176,10 @@ export async function runClientAgainstScenario(
       }
     }
   } finally {
+    // Clean up environment variables
+    delete process.env.MCP_CONFORMANCE_SCENARIO;
+    delete process.env.MCP_CONFORMANCE_CONTEXT;
+
     // Stop the scenario server
     await scenario.stop();
   }