[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_179":180,"_181":182},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_136":-5,"_20":137,"_22":138,"_139":140,"_141":142,"_26":143,"_24":144,"_145":-5,"_146":-5,"_147":52,"_148":149,"_150":43,"_151":-5,"_152":-5,"_153":154},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","pallavipant","name","instorepromotions","branchName","main","version","path","oauth.ts","project",{"_33":82,"_13":14,"_44":83,"_84":-5,"_85":52,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":73,"_95":43,"_96":-5,"_97":-5,"_98":46,"_99":100,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":106,"_107":106,"_108":109,"_110":109,"_111":109,"_112":106,"_113":106,"_114":115,"_116":117,"_118":119,"_120":52},"tree",[55,56,57],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","0cb6ce5e-d8c9-4159-a093-2738a572365b","fileId","9046db8c-9a56-11f1-a250-1607ee4eb77e","parentId","branchId","56475fb0-9b8d-42e2-b750-5571b77b93ce","branchVersion",5,"latest",true,"createdAt",["D",1786983200324],0,"fileType","script","content","// Minimal auto-approving OAuth 2.0 authorization-server endpoints for MCP.\n// This is a DEMO with NO real security: any request is accepted, and the\n// access token is never validated by the actual MCP endpoint. The flow only\n// exists so Claude Connectors' OAuth handshake completes successfully.\n//\n// Endpoints:\n// GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n// POST /register (RFC 7591 DCR)\n// GET /authorize (RFC 6749, auto-approve)\n// POST /token (RFC 6749, issue token)\n// POST /revoke (RFC 7009, always ok)\n//\n// Authorization codes are stored in the val's blob store because Val Town is\n// serverless and /authorize + /token are separate HTTP invocations that may\n// land on different isolates — in-memory state is not safe across requests.\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst CODE_PREFIX = \"oauth:code:\";\nconst keyForCode = (code: string) => CODE_PREFIX + code;\nconst epochSec = () => Math.floor(Date.now() / 1000);\n\nfunction baseUrl(req: Request): string {\n return new URL(req.url).origin;\n}\n\nfunction oauthError(status: number, error: string, description?: string): Response {\n return Response.json(\n { error, error_description: description ?? \"\" },\n { status },\n );\n}\n\nasync function readBody(req: Request): Promise> {\n const text = await req.text();\n if (!text) return {};\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n return Object.fromEntries(new URLSearchParams(text));\n }\n if (ct.includes(\"application/json\")) {\n try {\n const j = JSON.parse(text);\n const out: Record = {};\n for (const [k, v] of Object.entries(j)) out[k] = String(v);\n return out;\n } catch {\n return Object.fromEntries(new URLSearchParams(text));\n }\n }\n return Object.fromEntries(new URLSearchParams(text));\n}\n\nasync function pkceS256(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return btoa(String.fromCharCode(...new Uint8Array(digest)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/g, \"\");\n}\n\n// RFC 8414: OAuth 2.0 Authorization Server Metadata\nexport function wellKnown(req: Request): Response {\n const b = baseUrl(req);\n return Response.json({\n issuer: b,\n authorization_endpoint: `${b}/authorize`,\n token_endpoint: `${b}/token`,\n registration_endpoint: `${b}/register`,\n revocation_endpoint: `${b}/revoke`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n revocation_endpoint_auth_methods_supported: [\"none\"],\n code_challenge_methods_supported: [\"S256\"],\n });\n}\n\n// RFC 7591: Dynamic Client Registration — accept anything, return a client_id.