[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_84":67,"_85":78,"_65":-7,"_86":-5,"_13":87,"_88":89,"_11":90,"_91":92,"_93":94,"_95":-5,"_96":-5,"_97":-5,"_98":26,"_99":100,"_101":38,"_102":-5,"_103":-5,"_104":105},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":59,"_60":61,"_62":63,"_64":26},"query","handle","pallavipant","id","33dc0890-383d-41be-9f41-da7c9c856ebf","name","instorepromotions","createdAt",["D",1786982475729],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Remote MCP server (Streamable HTTP): get_todays_promotions tool","imageUrl","userId","13a73f69-9bc1-4a3c-8d54-80a27491896b","pinnedFileId","e062e0ae-9a54-11f1-8c7b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019fd215-485d-75ee-a30a-00353f9100df","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_83":78},"org",{"_16":17,"_77":78,"_79":78,"_33":34,"_80":81,"_82":26},"branch",{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"isOwned","version",7,"main","56475fb0-9b8d-42e2-b750-5571b77b93ce","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","path","adoptOrgId",{"_18":19,"_20":21,"_22":165,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":50,"_52":53,"_54":53,"_55":53,"_56":50,"_57":50,"_58":166,"_60":167,"_62":168,"_64":26},"tree",[152,153,154],[152,153,154],"counts",{"_142":42,"_143":118,"_144":42,"_145":146,"_147":148},"contents",[106,107,108],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_18":133,"_20":134,"_111":36,"_113":-5,"_114":68,"_115":135,"_116":38,"_22":136,"_65":137,"_119":138,"_121":139,"_123":26,"_124":140,"_85":141},{"_18":126,"_20":127,"_111":128,"_113":-5,"_114":68,"_115":129,"_116":38,"_22":130,"_65":42,"_119":120,"_121":131,"_123":26,"_124":-5,"_85":132},{"_18":109,"_20":110,"_111":112,"_113":-5,"_114":68,"_115":66,"_116":38,"_22":117,"_65":118,"_119":120,"_121":122,"_123":26,"_124":-5,"_85":125},"c7c7ec89-ff35-4c71-87a5-bbb5901c352b","test-mcp.ts","fileId","3303bbee-9a55-11f1-a932-1607ee4eb77e","parentId","branchId","branchVersion","latest",["D",1786983232020],1,"fileType","script","content","// One-off verification: full OAuth handshake (well-known → register →\n// authorize → token) then an MCP call to the real endpoint using the issued\n// token. Run with run_file.\nconst base = \"https://instore-promotions-mcp.val.run\";\nconst jsonHeaders = { \"Content-Type\": \"application/json\", Accept: \"application/json, text/event-stream\" };\n\nasync function show(label: string, res: Response, text: string) {\n console.log(`\\n== ${label} (${res.status}) ==`);\n console.log(text);\n}\n\n// 1) RFC 8414 metadata\nlet res = await fetch(`${base}/.well-known/oauth-authorization-server`);\nawait show(\"well-known metadata\", res, await res.text());\n\n// 2) RFC 7591 dynamic client registration\nres = await fetch(`${base}/register`, {\n method: \"POST\",\n headers: jsonHeaders,\n body: JSON.stringify({ redirect_uris: [\"http://127.0.0.1/callback\"], client_name: \"me\" }),\n});\nconst regText = await res.text();\nawait show(\"register\", res, regText);\nconst { client_id: clientId } = JSON.parse(regText);\n\n// 3) authorize -> auto-approve, redirects with code + state\nconst verifier = \"demo-verifier-abc123\";\nconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\nconst challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\nconst authUrl = new URL(`${base}/authorize`);\nauthUrl.searchParams.set(\"response_type\", \"code\");\nauthUrl.searchParams.set(\"client_id\", clientId);\nauthUrl.searchParams.set(\"redirect_uri\", \"http://127.0.0.1/callback\");\nauthUrl.searchParams.set(\"state\", \"test-state-123\");\nauthUrl.searchParams.set(\"code_challenge\", challenge);\nauthUrl.searchParams.set(\"code_challenge_method\", \"S256\");\nres = await fetch(authUrl, { redirect: \"manual\" });\nawait show(\"authorize (expect 302)\", res, res.headers.get(\"location\") ?? \"\");\nconst location = new URL(res.headers.get(\"location\") ?? \"\");\nconst code = location.searchParams.get(\"code\") ?? \"\";\nconst state = location.searchParams.get(\"state\") ?? \"\";\n\n// 4) token