Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n## MCP Auth Workbench\n\nThis project is a browser-based MCP client for prototyping OAuth/authz flows. It connects to MCP servers with authentication and provides a debug view of all HTTP traffic.\n\n### Current State\n- Connects to MCP servers via OAuth (authorization code + PKCE)\n- Supports CIMD (Client ID Metadata Documents) for skipping DCR\n- Lists tools after connecting\n- Request inspector shows all HTTP request/response pairs with expandable details\n- JWT auto-detection and inline decode for tokens in headers/bodies\n- VS Code dark theme UI with sidebar controls + request log panel\n\n### Architecture\n- **`backend/index.http.tsx`** — Hono server serving inline HTML, OAuth `/callback` (posts auth code back via `postMessage`), and `/client-metadata.json` (CIMD endpoint)\n- **`frontend/app.ts`** — Browser-side TypeScript loaded via esm.town. Contains `BrowserOAuthProvider`, request inspector middleware, and JWT decode utilities. Imports MCP SDK from esm.sh.\n\n### SDK Import Pattern\nUses `@modelcontextprotocol/sdk@1.25.3` via esm.sh with pinned zod to avoid a zod v4 ESM bundling issue:\n```ts\nimport { Client } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client?deps=zod@3.25.76\";\nimport { StreamableHTTPClientTransport } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/streamableHttp?deps=zod@3.25.76\";\nimport { auth, UnauthorizedError } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/auth?deps=zod@3.25.76\";\nimport { applyMiddlewares } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/middleware?deps=zod@3.25.76\";\n```\nThe `?deps=zod@3.25.76` is required because esm.sh resolves zod `^3.25 || ^4.0` to zod 4.x, which has broken ESM named exports for `zod/v4` (the `/v4` subpath uses CJS interop that doesn't produce proper named exports when bundled by esm.sh, causing `TypeError: e.custom is not a function`). Pinning to zod 3.25.x avoids this.\n\n### Middleware Chain\nThe frontend composes three fetch middlewares via `applyMiddlewares()`:\n1. **`withRequestInspector()`** — Captures all HTTP req/res, renders expandable log entries, scans for JWTs\n2. **`withClientMetadataDiscovery()`** — Intercepts OAuth metadata response, detects CIMD support, sets client_id to metadata URL\n3. **`withOAuth()`** — Handles 401 responses by running the SDK `auth()` flow and retrying\n\n### OAuth Flow\nPopup-based: `redirectToAuthorization()` opens a popup window, the popup redirects to `/callback` which posts the auth code back via `window.postMessage`, then the frontend exchanges the code for tokens and reconnects.\n\n### Preconfigured Servers (dropdown)\n- xaa.dev MCP Server (`https://mcp.xaa.dev`)\n- CIMD Open Example (`https://mcp-cimd-demo-rs.val.run/mcp`)\n- CIMD Pre-register Example (`https://mcp-cimd-demo-rs2.val.run/mcp`)\n- DCR Example (`https://mcp-oauth-ex2.val.run/mcp`)\n- Stytch Live Demo (`https://stytch-as-demo.val.run/mcp`)\n- Local RS (`http://localhost:3000/mcp`)\n- Custom URL\n\n### Related Projects\n- **`~/code/cimd-demo`** — Original CIMD demo this was forked from (SDK 1.18.2)\n- **`~/code/mcp/oauth-debugger`** — Server-side OAuth metadata debugger (Hono + Deno, no browser client)\n- **`~/code/mcp/typescript-sdk`** — The MCP TypeScript SDK source\n\n### Deployment & Verification\n**You are responsible for deploying and verifying.** After implementing changes, YOU MUST run `vt push` yourself to deploy. Do not ask the user to push, do not just suggest pushing — run it. After pushing, verify the deployment by opening the live URL in the browser using the claude-in-chrome skill and confirming the UI renders correctly. Do not consider a task complete until you have pushed and visually verified.