[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_184":185,"_186":187},"routes/_app.x.$handle.$name",{"_102":101,"_38":51,"_110":92,"_33":104,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_26":-5,"_121":-5,"_122":-5,"_123":31,"_124":125,"_126":65,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":31},"version",7,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","df61da39-c27d-4ce2-a123-26ab89a097c2","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","test-mcp.ts","latestPath","fileId","3303bbee-9a55-11f1-a932-1607ee4eb77e","name","fileType","script","content","// One-off verification script: exercises the MCP server over Streamable HTTP\n// with the required Accept header. Run manually (run_file) to check the server.\nconst endpoint = \"https://instore-promotions-mcp.val.run/\";\nconst headers = {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json, text/event-stream\",\n};\n\nasync function rpc(method: string, params: unknown = {}, id = 1) {\n const res = await fetch(endpoint, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method, params }),\n });\n console.log(`\\n== ${method} (${res.status}) ==`);\n console.log(await res.text());\n}\n\nawait rpc(\"initialize\", {\n protocolVersion: \"2025-06-18\",\n capabilities: {},\n clientInfo: { name: \"verifier\", version: \"1.0\" },\n});\nawait rpc(\"tools/list\", {}, 2);\nawait rpc(\"tools/call\", { name: \"get_todays_promotions\", arguments: {} }, 3);\n","// One-off verification: full OAuth handshake (well-known → register →\n// authorize → token) then an MCP call to the real endpoint using the issued\n// token. Run with run_file.\nconst base = \"https://instore-promotions-mcp.val.run\";\nconst jsonHeaders = { \"Content-Type\": \"application/json\", Accept: \"application/json, text/event-stream\" };\n\nasync function show(label: string, res: Response, text: string) {\n console.log(`\\n== ${label} (${res.status}) ==`);\n console.log(text);\n}\n\n// 1) RFC 8414 metadata\nlet res = await fetch(`${base}/.well-known/oauth-authorization-server`);\nawait show(\"well-known metadata\", res, await res.text());\n\n// 2) RFC 7591 dynamic client registration\nres = await fetch(`${base}/register`, {\n method: \"POST\",\n headers: jsonHeaders,\n body: JSON.stringify({ redirect_uris: [\"http://127.0.0.1/callback\"], client_name: \"me\" }),\n});\nconst regText = await res.text();\nawait show(\"register\", res, regText);\nconst { client_id: clientId } = JSON.parse(regText);\n\n// 3) authorize -> auto-approve, redirects with code + state\nconst verifier = \"demo-verifier-abc123\";\nconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\nconst challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\nconst authUrl = new URL(`${base}/authorize`);\nauthUrl.searchParams.set(\"response_type\", \"code\");\nauthUrl.searchParams.set(\"client_id\", clientId);\nauthUrl.searchParams.set(\"redirect_uri\", \"http://127.0.0.1/callback\");\nauthUrl.searchParams.set(\"state\", \"test-state-123\");\nauthUrl.searchParams.set(\"code_challenge\", challenge);\nauthUrl.searchParams.set(\"code_challenge_method\", \"S256\");\nres = await fetch(authUrl, { redirect: \"manual\" });\nawait show(\"authorize (expect 302)\", res, res.headers.get(\"location\") ?? \"\");\nconst location = new URL(res.headers.get(\"location\") ?? \"\");\nconst code = location.searchParams.get(\"code\") ?? \"\";\nconst state = location.searchParams.get(\"state\") ?? \"\";\n\n// 4) token exchange\nres = await fetch(`${base}/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: \"http://127.0.0.1/callback\",\n client_id: clientId,\n code_verifier: verifier,\n }),\n});\nconst tokText = await res.text();\nawait show(\"token\", res, tokText);\nconst { access_token: accessToken } = JSON.parse(tokText);\n\n// 5) MCP call with the Bearer token (server should accept it regardless)\nasync function rpc(method: string, params: unknown = {}, id = 1) {\n const r = await fetch(`${base}/`, {\n method: \"POST\",\n headers: { ...jsonHeaders, Authorization: `Bearer ${accessToken}` },\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method, params }),\n });\n await show(`MCP ${method} (with token)`, r, await r.text());\n}\nawait rpc(\"initialize\", { protocolVersion: \"2025-06-18\", capabilities: {}, clientInfo: { name: \"verifier\", version: \"1.0\" } });\nawait rpc(\"tools/call\", { name: \"get_todays_promotions\", arguments: {} }, 3);\n\nconsole.log(`\\nstate echoed: ${state} (expected \"test-state-123\")`);\n","createdAt",["D",1786983232020],"branchVersion","branchId","56475fb0-9b8d-42e2-b750-5571b77b93ce","id","33dc0890-383d-41be-9f41-da7c9c856ebf","instorepromotions",["D",1786982475729],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Remote MCP server (Streamable HTTP): get_todays_promotions tool","imageUrl","13a73f69-9bc1-4a3c-8d54-80a27491896b","pinnedFileId","e062e0ae-9a54-11f1-8c7b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019fd215-485d-75ee-a30a-00353f9100df","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_109":104},"org",{"_102":101,"_103":104,"_105":104,"_19":61,"_106":107,"_108":31},"branch",{"_13":14,"_38":92,"_49":48,"_93":50,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":51,"_100":101},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pallavipant","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_49":50,"_38":51,"_44":180,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":181,"_87":182,"_89":183,"_91":31},"tree",[167,168,169],"files",[167,168,169],"counts",{"_157":69,"_158":138,"_159":69,"_160":161,"_162":163},"contents",[131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":148,"_38":149,"_36":63,"_135":-5,"_47":48,"_46":150,"_136":65,"_44":151,"_13":152,"_39":153,"_41":154,"_30":31,"_139":155,"_33":156},{"_49":141,"_38":142,"_36":143,"_135":-5,"_47":48,"_46":144,"_136":65,"_44":145,"_13":69,"_39":40,"_41":146,"_30":31,"_139":-5,"_33":147},{"_49":134,"_38":34,"_36":37,"_135":-5,"_47":48,"_46":14,"_136":65,"_44":137,"_13":138,"_39":40,"_41":43,"_30":31,"_139":-5,"_33":140},"c7c7ec89-ff35-4c71-87a5-bbb5901c352b","parentId","latest",["D",1786983232020],1,"label",[34],"0cb6ce5e-d8c9-4159-a093-2738a572365b","oauth.ts","9046db8c-9a56-11f1-a250-1607ee4eb77e",5,["D",1786983200324],"// Minimal auto-approving OAuth 2.0 authorization-server endpoints for MCP.\n// This is a DEMO with NO real security: any request is accepted, and the\n// access token is never validated by the actual MCP endpoint. The flow only\n// exists so Claude Connectors' OAuth handshake completes successfully.\n//\n// Endpoints:\n// GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n// POST /register (RFC 7591 DCR)\n// GET /authorize (RFC 6749, auto-approve)\n// POST /token (RFC 6749, issue token)\n// POST /revoke (RFC 7009, always ok)\n//\n// Authorization codes are stored in the val's blob store because Val Town is\n// serverless and /authorize + /token are separate HTTP invocations that may\n// land on different isolates — in-memory state is not safe across requests.\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst CODE_PREFIX = \"oauth:code:\";\nconst keyForCode = (code: string) => CODE_PREFIX + code;\nconst epochSec = () => Math.floor(Date.now() / 1000);\n\nfunction baseUrl(req: Request): string {\n return new URL(req.url).origin;\n}\n\nfunction oauthError(status: number, error: string, description?: string): Response {\n return Response.json(\n { error, error_description: description ?? \"\" },\n { status },\n );\n}\n\nasync function readBody(req: Request): Promise> {\n const text = await req.text();\n if (!text) return {};\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n return Object.fromEntries(new URLSearchParams(text));\n }\n if (ct.includes(\"application/json\")) {\n try {\n const j = JSON.parse(text);\n const out: Record = {};\n for (const [k, v] of Object.entries(j)) out[k] = String(v);\n return out;\n } catch {\n return Object.fromEntries(new URLSearchParams(text));\n }\n }\n return Object.fromEntries(new URLSearchParams(text));\n}\n\nasync function pkceS256(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return btoa(String.fromCharCode(...new Uint8Array(digest)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/g, \"\");\n}\n\n// RFC 8414: OAuth 2.0 Authorization Server Metadata\nexport function wellKnown(req: Request): Response {\n const b = baseUrl(req);\n return Response.json({\n issuer: b,\n authorization_endpoint: `${b}/authorize`,\n token_endpoint: `${b}/token`,\n registration_endpoint: `${b}/register`,\n revocation_endpoint: `${b}/revoke`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n revocation_endpoint_auth_methods_supported: [\"none\"],\n code_challenge_methods_supported: [\"S256\"],\n });\n}\n\n// RFC 7591: Dynamic Client Registration — accept anything, return a client_id.