exchange\nres = await fetch(`${base}/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: \"http://127.0.0.1/callback\",\n client_id: clientId,\n code_verifier: verifier,\n }),\n});\nconst tokText = await res.text();\nawait show(\"token\", res, tokText);\nconst { access_token: accessToken } = JSON.parse(tokText);\n\n// 5) MCP call with the Bearer token (server should accept it regardless)\nasync function rpc(method: string, params: unknown = {}, id = 1) {\n const r = await fetch(`${base}/`, {\n method: \"POST\",\n headers: { ...jsonHeaders, Authorization: `Bearer ${accessToken}` },\n body: JSON.stringify({ jsonrpc: \"2.0\", id, method, params }),\n });\n await show(`MCP ${method} (with token)`, r, await r.text());\n}\nawait rpc(\"initialize\", { protocolVersion: \"2025-06-18\", capabilities: {}, clientInfo: { name: \"verifier\", version: \"1.0\" } });\nawait rpc(\"tools/call\", { name: \"get_todays_promotions\", arguments: {} }, 3);\n\nconsole.log(`\\nstate echoed: ${state} (expected \"test-state-123\")`);\n","deleted","label",[110],"0cb6ce5e-d8c9-4159-a093-2738a572365b","oauth.ts","9046db8c-9a56-11f1-a250-1607ee4eb77e",5,["D",1786983200324],"// Minimal auto-approving OAuth 2.0 authorization-server endpoints for MCP.\n// This is a DEMO with NO real security: any request is accepted, and the\n// access token is never validated by the actual MCP endpoint. The flow only\n// exists so Claude Connectors' OAuth handshake completes successfully.\n//\n// Endpoints:\n// GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n// POST /register (RFC 7591 DCR)\n// GET /authorize (RFC 6749, auto-approve)\n// POST /token (RFC 6749, issue token)\n// POST /revoke (RFC 7009, always ok)\n//\n// Authorization codes are stored in the val's blob store because Val Town is\n// serverless and /authorize + /token are separate HTTP invocations that may\n// land on different isolates — in-memory state is not safe across requests.\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst CODE_PREFIX = \"oauth:code:\";\nconst keyForCode = (code: string) => CODE_PREFIX + code;\nconst epochSec = () => Math.floor(Date.now() / 1000);\n\nfunction baseUrl(req: Request): string {\n return new URL(req.url).origin;\n}\n\nfunction oauthError(status: number, error: string, description?: string): Response {\n return Response.json(\n { error, error_description: description ?? \"\" },\n { status },\n );\n}\n\nasync function readBody(req: Request): Promise> {\n const text = await req.text();\n if (!text) return {};\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n return Object.fromEntries(new URLSearchParams(text));\n }\n if (ct.includes(\"application/json\")) {\n try {\n const j = JSON.parse(text);\n const out: Record = {};\n for (const [k, v] of Object.entries(j)) out[k] = String(v);\n return out;\n } catch {\n return Object.fromEntries(new URLSearchParams(text));\n }\n }\n return Object.fromEntries(new URLSearchParams(text));\n}\n\nasync function pkceS256(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return btoa(String.fromCharCode(...new Uint8Array(digest)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/g, \"\");\n}\n\n// RFC 8414: OAuth 2.0 Authorization Server Metadata\nexport function wellKnown(req: Request): Response {\n const b = baseUrl(req);\n return Response.json({\n issuer: b,\n authorization_endpoint: `${b}/authorize`,\n token_endpoint: `${b}/token`,\n registration_endpoint: `${b}/register`,\n revocation_endpoint: `${b}/revoke`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n revocation_endpoint_auth_methods_supported: [\"none\"],\n code_challenge_methods_supported: [\"S256\"],\n });\n}\n\n// RFC 7591: Dynamic Client Registration — accept anything, return a client_id.