\n\n### XAA Auth Flow (Split Login + Connect)\nThe xaa.dev flow is split into two user actions:\n1. **Login** — User clicks \"Login with IdP\" → popup to `idp.xaa.dev` → authenticates → id_token stored in sessionStorage (`xaa_id_token`)\n2. **Connect** — User selects \"⏩ xaa.dev MCP Server\" → clicks Connect → token exchange + jwt-bearer happen inline (no redirect) → connected\n\nKey functions:\n- `startIdpLogin()` — PKCE + popup to IdP, listens for postMessage, exchanges code → id_token\n- `completeIdpLogin()` — code → id_token exchange (also used in redirect fallback)\n- `getXaaAccessToken()` — id_token → token exchange → jwt-bearer → access_token\n- `withXaaAuth()` — middleware that reads id_token from sessionStorage, gets access_token inline, handles 401 retry\n- `updateLoginUI()` — renders login button or logged-in state (email + JWT decode badge + logout)\n\nSessionStorage keys: `xaa_id_token`, `xaa_access_token`, `idp_login_flow`, `idp_code_verifier`\n\n### Future Goals\n- Enhanced request inspectability (inspired by xaa.dev/requesting-app debug view)\n",[],[71],["D",1769538835602],[],[19],"86290718-fbac-11f0-930f-42dde27851f2",".npmrc","862907cc-fbac-11f0-930f-42dde27851f2",1,["D",1769537885217],"registry=https://registry.npmjs.org\n",[],[83],"bbf2d30e-fbae-11f0-917b-42dde27851f2","frontend","bbf2d3cc-fbae-11f0-917b-42dde27851f2",2,["D",1769538834451],"directory",[98],[91],{"_33":99,"_13":100,"_35":101,"_37":92,"_38":39,"_40":102,"_42":43,"_44":103,"_17":104,"_47":105,"_48":106,"_50":51,"_52":-5,"_67":107,"_18":108},"11fb90ec-fc40-11f0-9f1b-42dde27851f2","app.ts","bc70a126-fbae-11f0-a4b3-42dde27851f2",61,["D",1769601255818],27,"script","import { Client } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client?deps=zod@3.25.76\";\nimport { StreamableHTTPClientTransport } from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/streamableHttp?deps=zod@3.25.76\";\nimport {\n UnauthorizedError,\n type OAuthClientProvider,\n auth,\n extractResourceMetadataUrl,\n} from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/auth?deps=zod@3.25.76\";\nimport {\n applyMiddlewares,\n type Middleware,\n} from \"https://esm.sh/@modelcontextprotocol/sdk@1.25.3/client/middleware?deps=zod@3.25.76\";\n\n// --- JWT Utilities ---\n\nfunction isJWT(str: string): boolean {\n if (typeof str !== \"string\" || str.length < 20) return false;\n return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(str.trim());\n}\n\nfunction decodeJWT(\n token: string\n): { header: object; payload: object } | null {\n const parts = token.trim().split(\".\");\n if (parts.length !== 3) return null;\n try {\n const b64decode = (s: string) =>\n JSON.parse(\n atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (s.length % 4)) % 4))\n );\n const header = b64decode(parts[0]);\n const payload = b64decode(parts[1]);\n return { header, payload };\n } catch {\n return null;\n }\n}\n\n// --- XAA Constants ---\n\nconst XAA_CLIENT_ID = \"client_5d30b45153c55446\";\nconst XAA_CLIENT_SECRET = \"secret_bzfpaPOZYrfwcg_DZT7dxzs7vZM5XDZC\";\n\n// --- PKCE Helpers ---\n\nfunction generateCodeVerifier(): string {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function generateCodeChallenge(verifier: string): Promise {\n const encoder = new TextEncoder();\n const data = encoder.encode(verifier);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n const base64 = btoa(String.fromCharCode(...new Uint8Array(digest)));\n return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// --- Origin Classification ---\n\ntype OriginRole = \"idp\" | \"as\" | \"mcp\";\n\nfunction classifyOrigin(hostname: string, pathname?: string): OriginRole {\n if (hostname === \"idp.xaa.dev\") return \"idp\";\n if (hostname === \"auth.resource.xaa.dev\") return \"as\";\n // Path-based: authorization server metadata, authorize, and token endpoints\n if (pathname) {\n if (pathname.includes(\"/.well-known/oauth-authorization-server\")) return \"as\";\n if (pathname === \"/authorize\" || pathname === \"/token\") return \"as\";\n }\n return \"mcp\";\n}\n\n// --- Types ---\n\ninterface LogData {\n message: string;\n type?: string;\n originRole?: OriginRole;\n requestBody?: any;\n responseBody?: any;\n requestHeaders?: Record;\n responseHeaders?: Record;\n}\n\ninterface ClientMetadata {\n client_name: string;\n redirect_uris: string[];\n grant_types: string[];\n response_types: string[];\n token_endpoint_auth_method: string;\n scope?: string;\n}\n\ninterface ClientInformation {\n client_id: string;\n client_secret?: string;\n}\n\ninterface Tokens {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n}\n\n// --- OAuth Provider ---\n\nclass BrowserOAuthProvider implements OAuthClientProvider {\n private _redirectUrl: string;\n private _clientMetadata: ClientMetadata;\n private _clientMetadataUrl: string | undefined;\n private _clientInformation: ClientInformation | null = null;\n private _tokens: Tokens | null = null;\n private _codeVerifier: string | null = null;\n private _authCode: string | null = null;\n\n constructor(redirectUrl: string, clientMetadata: ClientMetadata, clientMetadataUrl?: string) {\n this._redirectUrl = redirectUrl;\n this._clientMetadata = clientMetadata;\n this._clientMetadataUrl = clientMetadataUrl;\n\n // Restore persisted state from sessionStorage (survives redirects)\n const savedVerifier = sessionStorage.getItem(\"mcp_code_verifier\");\n if (savedVerifier) this._codeVerifier = savedVerifier;\n const savedClientInfo = sessionStorage.getItem(\"mcp_client_info\");\n if (savedClientInfo) {\n try { this._clientInformation = JSON.parse(savedClientInfo); } catch {}\n }\n const savedAuthCode = sessionStorage.getItem(\"mcp_auth_code\");\n if (savedAuthCode) {\n this._authCode = savedAuthCode;\n sessionStorage.removeItem(\"mcp_auth_code\");\n }\n }\n\n get redirectUrl(): string {\n return this._redirectUrl;\n }\n get clientMetadata(): ClientMetadata {\n return this._clientMetadata;\n }\n get clientMetadataUrl(): string | undefined {\n return this._clientMetadataUrl;\n }\n\n clientInformation(): ClientInformation | null {\n return this._clientInformation;\n }\n saveClientInformation(info: ClientInformation): void {\n this._clientInformation = info;\n sessionStorage.setItem(\"mcp_client_info\", JSON.stringify(info));\n }\n\n tokens(): Tokens | null {\n return this._tokens;\n }\n saveTokens(tokens: Tokens): void {\n this._tokens = tokens;\n log(\"Tokens saved successfully\", \"auth\");\n // Clean up redirect-flow state from sessionStorage\n sessionStorage.removeItem(\"mcp_code_verifier\");\n sessionStorage.removeItem(\"mcp_client_info\");\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n // If we already have an auth code (from redirect flow), skip the redirect\n if (this._authCode) {\n log(\"Using authorization code from redirect\", \"auth\");\n return;\n }\n\n log({\n message: `GET ${authorizationUrl.hostname} ${authorizationUrl.pathname} → opening login window`,\n type: \"http\",\n originRole: classifyOrigin(authorizationUrl.hostname, authorizationUrl.pathname),\n responseBody: { authorization_url: authorizationUrl.toString() },\n });\n\n const usePopup = (document.getElementById(\"usePopup\") as HTMLInputElement)?.checked ?? true;\n\n return new Promise((resolve, reject) => {\n const authWindow = usePopup\n ? window.open(authorizationUrl.toString(), \"_blank\", \"width=600,height=700\")\n : null;\n\n if (!authWindow) {\n log(\"Popup blocked — redirecting in current tab...\", \"auth\");\n // Navigate this tab to the auth URL; the callback will redirect back with ?code=\n window.location.href = authorizationUrl.toString();\n return;\n }\n\n const messageHandler = (event: MessageEvent) => {\n if (event.origin !