[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_101":100,"_37":49,"_109":91,"_32":103,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_26":-5,"_120":-5,"_121":-5,"_122":30,"_123":124,"_125":63,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_47":48,"_37":49,"_42":50,"_51":-5,"_52":30,"_53":54,"_55":54,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":30},"version",5,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","df61da39-c27d-4ce2-a123-26ab89a097c2","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":33,"_38":39,"_40":41,"_42":43,"_44":14,"_45":46,"_29":30},"previous","deleted",false,"deletedHere","path","oauth.ts","latestPath","fileId","9046db8c-9a56-11f1-a250-1607ee4eb77e","name","fileType","script","content","// Minimal auto-approving OAuth 2.0 authorization-server endpoints for MCP.\n// This is a DEMO with NO real security: any request is accepted, and the\n// access token is never validated by the actual MCP endpoint. The flow only\n// exists so Claude Connectors' OAuth handshake completes successfully.\n//\n// Endpoints:\n// GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n// POST /register (RFC 7591 DCR)\n// GET /authorize (RFC 6749, auto-approve)\n// POST /token (RFC 6749, issue token)\n// POST /revoke (RFC 7009, always ok)\n//\n// Authorization codes are stored in the val's blob store because Val Town is\n// serverless and /authorize + /token are separate HTTP invocations that may\n// land on different isolates — in-memory state is not safe across requests.\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst CODE_PREFIX = \"oauth:code:\";\nconst keyForCode = (code: string) => CODE_PREFIX + code;\nconst epochSec = () => Math.floor(Date.now() / 1000);\n\nfunction baseUrl(req: Request): string {\n return new URL(req.url).origin;\n}\n\nfunction oauthError(status: number, error: string, description?: string): Response {\n return Response.json(\n { error, error_description: description ?? \"\" },\n { status },\n );\n}\n\nasync function readBody(req: Request): Promise> {\n const text = await req.text();\n if (!text) return {};\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n return Object.fromEntries(new URLSearchParams(text));\n }\n if (ct.includes(\"application/json\")) {\n try {\n const j = JSON.parse(text);\n const out: Record = {};\n for (const [k, v] of Object.entries(j)) out[k] = String(v);\n return out;\n } catch {\n return Object.fromEntries(new URLSearchParams(text));\n }\n }\n return Object.fromEntries(new URLSearchParams(text));\n}\n\nasync function pkceS256(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return btoa(String.fromCharCode(...new Uint8Array(digest)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/g, \"\");\n}\n\n// RFC 8414: OAuth 2.0 Authorization Server Metadata\nexport function wellKnown(req: Request): Response {\n const b = baseUrl(req);\n return Response.json({\n issuer: b,\n authorization_endpoint: `${b}/authorize`,\n token_endpoint: `${b}/token`,\n registration_endpoint: `${b}/register`,\n revocation_endpoint: `${b}/revoke`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n revocation_endpoint_auth_methods_supported: [\"none\"],\n code_challenge_methods_supported: [\"S256\"],\n });\n}\n\n// RFC 7591: Dynamic Client Registration — accept anything, return a client_id.\nexport async function register(req: Request): Promise {\n let redirectUris: string[] = [];\n let clientName = \"\";\n let tokenAuthMethod = \"none\";\n let secret = \"\";\n const text = await req.text();\n if (text) {\n try {\n const b = JSON.parse(text);\n if (Array.isArray(b.redirect_uris)) {\n redirectUris = b.redirect_uris.filter((u: unknown) => typeof u === \"string\");\n }\n if (typeof b.client_name === \"string\") clientName = b.client_name;\n if (\n b.token_endpoint_auth_method === \"client_secret_basic\" ||\n b.token_endpoint_auth_method === \"client_secret_post\"\n ) {\n tokenAuthMethod = b.token_endpoint_auth_method;\n secret = \"cs_\" + crypto.randomUUID().replace(/-/g, \"\");\n }\n } catch {\n // not JSON — still auto-register below\n }\n }\n\n const body: Record = {\n client_id: crypto.randomUUID(),\n client_id_issued_at: epochSec(),\n redirect_uris: redirectUris,\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: tokenAuthMethod,\n client_name: clientName,\n };\n if (secret) {\n body.client_secret = secret;\n body.client_secret_expires_at = 0;\n }\n return Response.json(body, { status: 201 });\n}\n\n// RFC 6749 / authorization code flow — always approves, no login screen.