[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_208":209,"_210":211},"routes/_app.x.$handle.$name",{"_99":98,"_32":46,"_108":85,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":121,"_122":123,"_124":25,"_125":126,"_127":128,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","shared/config.ts","latestPath","fileId","019ef6d9-f176-705d-8d8e-e7f509817afc","name","config.ts","fileType","script","content","/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://christinebetts--019ef6da11c372fc9887e43d7c03a238.web.val.run\",\n rs2: \"https://christinebetts--019ef6d9f176705d8d8ef6363a1c1df6.web.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n","/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://christinebetts-xaa-mcp-as2.web.val.run\",\n rs2: \"https://christinebetts-xaa-mcp-rs2.web.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };","createdAt",["D",1784304089181],"branchVersion","branchId","a1bf56af-d465-4e4f-bfd9-c30826c8b2b4","id","f726bb07-7ad6-425b-9da0-14a57a614b8f","xaa-mcp-rs2",["D",1782257938730],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","233f790c-f1f9-4399-b755-e5132ae1a50a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ef0dd-3fa8-7728-86f8-0cae11cb5ae4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":84,"_32":85,"_44":43,"_86":45,"_87":88,"_89":90,"_91":51,"_92":93,"_94":95,"_96":46,"_97":98},"isOwned",4,"main","projectId","forkedBranchId","69496e0a-4a56-11f1-8e32-ee650bb23af1","forkedBranchVersion",12,"forkedProjectPrivacy","forkedProjectId","6944ad98-4a56-11f1-8e32-ee650bb23af1","forkedProjectOrgId","019e0433-9f2e-749c-bf05-4b5f5a8e723b","projectName","userHandle","christinebetts","handle","displayName","Christine Betts","avatar","https://lh3.googleusercontent.com/a/ACg8ocIsz0U1bHCmvlQEmeKXflr2miVEnnjnL8WrdVAhJl2SLhAg7Cs=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":204,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":205,"_79":206,"_81":207,"_83":25},"tree",[173,177],"files",[173,174,175,176,177],"counts",{"_163":61,"_164":150,"_165":61,"_166":167,"_168":169},"contents",[144,145],"upstreamProject",{"_44":93,"_32":46,"_53":-5,"_54":-5,"_50":51,"_77":142},"upstreamBranch",{"_44":88,"_39":133,"_134":135,"_32":85,"_86":93,"_13":136,"_87":137,"_89":138,"_139":140,"_48":-5,"_83":25,"_50":51,"_97":141,"_62":95,"_96":46},"emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},["D",1778187041883],"updatedAt",["D",1786678483921],17,"b36964aa-18a0-11f1-bc84-42dde27851f2",9,"lockfileKey","1786678484152-esm.town_v_jlu_xaa-mcp-rs2@17-main","jlu",{"_99":141,"_107":143},"https://lh3.googleusercontent.com/a/ACg8ocK3SYoizVYImoeptY6sq74_q6gNsNUG1dJKtPCpRH1O99Wt0eQ=s96-c",{"_44":157,"_32":158,"_30":159,"_149":-5,"_42":43,"_41":150,"_151":128,"_39":160,"_13":61,"_34":161,"_36":-5,"_24":25,"_155":-5,"_27":162},{"_44":146,"_32":147,"_30":148,"_149":-5,"_42":43,"_41":150,"_151":128,"_39":152,"_13":61,"_34":153,"_36":154,"_24":25,"_155":-5,"_27":156},"e953619c-105e-411f-9633-d54c1dd001bb","http.ts","019ef6d9-f176-705d-8d8e-f6363a1c1df6","parentId",1,"latest",["D",1782257938730],"http","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Fake gmail. The point is the sub claim — prove that bob@tables.fake's\n// identity flowed Okta → as2 → here without a single consent screen.\n\nconst INBOX = [\n { id: \"m1\", from: \"aaron@okta.com\", subject: \"XAA beta access enabled for integrator-7089468\", snippet: \"Your tenant now supports token-exchange → id-jag. Try the Cross-App Access panel under Security.\" },\n { id: \"m2\", from: \"noreply@val.town\", subject: \"xaa-mcp-as2 deployed\", snippet: \"https://xaa-mcp-as2.val.run is live\" },\n { id: \"m3\", from: \"you@example.com\", subject: \"reminder: record demo before Apr 3\", snippet: \"todos → cal → gmail, zero clicks after the first Okta login\" },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-rs2\",\n selfUrl: URLS.rs2,\n asUrls: [URLS.as2],\n scopes: [\"gmail.read\", \"offline_access\"],\n port: 3004,\n tools: [\n {\n name: \"list_messages\",\n description: \"List inbox messages. Returns id + from + subject.