== window.location.origin) return;\n if (event.data.type === \"oauth_callback\") {\n log(\"Received authorization code\", \"auth\");\n this._authCode = event.data.code;\n window.removeEventListener(\"message\", messageHandler);\n resolve();\n }\n };\n\n window.addEventListener(\"message\", messageHandler);\n setTimeout(() => {\n window.removeEventListener(\"message\", messageHandler);\n reject(new Error(\"Authorization timeout\"));\n }, 300000);\n });\n }\n\n async getAuthCode(): Promise {\n if (this._authCode) return this._authCode;\n throw new Error(\"No authorization code\");\n }\n\n saveCodeVerifier(codeVerifier: string): void {\n this._codeVerifier = codeVerifier;\n sessionStorage.setItem(\"mcp_code_verifier\", codeVerifier);\n }\n codeVerifier(): string {\n if (!this._codeVerifier) throw new Error(\"No code verifier saved\");\n return this._codeVerifier;\n }\n}\n\n// --- Log Rendering ---\n\nfunction log(messageOrData: string | LogData, type: string = \"info\"): void {\n let logData: LogData;\n if (typeof messageOrData === \"string\") {\n logData = { message: messageOrData, type };\n } else {\n logData = { type, ...messageOrData };\n }\n\n console.log(`[${logData.type!.toUpperCase()}] ${logData.message}`);\n const logDiv = document.getElementById(\"log\");\n if (!logDiv) return;\n\n const entry = document.createElement(\"div\");\n entry.className = \"log-entry \" + logData.type;\n\n const header = document.createElement(\"div\");\n header.className = \"log-entry-header\";\n\n const hasDetails = !!(\n logData.requestBody ||\n logData.responseBody ||\n logData.requestHeaders ||\n logData.responseHeaders\n );\n\n const expandArrow = document.createElement(\"div\");\n expandArrow.className = \"expand-arrow\";\n expandArrow.textContent = hasDetails ? \"\\u25b6\" : \"\";\n\n const time = document.createElement(\"span\");\n time.className = \"time\";\n time.textContent = new Date().toLocaleTimeString();\n\n // Type prefix for non-http log types\n const typePrefix = document.createElement(\"span\");\n typePrefix.className = \"type-prefix\";\n const prefixMap: Record = { info: \"INFO:\", auth: \"AUTH:\", success: \"SUCCESS:\", error: \"ERROR:\" };\n typePrefix.textContent = prefixMap[logData.type!] || \"\";\n\n // Origin badge for HTTP log lines\n let originBadge: HTMLSpanElement | null = null;\n if (logData.originRole) {\n originBadge = document.createElement(\"span\");\n originBadge.className = `origin-badge ${logData.originRole}`;\n originBadge.textContent = logData.originRole.toUpperCase();\n }\n\n const msg = document.createElement(\"span\");\n msg.className = \"message\";\n msg.textContent = logData.message;\n\n header.appendChild(expandArrow);\n header.appendChild(time);\n header.appendChild(typePrefix);\n if (originBadge) header.appendChild(originBadge);\n header.appendChild(msg);\n entry.appendChild(header);\n\n if (hasDetails) {\n const detailsContainer = document.createElement(\"div\");\n detailsContainer.className = \"log-details\";\n\n const detailsContent = document.createElement(\"div\");\n detailsContent.className = \"details-content\";\n\n if (logData.requestHeaders) {\n appendSection(detailsContent, \"Request Headers\", logData.requestHeaders, true);\n appendJWTDecodes(detailsContent, logData.requestHeaders, true);\n }\n if (logData.requestBody) {\n appendSection(detailsContent, \"Request Body\", logData.requestBody, true);\n appendJWTDecodes(detailsContent, logData.requestBody, false);\n }\n if (logData.responseHeaders) {\n appendSection(detailsContent, \"Response Headers\", logData.responseHeaders, true);\n }\n if (logData.responseBody) {\n appendSection(detailsContent, \"Response Body\", logData.responseBody, true);\n appendJWTDecodes(detailsContent, logData.responseBody, false);\n }\n\n detailsContainer.appendChild(detailsContent);\n entry.appendChild(detailsContainer);\n\n header.onclick = (e) => {\n