\nexport async function register(req: Request): Promise {\n let redirectUris: string[] = [];\n let clientName = \"\";\n let tokenAuthMethod = \"none\";\n let secret = \"\";\n const text = await req.text();\n if (text) {\n try {\n const b = JSON.parse(text);\n if (Array.isArray(b.redirect_uris)) {\n redirectUris = b.redirect_uris.filter((u: unknown) => typeof u === \"string\");\n }\n if (typeof b.client_name === \"string\") clientName = b.client_name;\n if (\n b.token_endpoint_auth_method === \"client_secret_basic\" ||\n b.token_endpoint_auth_method === \"client_secret_post\"\n ) {\n tokenAuthMethod = b.token_endpoint_auth_method;\n secret = \"cs_\" + crypto.randomUUID().replace(/-/g, \"\");\n }\n } catch {\n // not JSON — still auto-register below\n }\n }\n\n const body: Record = {\n client_id: crypto.randomUUID(),\n client_id_issued_at: epochSec(),\n redirect_uris: redirectUris,\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: tokenAuthMethod,\n client_name: clientName,\n };\n if (secret) {\n body.client_secret = secret;\n body.client_secret_expires_at = 0;\n }\n return Response.json(body, { status: 201 });\n}\n\n// RFC 6749 / authorization code flow — always approves, no login screen.\nexport async function authorize(req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = url.searchParams.get(\"redirect_uri\") ?? \"\";\n if (!redirectUri) {\n return oauthError(400, \"invalid_request\", \"missing redirect_uri\");\n }\n\n const state = url.searchParams.get(\"state\") ?? \"\";\n const codeChallenge = url.searchParams.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = url.searchParams.get(\"code_challenge_method\") ?? \"plain\";\n\n const code = crypto.randomUUID();\n await blob.setJSON(keyForCode(code), {\n client_id: url.searchParams.get(\"client_id\") ?? \"\",\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: codeChallengeMethod,\n created: Date.now(),\n });\n\n const location = new URL(redirectUri);\n location.searchParams.set(\"code\", code);\n if (state) location.searchParams.set(\"state\", state);\n // Response.redirect is broken on Val Town — build the 302 manually.\n return new Response(null, { status: 302, headers: { Location: location.toString() } });\n}\n\n// RFC 6749 token endpoint — validates the code (+PKCE) then issues a Bearer token.\nexport async function token(req: Request): Promise {\n const params = await readBody(req);\n if (params.grant_type !== \"authorization_code\" || !params.code) {\n return oauthError(400, \"unsupported_grant_type\", \"Expected grant_type=authorization_code\");\n }\n\n const key = keyForCode(params.code);\n const stored = await blob.getJSON<{\n client_id: string;\n redirect_uri: string;\n code_challenge: string;\n code_challenge_method: string;\n }>(key);\n if (!stored) return oauthError(400, \"invalid_grant\", \"unknown or expired code\");\n\n // Verify PKCE if the authorization request carried a code_challenge.\n if (stored.code_challenge) {\n const verifier = params.code_verifier;\n if (!verifier) return oauthError(400, \"invalid_grant\", \"code_verifier required\");\n const expected = stored.code_challenge_method === \"S256\"\n ? await pkceS256(verifier)\n : verifier;\n if (expected !== stored.code_challenge) {\n return oauthError(400, \"invalid_grant\", \"code_verifier mismatch\");\n }\n }\n\n await blob.delete(key); // one-time use\n\n return Response.json({\n access_token: \"vt_\" + crypto.randomUUID().replace(/-/g, \"\"),\n token_type: \"Bearer\",\n expires_in: 3600,\n scope: \"\",\n });\n}\n\n// RFC 7009 — nothing to revoke, just succeed.\nexport async function revoke(): Promise {\n return new Response(null, { status: 200 });\n}\n",[142],"1f785d61-d6e3-4d23-be6d-86fe1a5746df","main.ts",6,["D",1786983208835],3,"http","// Remote MCP server — Streamable HTTP transport (stateless, JSON responses).\n// Exposes one tool: get_todays_promotions\n//\n// Also serves a minimal auto-approving OAuth 2.0 flow so Claude Connectors can\n// complete their OAuth handshake (the MCP endpoint itself accepts any request,\n// with or without a token — this is a demo with no real security).\n//\n// Import the SDK subpaths (TypeScript SDK v1.x, web-standard transport).