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: (_args, claims) => ({\n content: [{\n type: \"text\",\n text: `Inbox for ${claims?.sub}:\\n` +\n INBOX.map((m) => ` [${m.id}] ${m.from} — ${m.subject}`).join(\"\\n\"),\n }],\n }),\n },\n {\n name: \"get_message\",\n description: \"Get one message by id.\",\n inputSchema: { type: \"object\", properties: { id: { type: \"string\" } }, required: [\"id\"] },\n handler: ({ id }) => {\n const m = INBOX.find((x) => x.id === id);\n return { content: [{ type: \"text\", text: m ? `From: ${m.from}\\nSubject: ${m.subject}\\n\\n${m.snippet}` : `No message ${id}` }] };\n },\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3004 }, app.fetch);\n","label",[147],"f9042eb3-87c6-4f64-9164-d80bcf24e2a6","shared","019ef6d9-f176-705d-8d8e-f138d0132ea1",["D",1782257938730],"directory",[158],"pulls","branches","forks","envVars",{"_170":61,"_172":61},"connections",{"_170":61,"_171":61},"count","unfilledCount","emptyCount",{"_44":157,"_32":158,"_30":159,"_149":-5,"_42":43,"_41":150,"_151":128,"_39":201,"_13":61,"_34":161,"_36":-5,"_24":25,"_155":-5,"_179":202,"_27":203},{"_44":196,"_32":33,"_30":31,"_149":159,"_42":43,"_41":14,"_151":25,"_39":197,"_13":198,"_34":35,"_36":38,"_24":25,"_155":-5,"_179":199,"_27":200},{"_44":189,"_32":190,"_30":191,"_149":159,"_42":43,"_41":150,"_151":128,"_39":192,"_13":61,"_34":35,"_36":193,"_24":25,"_155":-5,"_179":194,"_27":195},{"_44":182,"_32":183,"_30":184,"_149":159,"_42":43,"_41":150,"_151":128,"_39":185,"_13":61,"_34":35,"_36":186,"_24":25,"_155":-5,"_179":187,"_27":188},{"_44":146,"_32":147,"_30":148,"_149":-5,"_42":43,"_41":150,"_151":128,"_39":178,"_13":61,"_34":153,"_36":154,"_24":25,"_155":-5,"_179":180,"_27":181},["D",1782257938730],"children",[],[147],"49aa3109-ab4d-4891-be9f-59d063c7ef3f","mcp-rs.ts","019ef6d9-f176-705d-8d8e-ed09ceaefb50",["D",1782257938730],"/**\n * Shared MCP resource-server scaffolding. A tiny Hono app with:\n * - RFC 9728 PRM at /.well-known/oauth-protected-resource/mcp\n * - /mcp gated by AS-issued JWT bearer (aud-bound to this resource)\n * - stateless JSON-RPC dispatch (initialize, tools/list, tools/call)\n *\n * Skips the SDK transport + fetch-to-node — see rs/rs.ts history for why.\n */\n\nimport { Hono } from \"npm:hono@3\";\nimport type { Context } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, OKTA_ISSUER } from \"./config.ts\";\nimport { indexPage } from \"./html.ts\";\n\nexport interface Tool {\n name: string;\n description: string;\n inputSchema: Record;\n handler: (args: Record, claims?: jose.JWTPayload) => { content: { type: \"text\"; text: string }[] };\n}\n\nexport function createResourceServer(opts: {\n name: string;\n selfUrl: string; // e.g. URLS.rs or URLS.cal — origin only, we add /mcp\n asUrls?: string[]; // ASes whose JWKS gate /mcp; all advertised in PRM (toolbox picks [0])\n scopes?: string[]; // advertised as scopes_supported in the PRM\n tools: Tool[];\n port: number;\n}): Hono {\n const resource = `${opts.selfUrl}/mcp`;\n const asUrls = opts.asUrls ?? [URLS.as];\n const jwksByIss = new Map(asUrls.map((u) => [u, jose.createRemoteJWKSet(new URL(`${u}/.well-known/jwks.json`))]));\n const prmPath = \"/.well-known/oauth-protected-resource/mcp\";\n\n const app = new Hono();\n app.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n exposeHeaders: [\"WWW-Authenticate\"],\n }));\n\n app.get(prmPath, (c) =>\n c.json({ resource, authorization_servers: asUrls, ...(opts.scopes ? { scopes_supported: opts.scopes } : {}) }));\n\n // Tenant-flavored PRM (RFC 9728 path-suffix form). The AS URLs carry the\n // tenant as a path segment (Atlassian-style tenanted issuer) so we can\n // observe which well-known construction a client derives from it.