detailsContainer.classList.toggle(\"expanded\");\n expandArrow.classList.toggle(\"expanded\");\n e.stopPropagation();\n };\n }\n\n // Right-click or double-click to highlight\n header.oncontextmenu = (e) => {\n e.preventDefault();\n entry.classList.toggle(\"highlighted\");\n };\n header.ondblclick = () => {\n entry.classList.toggle(\"highlighted\");\n };\n\n logDiv.appendChild(entry);\n logDiv.scrollTop = logDiv.scrollHeight;\n}\n\nfunction appendSection(\n container: HTMLElement,\n label: string,\n data: any,\n collapsed: boolean = false\n): void {\n const div = document.createElement(\"div\");\n div.style.marginBottom = \"8px\";\n\n const strong = document.createElement(\"strong\");\n strong.style.cursor = collapsed ? \"pointer\" : \"default\";\n strong.textContent = collapsed ? `▶ ${label}:` : `${label}:`;\n div.appendChild(strong);\n\n const content = document.createElement(\"div\");\n if (collapsed) {\n content.style.display = \"none\";\n }\n\n const formatted =\n typeof data === \"string\" ? data : JSON.stringify(data, null, 2);\n\n const pre = document.createElement(\"pre\");\n pre.textContent = formatted;\n content.appendChild(pre);\n\n if (collapsed) {\n strong.onclick = (e) => {\n e.stopPropagation();\n const visible = content.style.display !== \"none\";\n content.style.display = visible ? \"none\" : \"block\";\n strong.textContent = visible ? `▶ ${label}:` : `▼ ${label}:`;\n };\n }\n\n div.appendChild(content);\n container.appendChild(div);\n}\n\nfunction appendJWTDecodes(\n container: HTMLElement,\n data: any,\n isHeaders: boolean\n): void {\n if (typeof data !== \"object\" || data === null) return;\n\n // Check for Bearer token in Authorization header\n if (isHeaders) {\n const authHeader = data[\"authorization\"] || data[\"Authorization\"];\n if (typeof authHeader === \"string\" && authHeader.startsWith(\"Bearer \")) {\n const token = authHeader.slice(7);\n if (isJWT(token)) {\n appendCollapsibleJWTDecode(container, \"Bearer Token\", token);\n }\n }\n return;\n }\n\n // Scan body values for JWTs\n for (const [key, value] of Object.entries(data)) {\n if (typeof value === \"string\" && isJWT(value)) {\n appendCollapsibleJWTDecode(container, key, value);\n }\n }\n}\n\nfunction appendCollapsibleJWTDecode(\n container: HTMLElement,\n fieldName: string,\n token: string\n): void {\n const decoded = decodeJWT(token);\n if (!decoded) return;\n\n const div = document.createElement(\"div\");\n div.style.marginBottom = \"8px\";\n\n const label = document.createElement(\"strong\");\n label.style.cursor = \"pointer\";\n label.style.color = \"#dcdcaa\";\n label.textContent = `▶ \\uD83D\\uDD11 Decoded ${fieldName}:`;\n div.appendChild(label);\n\n const content = document.createElement(\"div\");\n content.style.display = \"none\";\n\n const wrapper = document.createElement(\"div\");\n wrapper.className = \"jwt-decoded visible\";\n\n // Header section\n const headerSection = document.createElement(\"div\");\n const headerTitle = document.createElement(\"div\");\n headerTitle.className = \"jwt-section-header\";\n headerTitle.textContent = \"Header\";\n const headerBody = document.createElement(\"div\");\n headerBody.className = \"jwt-section-body\";\n const headerPre = document.createElement(\"pre\");\n headerPre.textContent = JSON.stringify(decoded.header, null, 2);\n headerBody.appendChild(headerPre);\n headerSection.appendChild(headerTitle);\n headerSection.appendChild(headerBody);\n wrapper.appendChild(headerSection);\n\n // Payload section\n const payloadSection = document.createElement(\"div\");\n const payloadTitle = document.createElement(\"div\");\n payloadTitle.className = \"jwt-section-header\";\n payloadTitle.textContent = \"Payload\";\n const payloadBody = document.createElement(\"div\");\n payloadBody.className = \"jwt-section-body\";\n const payloadPre = document.createElement(\"pre\");\n payloadPre.textContent = JSON.stringify(decoded.payload, null, 2);\n payloadBody.appendChild(payloadPre);\n payloadSection.appendChild(payloadTitle);\n payloadSection.appendChild(payloadBody);\n wrapper.appendChild(payloadSection);\n\n content.appendChild(wrapper);\n\n label.onclick = (e) => {\n e.stopPropagation();\n const visible = content.style.display !