\nexport async function register(req: Request): Promise {\n let redirectUris: string[] = [];\n let clientName = \"\";\n let tokenAuthMethod = \"none\";\n let secret = \"\";\n const text = await req.text();\n if (text) {\n try {\n const b = JSON.parse(text);\n if (Array.isArray(b.redirect_uris)) {\n redirectUris = b.redirect_uris.filter((u: unknown) => typeof u === \"string\");\n }\n if (typeof b.client_name === \"string\") clientName = b.client_name;\n if (\n b.token_endpoint_auth_method === \"client_secret_basic\" ||\n b.token_endpoint_auth_method === \"client_secret_post\"\n ) {\n tokenAuthMethod = b.token_endpoint_auth_method;\n secret = \"cs_\" + crypto.randomUUID().replace(/-/g, \"\");\n }\n } catch {\n // not JSON — still auto-register below\n }\n }\n\n const body: Record = {\n client_id: crypto.randomUUID(),\n client_id_issued_at: epochSec(),\n redirect_uris: redirectUris,\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: tokenAuthMethod,\n client_name: clientName,\n };\n if (secret) {\n body.client_secret = secret;\n body.client_secret_expires_at = 0;\n }\n return Response.json(body, { status: 201 });\n}\n\n// RFC 6749 / authorization code flow — always approves, no login screen.\nexport async function authorize(req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = url.searchParams.get(\"redirect_uri\") ?? \"\";\n if (!redirectUri) {\n return oauthError(400, \"invalid_request\", \"missing redirect_uri\");\n }\n\n const state = url.searchParams.get(\"state\") ?? \"\";\n const codeChallenge = url.searchParams.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = url.searchParams.get(\"code_challenge_method\") ?? \"plain\";\n\n const code = crypto.randomUUID();\n await blob.setJSON(keyForCode(code), {\n client_id: url.searchParams.get(\"client_id\") ?? \"\",\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: codeChallengeMethod,\n created: Date.now(),\n });\n\n const location = new URL(redirectUri);\n location.searchParams.set(\"code\", code);\n if (state) location.searchParams.set(\"state\", state);\n // Response.redirect is broken on Val Town — build the 302 manually.\n return new Response(null, { status: 302, headers: { Location: location.toString() } });\n}\n\n// RFC 6749 token endpoint — validates the code (+PKCE) then issues a Bearer token.\nexport async function token(req: Request): Promise {\n const params = await readBody(req);\n if (params.grant_type !== \"authorization_code\" || !params.code) {\n return oauthError(400, \"unsupported_grant_type\", \"Expected grant_type=authorization_code\");\n }\n\n const key = keyForCode(params.code);\n const stored = await blob.getJSON<{\n client_id: string;\n redirect_uri: string;\n code_challenge: string;\n code_challenge_method: string;\n }>(key);\n if (!stored) return oauthError(400, \"invalid_grant\", \"unknown or expired code\");\n\n // Verify PKCE if the authorization request carried a code_challenge.\n if (stored.code_challenge) {\n const verifier = params.code_verifier;\n if (!verifier) return oauthError(400, \"invalid_grant\", \"code_verifier required\");\n const expected = stored.code_challenge_method === \"S256\"\n ? await pkceS256(verifier)\n : verifier;\n if (expected !== stored.code_challenge) {\n return oauthError(400, \"invalid_grant\", \"code_verifier mismatch\");\n }\n }\n\n await blob.delete(key); // one-time use\n\n return Response.json({\n access_token: \"vt_\" + crypto.randomUUID().replace(/-/g, \"\"),\n token_type: \"Bearer\",\n expires_in: 3600,\n scope: \"\",\n });\n}\n\n// RFC 7009 — nothing to revoke, just succeed.\nexport async function revoke(): Promise {\n return new Response(null, { status: 200 });\n}\n","deleted",false,"label",[19],{"_33":71,"_13":72,"_35":73,"_37":-5,"_38":39,"_40":74,"_42":43,"_44":75,"_17":76,"_47":77,"_49":78,"_51":52,"_53":79,"_65":80,"_18":81},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":68,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_65":69,"_18":70},{"_33":58,"_13":59,"_35":60,"_37":-5,"_38":39,"_40":61,"_42":43,"_44":62,"_17":63,"_47":48,"_49":64,"_51":52,"_53":-5,"_65":66,"_18":67},"c7c7ec89-ff35-4c71-87a5-bbb5901c352b","test-mcp.ts","3303bbee-9a55-11f1-a932-1607ee4eb77e",7,["D",1786983232020],1,"// One-off verification: full OAuth handshake (well-known → register →\n// authorize → token) then an MCP call to the real endpoint using the issued\n// token. Run with run_file.