\nimport { Server } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/index.js\";\nimport { WebStandardStreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/webStandardStreamableHttp.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"npm:@modelcontextprotocol/sdk@1.26.0/types.js\";\nimport {\n authorize,\n register,\n revoke,\n token,\n wellKnown,\n} from \"./oauth.ts\";\n\n// ---- Static data ----\nconst PROMOTIONS = [\n { item_name: \"Fall Harvest Pumpkin Spice Granola\", discount: \"Buy 1 Get 1 50% Off\", category: \"Snacks\", ends_date: \"2026-11-30\" },\n { item_name: \"Cozy Flannel Throw Blanket\", discount: \"25% Off\", category: \"Home & Seasonal\", ends_date: \"2026-12-31\" },\n { item_name: \"Wireless Noise-Cancelling Earbuds\", discount: \"$40 Off\", category: \"Electronics\", ends_date: \"2026-12-15\" },\n { item_name: \"Organic Cold-Pressed Orange Juice\", discount: \"2 for $6\", category: \"Beverages\", ends_date: \"2026-12-01\" },\n { item_name: \"Men's Thermal Base Layer Set\", discount: \"30% Off\", category: \"Apparel\", ends_date: \"2027-02-28\" },\n];\n\nconst TOOL_DEFINITION = {\n name: \"get_todays_promotions\",\n description:\n \"Returns today's in-store promotions. Each promotion has an item_name, discount, category, and ends_date. Takes no inputs.\",\n inputSchema: { type: \"object\", properties: {} },\n};\n\n// ---- MCP server ----\nfunction createServer(): Server {\n const server = new Server(\n { name: \"instore-promotions\", version: \"1.0.0\" },\n { capabilities: { tools: {} } },\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [TOOL_DEFINITION],\n }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === \"get_todays_promotions\") {\n return {\n content: [\n {\n type: \"text\" as const,\n text: JSON.stringify(PROMOTIONS, null, 2),\n },\n ],\n };\n }\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: `Unknown tool: ${request.params.name}` }],\n };\n });\n\n return server;\n}\n\n// ---- MCP HTTP handler ----\n// Stateless: a fresh server + transport per request. enableJsonResponse makes\n// the server answer plain JSON instead of opening SSE streams, which works\n// reliably on serverless runtimes like Val Town.\nasync function handleMcp(req: Request): Promise {\n const server = createServer();\n const transport = new WebStandardStreamableHTTPServerTransport({\n sessionIdGenerator: undefined, // stateless — no session tracking\n enableJsonResponse: true,\n });\n await server.connect(transport);\n // The transport ignores the Authorization header, so a Bearer token (valid\n // or not) is accepted — exactly what this demo wants.\n return transport.handleRequest(req);\n}\n\n// ---- Router ----\nexport default async function (req: Request): Promise {\n const { pathname } = new URL(req.url);\n\n switch (pathname) {\n case \"/.well-known/oauth-authorization-server\":\n return wellKnown(req);\n case \"/register\":\n return register(req);\n case \"/authorize\":\n return authorize(req);\n case \"/token\":\n return token(req);\n case \"/revoke\":\n return revoke();\n default:\n return handleMcp(req);\n }\n}\n","instore-promotions-mcp",[149],"pulls","branches","forks","envVars",{"_164":69,"_166":69},"connections",{"_164":69,"_165":69},"count","unfilledCount","emptyCount",{"_49":148,"_38":149,"_36":63,"_135":-5,"_47":48,"_46":150,"_136":65,"_44":177,"_13":152,"_39":153,"_41":154,"_30":31,"_139":155,"_171":178,"_33":179},{"_49":141,"_38":142,"_36":143,"_135":-5,"_47":48,"_46":144,"_136":65,"_44":174,"_13":69,"_39":40,"_41":146,"_30":31,"_139":-5,"_171":175,"_33":176},{"_49":134,"_38":34,"_36":37,"_135":-5,"_47":48,"_46":14,"_136":65,"_44":170,"_13":138,"_39":40,"_41":43,"_30":31,"_139":-5,"_171":172,"_33":173},["D",1786983232020],"children",[],[34],["D",1786983200324],[],[142],["D",1786983208835],[],[149],["D",1786982475729],{"_102":101,"_109":104},{"_102":101,"_103":104,"_105":104,"_19":61,"_106":107,"_108":31},{"_13":14,"_38":92,"_49":48,"_93":50,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":51,"_100":101},"ctx",{"_85":-5,"_128":217,"_218":219,"_220":221,"_222":31,"_223":31,"_224":31,"_225":65,"_226":-5,"_227":-7,"_228":-7,"_229":69,"_230":31,"_231":31,"_232":-5,"_233":31,"_234":31,"_235":31,"_236":-5},"ENV",{"_188":189,"_190":191,"_192":92,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7