== \"none\";\n content.style.display = visible ? \"none\" : \"block\";\n label.textContent = visible\n ? `▶ \\uD83D\\uDD11 Decoded ${fieldName}:`\n : `▼ \\uD83D\\uDD11 Decoded ${fieldName}:`;\n };\n\n div.appendChild(content);\n container.appendChild(div);\n}\n\n// --- Middlewares ---\n\nconst withRequestInspector = (): Middleware => {\n return (next) => async (input, init) => {\n const startTime = performance.now();\n const method = init?.method || \"GET\";\n const url = typeof input === \"string\" ? input : input.toString();\n\n let requestBody: any = null;\n const requestHeaders: Record = {};\n\n if (init?.headers) {\n const headers = new Headers(init.headers);\n headers.forEach((value, key) => {\n requestHeaders[key] = value;\n });\n }\n\n if (init?.body) {\n try {\n if (typeof init.body === \"string\") {\n requestBody = init.body;\n try {\n requestBody = JSON.parse(init.body);\n } catch {\n // Check if it's URL-encoded form data\n if (init.body.includes(\"=\")) {\n const params: Record = {};\n for (const [key, value] of new URLSearchParams(init.body)) {\n params[key] = value;\n }\n requestBody = params;\n }\n }\n } else if (init.body instanceof URLSearchParams) {\n const params: Record = {};\n for (const [key, value] of init.body) {\n params[key] = value;\n }\n requestBody = params;\n } else {\n requestBody = init.body;\n }\n } catch {\n requestBody = \"[Unable to capture request body]\";\n }\n }\n\n try {\n const response = await next(input, init);\n const duration = Math.round(performance.now() - startTime);\n\n const responseHeaders: Record = {};\n response.headers.forEach((value, key) => {\n responseHeaders[key] = value;\n });\n\n let responseBody: any = null;\n try {\n const clonedResponse = response.clone();\n const contentType = response.headers.get(\"content-type\") || \"\";\n if (contentType.includes(\"application/json\")) {\n responseBody = await clonedResponse.json();\n } else if (contentType.includes(\"text/\")) {\n responseBody = await clonedResponse.text();\n }\n } catch {\n responseBody = \"[Unable to capture response body]\";\n }\n\n const parsedUrl = new URL(url);\n const hostname = parsedUrl.hostname;\n const shortUrl = parsedUrl.pathname;\n const originRole = classifyOrigin(hostname, shortUrl);\n const message = `${method} ${hostname} ${shortUrl} \\u2192 ${response.status} ${response.statusText} (${duration}ms)`;\n\n const logData: LogData = {\n message,\n originRole,\n requestBody,\n responseBody,\n requestHeaders:\n Object.keys(requestHeaders).length > 0 ? requestHeaders : undefined,\n responseHeaders:\n Object.keys(responseHeaders).length > 0\n ? responseHeaders\n : undefined,\n };\n\n if (response.status >= 400) {\n log(logData, \"error\");\n } else {\n log(logData, \"http\");\n }\n\n return response;\n } catch (error) {\n const duration = Math.round(performance.now() - startTime);\n let hostname: string;\n let originRole: OriginRole;\n try {\n const parsedUrl = new URL(url);\n hostname = parsedUrl.hostname;\n originRole = classifyOrigin(hostname, parsedUrl.pathname);\n } catch {\n hostname = url;\n originRole = \"mcp\";\n }\n const errorMessage = `${method} ${hostname} failed: ${error instanceof Error ? error.message : String(error)} (${duration}ms)`;\n\n log(\n {\n message: errorMessage,\n originRole,\n requestBody,\n requestHeaders:\n Object.keys(requestHeaders).length > 0\n ? requestHeaders\n : undefined,\n },\n \"error\"\n );\n throw error;\n }\n };\n};\n\nconst withOAuth =\n (provider: OAuthClientProvider, baseUrl?: string | URL): Middleware =>\n (next) => {\n return async (input, init) => {\n const makeRequest = async (): Promise => {\n const headers = new Headers(init?.headers);\n const tokens = await provider.tokens();\n if (tokens) {\n headers.set(\"Authorization\", `Bearer ${tokens.access_token}`);\n }\n return await next(input, { ...init, headers });\n };\n\n let response = await makeRequest();\n\n if (response.status === 401) {\n try {\n const resourceMetadataUrl = extractResourceMetadataUrl(response);\n const serverUrl =\n baseUrl ||\n (typeof input === \"string\"\n ? new URL(input).origin\n : input.origin);\n\n const result = await auth(provider, {\n serverUrl,\n resourceMetadataUrl,\n fetchFn: next,\n });\n\n if (result === \"REDIRECT\") {\n throw new UnauthorizedError(\n \"Authentication requires user authorization - redirect initiated\"\n );\n }\n if (result !== \"AUTHORIZED\") {\n throw new UnauthorizedError(\n `Authentication failed with result: ${result}`\n );\n }\n\n response = await makeRequest();\n } catch (error) {\n if (error instanceof UnauthorizedError) throw error;\n throw new UnauthorizedError(\n `Failed to re-authenticate: ${error instanceof Error ? error.message : String(error)}`\n );\n }\n }\n\n if (response.status === 401) {\n const requestUrl =\n typeof input === \"string\" ? input : input.toString();\n throw new UnauthorizedError(\n `Authentication failed for ${requestUrl}`\n );\n }\n\n return response;\n };\n };\n\nconst withProxy = (proxyBaseUrl: string): Middleware => {\n return (next) => async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const proxiedUrl = `${proxyBaseUrl}/proxy?url=${encodeURIComponent(url)}`;\n return next(proxiedUrl, init);\n };\n};\n\n// --- XAA Auth Flow (Split: Login + Connect) ---\n\nasync function completeIdpLogin(\n code: string,\n callbackUrl: string,\n fetchFn: typeof fetch\n): Promise {\n const codeVerifier = sessionStorage.getItem(\"idp_code_verifier\")!;\n sessionStorage.removeItem(\"idp_code_verifier\");\n sessionStorage.removeItem(\"idp_login_flow\");\n\n // Exchange auth code → id_token at IdP\n log(\"Exchanging auth code for id_token at IdP...\", \"auth\");\n const tokenRes = await fetchFn(\"https://idp.xaa.dev/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n client_id: XAA_CLIENT_ID,\n client_secret: XAA_CLIENT_SECRET,\n code_verifier: codeVerifier,\n redirect_uri: callbackUrl,\n }),\n });\n if (!tokenRes.ok) {\n const errBody = await tokenRes.text();\n throw new Error(`IdP token exchange failed (${tokenRes.status}): ${errBody}`);\n }\n const { id_token } = await tokenRes.json();\n log(\"Got id_token from IdP\", \"auth\");\n\n sessionStorage.setItem(\"xaa_id_token\", id_token);\n return id_token;\n}\n\nasync function getXaaAccessToken(\n idToken: string,\n fetchFn: typeof fetch\n): Promise {\n // Token exchange → ID-JAG at IdP\n log(\"Performing token exchange for ID-JAG...\", \"auth\");\n const exchangeRes = await fetchFn(\"https://idp.xaa.dev/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:token-exchange\",\n subject_token: idToken,\n subject_token_type: \"urn:ietf:params:oauth:token-type:id_token\",\n requested_token_type: \"urn:ietf:params:oauth:token-type:id-jag\",\n audience: \"https://auth.resource.xaa.dev\",\n resource: \"https://mcp.xaa.dev/mcp\",\n client_id: XAA_CLIENT_ID,\n client_secret: XAA_CLIENT_SECRET,\n }),\n });\n if (!exchangeRes.ok) {\n const errBody = await exchangeRes.text();\n throw new Error(`Token exchange failed (${exchangeRes.status}): ${errBody}`);\n }\n const { access_token: idJag } = await exchangeRes.json();\n log(\"Got ID-JAG from IdP\", \"auth\");\n\n // jwt-bearer → access_token at resource AS\n log(\"Exchanging ID-JAG for access token at resource AS...