\nconst base = \"https://instore-promotions-mcp.val.run\";\nconst jsonHeaders = { \"Content-Type\": \"application/json\", Accept: \"application/json, text/event-stream\" };\n\nasync function show(label: string, res: Response, text: string) {\n console.log(`\\n== ${label} (${res.status}) ==`);\n console.log(text);\n}\n\n// 1) RFC 8414 metadata\nlet res = await fetch(`${base}/.well-known/oauth-authorization-server`);\nawait show(\"well-known metadata\", res, await res.text());\n\n// 2) RFC 7591 dynamic client registration\nres = await fetch(`${base}/register`, {\n method: \"POST\",\n headers: jsonHeaders,\n body: JSON.stringify({ redirect_uris: [\"http://127.0.0.1/callback\"], client_name: \"me\" }),\n});\nconst regText = await res.text();\nawait show(\"register\", res, regText);\nconst { client_id: clientId } = JSON.parse(regText);\n\n// 3) authorize -> auto-approve, redirects with code + state\nconst verifier = \"demo-verifier-abc123\";\nconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\nconst challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\nconst authUrl = new URL(`${base}/authorize`);\nauthUrl.searchParams.set(\"response_type\", \"code\");\nauthUrl.searchParams.set(\"client_id\", clientId);\nauthUrl.searchParams.set(\"redirect_uri\", \"http://127.0.0.1/callback\");\nauthUrl.searchParams.set(\"state\", \"test-state-123\");\nauthUrl.searchParams.set(\"code_challenge\", challenge);\nauthUrl.searchParams.set(\"code_challenge_method\", \"S256\");\nres = await fetch(authUrl, { redirect: \"manual\" });\nawait show(\"authorize (expect 302)\", res, res.headers.get(\"location\") ?? \"\");\nconst location = new URL(res.headers.get(\"location\") ?? \"\");\nconst code = location.searchParams.get(\"code\") ?? \"\";\nconst state = location.searchParams.get(\"state\") ?? \"\";\n\n// 4) token exchange\nres = await fetch(`${base}/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: \"http://127.0.0.1/callback\",\n client_id: clientId,\n code_verifier: verifier,\n }),\n});\nconst tokText = await res.text();\nawait show(\"token\", res, tokText);\nconst { access_token: accessToken } = JSON.parse(tokText);\n\n// 5) MCP call with the Bearer token (server should accept it regardless)\nasync function rpc(method: string, params: unknown = {}, id = 1) {\n const r = await fetch(`${base}/`, {\n method: \"POST\",\n headers: { ...jsonHeaders, Authorization: `Bearer ${accessToken}` },\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method, params }),\n });\n await show(`MCP ${method} (with token)`, r, await r.text());\n}\nawait rpc(\"initialize\", { protocolVersion: \"2025-06-18\", capabilities: {}, clientInfo: { name: \"verifier\", version: \"1.0\" } });\nawait rpc(\"tools/call\", { name: \"get_todays_promotions\", arguments: {} }, 3);\n\nconsole.log(`\\nstate echoed: ${state} (expected \"test-state-123\")`);\n","children",[],[59],["D",1786983200324],[],[19],"1f785d61-d6e3-4d23-be6d-86fe1a5746df","main.ts","e062e0ae-9a54-11f1-8c7b-1607ee4eb77e",6,["D",1786983208835],3,"http","// Remote MCP server — Streamable HTTP transport (stateless, JSON responses).\n// Exposes one tool: get_todays_promotions\n//\n// Also serves a minimal auto-approving OAuth 2.0 flow so Claude Connectors can\n// complete their OAuth handshake (the MCP endpoint itself accepts any request,\n// with or without a token — this is a demo with no real security).\n//\n// Import the SDK subpaths (TypeScript SDK v1.x, web-standard transport).\nimport { Server } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/index.js\";\nimport { WebStandardStreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/webStandardStreamableHttp.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"npm:@modelcontextprotocol/sdk@1.26.0/types.js\";\nimport {\n authorize,\n register,\n revoke,\n token,\n wellKnown,\n} from \"./oauth.ts\";\n\n// ---- Static data ----\nconst PROMOTIONS = [\n { item_name: \"Fall Harvest Pumpkin Spice Granola\", discount: \"Buy 1 Get 1 50% Off\", category: \"Snacks\", ends_date: \"2026-11-30\" },\n { item_name: \"Cozy Flannel Throw Blanket\", discount: \"25% Off\", category: \"Home & Seasonal\", ends_date: \"2026-12-31\" },\n { item_name: \"Wireless Noise-Cancelling Earbuds\", discount: \"$40 Off\", category: \"Electronics\", ends_date: \"2026-12-15\" },\n { item_name: \"Organic Cold-Pressed Orange Juice\", discount: \"2 for $6\", category: \"Beverages\", ends_date: \"2026-12-01\" },\n { item_name: \"Men's Thermal Base Layer Set\", discount: \"30% Off\", category: \"Apparel\", ends_date: \"2027-02-28\" },\n];\n\nconst TOOL_DEFINITION = {\n name: \"get_todays_promotions\",\n description:\n \"Returns today's in-store promotions. Each promotion has an item_name, discount, category, and ends_date. Takes no inputs.