\nexport async function authorize(req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = url.searchParams.get(\"redirect_uri\") ?? \"\";\n if (!redirectUri) {\n return oauthError(400, \"invalid_request\", \"missing redirect_uri\");\n }\n\n const state = url.searchParams.get(\"state\") ?? \"\";\n const codeChallenge = url.searchParams.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = url.searchParams.get(\"code_challenge_method\") ?? \"plain\";\n\n const code = crypto.randomUUID();\n await blob.setJSON(keyForCode(code), {\n client_id: url.searchParams.get(\"client_id\") ?? \"\",\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: codeChallengeMethod,\n created: Date.now(),\n });\n\n const location = new URL(redirectUri);\n location.searchParams.set(\"code\", code);\n if (state) location.searchParams.set(\"state\", state);\n // Response.redirect is broken on Val Town — build the 302 manually.\n return new Response(null, { status: 302, headers: { Location: location.toString() } });\n}\n\n// RFC 6749 token endpoint — validates the code (+PKCE) then issues a Bearer token.\nexport async function token(req: Request): Promise {\n const params = await readBody(req);\n if (params.grant_type !== \"authorization_code\" || !params.code) {\n return oauthError(400, \"unsupported_grant_type\", \"Expected grant_type=authorization_code\");\n }\n\n const key = keyForCode(params.code);\n const stored = await blob.getJSON<{\n client_id: string;\n redirect_uri: string;\n code_challenge: string;\n code_challenge_method: string;\n }>(key);\n if (!stored) return oauthError(400, \"invalid_grant\", \"unknown or expired code\");\n\n // Verify PKCE if the authorization request carried a code_challenge.\n if (stored.code_challenge) {\n const verifier = params.code_verifier;\n if (!verifier) return oauthError(400, \"invalid_grant\", \"code_verifier required\");\n const expected = stored.code_challenge_method === \"S256\"\n ? await pkceS256(verifier)\n : verifier;\n if (expected !== stored.code_challenge) {\n return oauthError(400, \"invalid_grant\", \"code_verifier mismatch\");\n }\n }\n\n await blob.delete(key); // one-time use\n\n return Response.json({\n access_token: \"vt_\" + crypto.randomUUID().replace(/-/g, \"\"),\n token_type: \"Bearer\",\n expires_in: 3600,\n scope: \"\",\n });\n}\n\n// RFC 7009 — nothing to revoke, just succeed.\nexport async function revoke(): Promise {\n return new Response(null, { status: 200 });\n}\n","createdAt",["D",1786983200324],"branchVersion","branchId","56475fb0-9b8d-42e2-b750-5571b77b93ce","id","33dc0890-383d-41be-9f41-da7c9c856ebf","instorepromotions",["D",1786982475729],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Remote MCP server (Streamable HTTP): get_todays_promotions tool","imageUrl","13a73f69-9bc1-4a3c-8d54-80a27491896b","pinnedFileId","e062e0ae-9a54-11f1-8c7b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019fd215-485d-75ee-a30a-00353f9100df","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":103},"org",{"_101":100,"_102":103,"_104":103,"_19":59,"_105":106,"_107":30},"branch",{"_13":90,"_37":91,"_47":46,"_92":48,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":49,"_99":100},"isOwned",7,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pallavipant","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_47":48,"_37":49,"_42":179,"_51":-5,"_52":30,"_53":54,"_55":54,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":180,"_85":181,"_87":182,"_89":30},"tree",[166,167,168],"files",[166,167,168],"counts",{"_155":67,"_156":157,"_158":67,"_159":160,"_161":162},"contents",[130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_47":146,"_37":147,"_35":61,"_136":-5,"_45":46,"_44":148,"_138":30,"_42":149,"_13":150,"_38":151,"_40":152,"_29":30,"_141":153,"_32":154},{"_47":143,"_37":33,"_35":36,"_136":-5,"_45":46,"_44":14,"_138":63,"_42":144,"_13":67,"_38":39,"_40":41,"_29":30,"_141":-5,"_32":145},{"_47":133,"_37":134,"_35":135,"_136":-5,"_45":46,"_44":137,"_138":30,"_42":139,"_13":67,"_38":39,"_40":140,"_29":30,"_141":-5,"_32":142},"2bca0d7c-9cc3-4a17-b90f-e2f1db9054c8","test-mcp.ts","3303bbee-9a55-11f1-a932-1607ee4eb77e","parentId",4,"latest",["D",1786982614387],"// One-off verification script: exercises the MCP server over Streamable HTTP\n// with the required Accept header. Run manually (run_file) to check the server.