\nexport async function register(req: Request): Promise {\n let redirectUris: string[] = [];\n let clientName = \"\";\n let tokenAuthMethod = \"none\";\n let secret = \"\";\n const text = await req.text();\n if (text) {\n try {\n const b = JSON.parse(text);\n if (Array.isArray(b.redirect_uris)) {\n redirectUris = b.redirect_uris.filter((u: unknown) => typeof u === \"string\");\n }\n if (typeof b.client_name === \"string\") clientName = b.client_name;\n if (\n b.token_endpoint_auth_method === \"client_secret_basic\" ||\n b.token_endpoint_auth_method === \"client_secret_post\"\n ) {\n tokenAuthMethod = b.token_endpoint_auth_method;\n secret = \"cs_\" + crypto.randomUUID().replace(/-/g, \"\");\n }\n } catch {\n // not JSON — still auto-register below\n }\n }\n\n const body: Record = {\n client_id: crypto.randomUUID(),\n client_id_issued_at: epochSec(),\n redirect_uris: redirectUris,\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: tokenAuthMethod,\n client_name: clientName,\n };\n if (secret) {\n body.client_secret = secret;\n body.client_secret_expires_at = 0;\n }\n return Response.json(body, { status: 201 });\n}\n\n// RFC 6749 / authorization code flow — always approves, no login screen.\nexport async function authorize(req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = url.searchParams.get(\"redirect_uri\") ?? \"\";\n if (!redirectUri) {\n return oauthError(400, \"invalid_request\", \"missing redirect_uri\");\n }\n\n const state = url.searchParams.get(\"state\") ?? \"\";\n const codeChallenge = url.searchParams.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = url.searchParams.get(\"code_challenge_method\") ?? \"plain\";\n\n const code = crypto.randomUUID();\n await blob.setJSON(keyForCode(code), {\n client_id: url.searchParams.get(\"client_id\") ?? \"\",\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: codeChallengeMethod,\n created: Date.now(),\n });\n\n const location = new URL(redirectUri);\n location.searchParams.set(\"code\", code);\n if (state) location.searchParams.set(\"state\", state);\n // Response.redirect is broken on Val Town — build the 302 manually.\n return new Response(null, { status: 302, headers: { Location: location.toString() } });\n}\n\n// RFC 6749 token endpoint — validates the code (+PKCE) then issues a Bearer token.\nexport async function token(req: Request): Promise {\n const params = await readBody(req);\n if (params.grant_type !== \"authorization_code\" || !params.code) {\n return oauthError(400, \"unsupported_grant_type\", \"Expected grant_type=authorization_code\");\n }\n\n const key = keyForCode(params.code);\n const stored = await blob.getJSON<{\n client_id: string;\n redirect_uri: string;\n code_challenge: string;\n code_challenge_method: string;\n }>(key);\n if (!stored) return oauthError(400, \"invalid_grant\", \"unknown or expired code\");\n\n // Verify PKCE if the authorization request carried a code_challenge.\n if (stored.code_challenge) {\n const verifier = params.code_verifier;\n if (!verifier) return oauthError(400, \"invalid_grant\", \"code_verifier required\");\n const expected = stored.code_challenge_method === \"S256\"\n ? await pkceS256(verifier)\n : verifier;\n if (expected !== stored.code_challenge) {\n return oauthError(400, \"invalid_grant\", \"code_verifier mismatch\");\n }\n }\n\n await blob.delete(key); // one-time use\n\n return Response.json({\n access_token: \"vt_\" + crypto.randomUUID().replace(/-/g, \"\"),\n token_type: \"Bearer\",\n expires_in: 3600,\n scope: \"\",\n });\n}\n\n// RFC 7009 — nothing to revoke, just succeed.\nexport async function revoke(): Promise {\n return new Response(null, { status: 200 });\n}\n",[127],"1f785d61-d6e3-4d23-be6d-86fe1a5746df","main.ts",6,["D",1786983208835],3,"http","// Remote MCP server — Streamable HTTP transport (stateless, JSON responses).\n// Exposes one tool: get_todays_promotions\n//\n// Also serves a minimal auto-approving OAuth 2.0 flow so Claude Connectors can\n// complete their OAuth handshake (the MCP endpoint itself accepts any request,\n// with or without a token — this is a demo with no real security).\n//\n// Import the SDK subpaths (TypeScript SDK v1.x, web-standard transport).