\n app.get(`${prmPath}/:tenant`, (c) => {\n const tenant = c.req.param(\"tenant\");\n return c.json({\n resource: `${resource}/${tenant}`,\n authorization_servers: asUrls.map((u) => `${u}/${tenant}`),\n ...(opts.scopes ? { scopes_supported: opts.scopes } : {}),\n });\n });\n\n const handleMcp = async (c: Context, tenant?: string) => {\n const prm = tenant ? `${prmPath}/${tenant}` : prmPath;\n const authz = c.req.header(\"Authorization\");\n const unauthorized = (msg: string) =>\n c.json(\n { jsonrpc: \"2.0\", error: { code: -32001, message: msg }, id: null },\n 401,\n { \"WWW-Authenticate\": `Bearer resource_metadata=\"${opts.selfUrl}${prm}\"` },\n );\n\n if (!authz?.startsWith(\"Bearer \")) return unauthorized(\"Authentication required\");\n\n const token = authz.slice(7);\n let tokenClaims: jose.JWTPayload;\n try {\n const peek = jose.decodeJwt(token);\n if (peek.iss === OKTA_ISSUER) {\n // ID-JAG from Okta — iss check only, sig verification TODO\n tokenClaims = peek;\n } else {\n const jwks = peek.iss ? jwksByIss.get(peek.iss) : undefined;\n if (!jwks) throw new Error(`untrusted issuer ${peek.iss}`);\n // Tenant paths accept the base /mcp aud too — this demo tests\n // discovery-URL fidelity, not aud strictness.\n const { payload } = await jose.jwtVerify(token, jwks, {\n issuer: peek.iss,\n audience: tenant ? [resource, `${resource}/${tenant}`] : resource,\n });\n tokenClaims = payload;\n }\n } catch (e) {\n return unauthorized(`Invalid token: ${e instanceof Error ? e.message : e}`);\n }\n\n const msg = await c.req.json();\n if (msg.id === undefined) return c.body(null, 202); // notification\n\n try {\n return c.json({ jsonrpc: \"2.0\", id: msg.id, result: dispatch(msg, opts, tokenClaims) });\n } catch (err) {\n const error = (err && typeof err === \"object\" && \"code\" in err)\n ? err\n : { code: -32603, message: String(err) };\n return c.json({ jsonrpc: \"2.0\", id: msg.id, error });\n }\n };\n\n app.post(\"/mcp\", (c) => handleMcp(c));\n app.post(\"/mcp/:tenant\", (c) => handleMcp(c, c.req.param(\"tenant\")));\n\n app.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"RS\",\n name: opts.name,\n endpoints: [\n { method: \"GET\", path: prmPath },\n { method: \"POST\", path: \"/mcp\", note: `bearer-gated; tools: ${opts.tools.map((t) => t.name).join(\", \")}` },\n ],\n })));\n\n app.onError((err) => { throw err; });\n return app;\n}\n\nfunction dispatch(msg: { method: string; params?: any }, opts: { name: string; tools: Tool[] }, claims?: jose.JWTPayload): unknown {\n switch (msg.method) {\n case \"initialize\":\n return {\n protocolVersion: msg.params?.protocolVersion ?? \"2025-06-18\",\n serverInfo: { name: opts.name, version: \"1.0.0\" },\n capabilities: { tools: { listChanged: false } },\n };\n case \"tools/list\":\n return { tools: opts.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) };\n case \"tools/call\": {\n const { name, arguments: args } = msg.params ?? {};\n const tool = opts.tools.find((t) => t.name === name);\n if (!tool) throw { code: -32602, message: `Unknown tool: ${name}` };\n return tool.handler(args ?? {}, claims);\n }\n default:\n throw { code: -32601, message: `Method not found: ${msg.method}` };\n }\n}\n",[],[158,183],"8f304e3b-4f95-480c-af90-bbd445b752bd","html.ts","019ef6d9-f176-705d-8d8e-eb9d8144fd7b",["D",1782257938730],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[158,190],"c5954a98-1a45-421b-9623-3c48a6aeaafb",["D",1784304089181],2,[],[158,33],["D",1782257938730],[174,175,176],[158],["D",1782257938730],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":84,"_32":85,"_44":43,"_86":45,"_87":88,"_89":90,"_91":51,"_92":93,"_94":95,"_96":46,"_97":98},"ctx",{"_77":-5,"_130":241,"_242":243,"_244":245,"_246":25,"_247":25,"_248":25,"_249":128,"_250":-5,"_251":-7,"_252":-7,"_253":61,"_254":25,"_255":25,"_256":-5,"_257":25,"_258":25,"_259":25,"_260":-5},"ENV",{"_212":213,"_214":215,"_216":85,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3