\",\n inputSchema: { type: \"object\", properties: {} },\n};\n\n// ---- MCP server ----\nfunction createServer(): Server {\n const server = new Server(\n { name: \"instore-promotions\", version: \"1.0.0\" },\n { capabilities: { tools: {} } },\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [TOOL_DEFINITION],\n }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === \"get_todays_promotions\") {\n return {\n content: [\n {\n type: \"text\" as const,\n text: JSON.stringify(PROMOTIONS, null, 2),\n },\n ],\n };\n }\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: `Unknown tool: ${request.params.name}` }],\n };\n });\n\n return server;\n}\n\n// ---- MCP HTTP handler ----\n// Stateless: a fresh server + transport per request. enableJsonResponse makes\n// the server answer plain JSON instead of opening SSE streams, which works\n// reliably on serverless runtimes like Val Town.\nasync function handleMcp(req: Request): Promise {\n const server = createServer();\n const transport = new WebStandardStreamableHTTPServerTransport({\n sessionIdGenerator: undefined, // stateless — no session tracking\n enableJsonResponse: true,\n });\n await server.connect(transport);\n // The transport ignores the Authorization header, so a Bearer token (valid\n // or not) is accepted — exactly what this demo wants.\n return transport.handleRequest(req);\n}\n\n// ---- Router ----\nexport default async function (req: Request): Promise {\n const { pathname } = new URL(req.url);\n\n switch (pathname) {\n case \"/.well-known/oauth-authorization-server\":\n return wellKnown(req);\n case \"/register\":\n return register(req);\n case \"/authorize\":\n return authorize(req);\n case \"/token\":\n return token(req);\n case \"/revoke\":\n return revoke();\n default:\n return handleMcp(req);\n }\n}\n","instore-promotions-mcp",[],[72],"33dc0890-383d-41be-9f41-da7c9c856ebf",["D",1786982475729],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Remote MCP server (Streamable HTTP): get_todays_promotions tool","imageUrl","userId","13a73f69-9bc1-4a3c-8d54-80a27491896b","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019fd215-485d-75ee-a30a-00353f9100df","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_135":130},"org",{"_11":12,"_129":130,"_131":130,"_92":93,"_132":133,"_134":52},"branch",{"_17":61,"_13":16,"_33":39,"_121":82,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":82,"_13":14,"_44":175,"_84":-5,"_85":52,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":73,"_95":43,"_96":-5,"_97":-5,"_98":46,"_99":100,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":106,"_107":106,"_108":109,"_110":109,"_111":109,"_112":106,"_113":106,"_114":176,"_116":177,"_118":178,"_120":52},[166,167,168],"files",[166,167,168],"counts",{"_157":46,"_158":63,"_159":46,"_32":160,"_161":162},[],{"_33":34,"_38":39,"_35":36,"_13":19,"_49":50,"_47":48,"_17":46,"_37":-5,"_44":155,"_40":41,"_53":-5,"_18":156},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1786983200324],[19],"pulls","branches","forks",{"_163":46,"_165":46},"connections",{"_163":46,"_164":46},"count","unfilledCount","emptyCount",{"_33":71,"_13":72,"_35":73,"_37":-5,"_38":39,"_40":74,"_42":43,"_44":75,"_17":76,"_47":77,"_49":78,"_51":52,"_53":79,"_65":173,"_18":174},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":68,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_65":171,"_18":172},{"_33":58,"_13":59,"_35":60,"_37":-5,"_38":39,"_40":61,"_42":43,"_44":62,"_17":63,"_47":48,"_49":64,"_51":52,"_53":-5,"_65":169,"_18":170},[],[59],[],[19],[],[72],["D",1786982475729],{"_11":12,"_135":130},{"_11":12,"_129":130,"_131":130,"_92":93,"_132":133,"_134":52},{"_17":61,"_13":16,"_33":39,"_121":82,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"ctx",{"_114":-5,"_152":212,"_213":214,"_215":216,"_217":52,"_218":52,"_219":52,"_220":43,"_221":-5,"_222":-7,"_223":-7,"_224":46,"_225":52,"_226":52,"_227":-5,"_228":52,"_229":52,"_230":52,"_231":-5},"ENV",{"_183":184,"_185":186,"_187":16,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]