\nimport { Server } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/index.js\";\nimport { WebStandardStreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk@1.26.0/server/webStandardStreamableHttp.js\";\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n} from \"npm:@modelcontextprotocol/sdk@1.26.0/types.js\";\nimport {\n authorize,\n register,\n revoke,\n token,\n wellKnown,\n} from \"./oauth.ts\";\n\n// ---- Static data ----\nconst PROMOTIONS = [\n { item_name: \"Fall Harvest Pumpkin Spice Granola\", discount: \"Buy 1 Get 1 50% Off\", category: \"Snacks\", ends_date: \"2026-11-30\" },\n { item_name: \"Cozy Flannel Throw Blanket\", discount: \"25% Off\", category: \"Home & Seasonal\", ends_date: \"2026-12-31\" },\n { item_name: \"Wireless Noise-Cancelling Earbuds\", discount: \"$40 Off\", category: \"Electronics\", ends_date: \"2026-12-15\" },\n { item_name: \"Organic Cold-Pressed Orange Juice\", discount: \"2 for $6\", category: \"Beverages\", ends_date: \"2026-12-01\" },\n { item_name: \"Men's Thermal Base Layer Set\", discount: \"30% Off\", category: \"Apparel\", ends_date: \"2027-02-28\" },\n];\n\nconst TOOL_DEFINITION = {\n name: \"get_todays_promotions\",\n description:\n \"Returns today's in-store promotions. Each promotion has an item_name, discount, category, and ends_date. Takes no inputs.\",\n inputSchema: { type: \"object\", properties: {} },\n};\n\n// ---- MCP server ----\nfunction createServer(): Server {\n const server = new Server(\n { name: \"instore-promotions\", version: \"1.0.0\" },\n { capabilities: { tools: {} } },\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [TOOL_DEFINITION],\n }));\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === \"get_todays_promotions\") {\n return {\n content: [\n {\n type: \"text\" as const,\n text: JSON.stringify(PROMOTIONS, null, 2),\n },\n ],\n };\n }\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: `Unknown tool: ${request.params.name}` }],\n };\n });\n\n return server;\n}\n\n// ---- MCP HTTP handler ----\n// Stateless: a fresh server + transport per request. enableJsonResponse makes\n// the server answer plain JSON instead of opening SSE streams, which works\n// reliably on serverless runtimes like Val Town.\nasync function handleMcp(req: Request): Promise {\n const server = createServer();\n const transport = new WebStandardStreamableHTTPServerTransport({\n sessionIdGenerator: undefined, // stateless — no session tracking\n enableJsonResponse: true,\n });\n await server.connect(transport);\n // The transport ignores the Authorization header, so a Bearer token (valid\n // or not) is accepted — exactly what this demo wants.\n return transport.handleRequest(req);\n}\n\n// ---- Router ----\nexport default async function (req: Request): Promise {\n const { pathname } = new URL(req.url);\n\n switch (pathname) {\n case \"/.well-known/oauth-authorization-server\":\n return wellKnown(req);\n case \"/register\":\n return register(req);\n case \"/authorize\":\n return authorize(req);\n case \"/token\":\n return token(req);\n case \"/revoke\":\n return revoke();\n default:\n return handleMcp(req);\n }\n}\n","instore-promotions-mcp",[134],"pulls","branches","forks","envVars",{"_149":42,"_151":42},"connections",{"_149":42,"_150":42},"count","unfilledCount","emptyCount",{"_18":133,"_20":134,"_111":36,"_113":-5,"_114":68,"_115":135,"_116":38,"_22":162,"_65":137,"_119":138,"_121":139,"_123":26,"_124":140,"_156":163,"_85":164},{"_18":126,"_20":127,"_111":128,"_113":-5,"_114":68,"_115":129,"_116":38,"_22":159,"_65":42,"_119":120,"_121":131,"_123":26,"_124":-5,"_156":160,"_85":161},{"_18":109,"_20":110,"_111":112,"_113":-5,"_114":68,"_115":66,"_116":38,"_22":155,"_65":118,"_119":120,"_121":122,"_123":26,"_124":-5,"_156":157,"_85":158},["D",1786983232020],"children",[],[110],["D",1786983200324],[],[127],["D",1786983208835],[],[134],["D",1786982475729],{"_16":17,"_83":78},{"_16":17,"_77":78,"_79":78,"_33":34,"_80":81,"_82":26},{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"ctx",{"_58":-5,"_103":202,"_203":204,"_205":206,"_207":26,"_208":26,"_209":26,"_210":38,"_211":-5,"_212":-7,"_213":-7,"_214":42,"_215":26,"_216":26,"_217":-5,"_218":26,"_219":26,"_220":26,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":67,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]