\nconst endpoint = \"https://instore-promotions-mcp.val.run/\";\nconst headers = {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json, text/event-stream\",\n};\n\nasync function rpc(method: string, params: unknown = {}, id = 1) {\n const res = await fetch(endpoint, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method, params }),\n });\n console.log(`\\n== ${method} (${res.status}) ==`);\n console.log(await res.text());\n}\n\nawait rpc(\"initialize\", {\n protocolVersion: \"2025-06-18\",\n capabilities: {},\n clientInfo: { name: \"verifier\", version: \"1.0\" },\n});\nawait rpc(\"tools/list\", {}, 2);\nawait rpc(\"tools/call\", { name: \"get_todays_promotions\", arguments: {} }, 3);\n","label",[134],"0cb6ce5e-d8c9-4159-a093-2738a572365b",["D",1786983200324],[33],"ee92bf6d-498d-4c3e-a91e-4bdb74c18639","main.ts",3,["D",1786982553108],2,"http","// Remote MCP server — Streamable HTTP transport (stateless, JSON responses).\n// Exposes one tool: get_todays_promotions\n//\n// Import the SDK subpaths (TypeScript SDK v1.x, web-standard transport).\nimport { Server } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/index.js\";\nimport { WebStandardStreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/webStandardStreamableHttp.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"npm:@modelcontextprotocol/sdk@1.26.0/types.js\";\n\n// ---- Static data ----\nconst PROMOTIONS = [\n { item_name: \"Fall Harvest Pumpkin Spice Granola\", discount: \"Buy 1 Get 1 50% Off\", category: \"Snacks\", ends_date: \"2026-11-30\" },\n { item_name: \"Cozy Flannel Throw Blanket\", discount: \"25% Off\", category: \"Home & Seasonal\", ends_date: \"2026-12-31\" },\n { item_name: \"Wireless Noise-Cancelling Earbuds\", discount: \"$40 Off\", category: \"Electronics\", ends_date: \"2026-12-15\" },\n { item_name: \"Organic Cold-Pressed Orange Juice\", discount: \"2 for $6\", category: \"Beverages\", ends_date: \"2026-12-01\" },\n { item_name: \"Men's Thermal Base Layer Set\", discount: \"30% Off\", category: \"Apparel\", ends_date: \"2027-02-28\" },\n];\n\nconst TOOL_DEFINITION = {\n name: \"get_todays_promotions\",\n description:\n \"Returns today's in-store promotions. Each promotion has an item_name, discount, category, and ends_date. Takes no inputs.\",\n inputSchema: { type: \"object\", properties: {} },\n};\n\n// ---- MCP server ----\nfunction createServer(): Server {\n const server = new Server(\n { name: \"instore-promotions\", version: \"1.0.0\" },\n { capabilities: { tools: {} } },\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [TOOL_DEFINITION],\n }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === \"get_todays_promotions\") {\n return {\n content: [\n {\n type: \"text\" as const,\n text: JSON.stringify(PROMOTIONS, null, 2),\n },\n ],\n };\n }\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: `Unknown tool: ${request.params.name}` }],\n };\n });\n\n return server;\n}\n\n// ---- HTTP handler (Val Town runs this on each request) ----\n// Stateless: a fresh server + transport per request. enableJsonResponse makes\n// the server answer plain JSON instead of opening SSE streams, which works\n// reliably on serverless runtimes like Val Town.\nexport default async function (req: Request): Promise {\n const server = createServer();\n const transport = new WebStandardStreamableHTTPServerTransport({\n sessionIdGenerator: undefined, // stateless — no session tracking\n enableJsonResponse: true,\n });\n await server.connect(transport);\n return transport.handleRequest(req);\n}\n","instore-promotions-mcp",[147],"pulls","branches",1,"forks","envVars",{"_163":67,"_165":67},"connections",{"_163":67,"_164":67},"count","unfilledCount","emptyCount",{"_47":146,"_37":147,"_35":61,"_136":-5,"_45":46,"_44":148,"_138":30,"_42":176,"_13":150,"_38":151,"_40":152,"_29":30,"_141":153,"_170":177,"_32":178},{"_47":143,"_37":33,"_35":36,"_136":-5,"_45":46,"_44":14,"_138":63,"_42":173,"_13":67,"_38":39,"_40":41,"_29":30,"_141":-5,"_170":174,"_32":175},{"_47":133,"_37":134,"_35":135,"_136":-5,"_45":46,"_44":137,"_138":30,"_42":169,"_13":67,"_38":39,"_40":140,"_29":30,"_141":-5,"_170":171,"_32":172},["D",1786982614387],"children",[],[134],["D",1786983200324],[],[33],["D",1786982553108],[],[147],["D",1786982475729],{"_101":100,"_108":103},{"_101":100,"_102":103,"_104":103,"_19":59,"_105":106,"_107":30},{"_13":90,"_37":91,"_47":46,"_92":48,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":49,"_99":100},"ctx",{"_83":-5,"_127":216,"_217":218,"_219":220,"_221":30,"_222":30,"_223":30,"_224":63,"_225":-5,"_226":-7,"_227":-7,"_228":67,"_229":30,"_230":30,"_231":-5,"_232":30,"_233":30,"_234":30,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":91,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v5