\", \"auth\");\n const bearerRes = await fetchFn(\"https://auth.resource.xaa.dev/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n assertion: idJag,\n client_id: XAA_CLIENT_ID,\n client_secret: XAA_CLIENT_SECRET,\n }),\n });\n if (!bearerRes.ok) {\n const errBody = await bearerRes.text();\n throw new Error(`JWT bearer exchange failed (${bearerRes.status}): ${errBody}`);\n }\n const { access_token } = await bearerRes.json();\n log(\"Got access token from resource AS\", \"success\");\n\n sessionStorage.setItem(\"xaa_access_token\", access_token);\n return access_token;\n}\n\nasync function startIdpLogin(callbackUrl: string): Promise {\n const codeVerifier = generateCodeVerifier();\n const codeChallenge = await generateCodeChallenge(codeVerifier);\n\n sessionStorage.setItem(\"idp_code_verifier\", codeVerifier);\n\n const params = new URLSearchParams({\n response_type: \"code\",\n client_id: XAA_CLIENT_ID,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n redirect_uri: callbackUrl,\n scope: \"openid email\",\n });\n\n const authUrl = `https://idp.xaa.dev/authorize?${params}`;\n log({\n message: \"GET idp.xaa.dev /authorize → opening login window\",\n type: \"http\",\n originRole: \"idp\",\n responseBody: { authorization_url: authUrl },\n });\n\n const usePopup = (document.getElementById(\"usePopup\") as HTMLInputElement)?.checked ?? true;\n\n return new Promise((resolve, reject) => {\n const authWindow = usePopup\n ? window.open(authUrl, \"_blank\", \"width=600,height=700\")\n : null;\n\n if (!authWindow) {\n // Popup blocked — fall back to redirect\n log(\"Popup blocked — redirecting in current tab...\", \"auth\");\n sessionStorage.setItem(\"idp_login_flow\", \"active\");\n window.location.href = authUrl;\n // This never returns (page navigates)\n return;\n }\n\n const messageHandler = (event: MessageEvent) => {\n if (event.origin !== window.location.origin) return;\n if (event.data.type === \"oauth_callback\") {\n window.removeEventListener(\"message\", messageHandler);\n const code = event.data.code;\n log(\"Received authorization code from popup\", \"auth\");\n\n const proxyFetch = applyMiddlewares(\n withProxy(window.location.origin),\n withRequestInspector(),\n )(fetch);\n\n completeIdpLogin(code, callbackUrl, proxyFetch)\n .then((idToken) => {\n const decoded = decodeJWT(idToken);\n const email = decoded?.payload && (decoded.payload as any).sub;\n log(`Logged in as ${email || \"unknown\"}`, \"success\");\n updateLoginUI();\n resolve(idToken);\n })\n .catch((err) => {\n log(`IdP login failed: ${err.message}`, \"error\");\n reject(err);\n });\n }\n if (event.data.type === \"oauth_error\") {\n window.removeEventListener(\"message\", messageHandler);\n const errMsg = `${event.data.error}: ${event.data.error_description || \"\"}`;\n log(`IdP login error: ${errMsg}`, \"error\");\n reject(new Error(errMsg));\n }\n };\n\n window.addEventListener(\"message\", messageHandler);\n setTimeout(() => {\n window.removeEventListener(\"message\", messageHandler);\n reject(new Error(\"Login timeout\"));\n }, 300000);\n });\n}\n\nconst withXaaAuth = (): Middleware => {\n return (next) => async (input, init) => {\n const idToken = sessionStorage.getItem(\"xaa_id_token\");\n if (!idToken) {\n throw new Error(\"Not logged in — please log in with the IdP first\");\n }\n\n // Build a fetch for token exchange calls that goes through proxy + inspector\n const tokenFetchFn = applyMiddlewares(\n withProxy(window.location.origin),\n withRequestInspector(),\n )(fetch);\n\n // Check for cached access token\n let accessToken = sessionStorage.getItem(\"xaa_access_token\");\n if (!accessToken) {\n // Get a fresh access token via token exchange + jwt-bearer\n accessToken = await getXaaAccessToken(idToken, tokenFetchFn);\n }\n\n const headers = new Headers(init?.headers);\n headers.set(\"Authorization\", `Bearer ${accessToken}`);\n const response = await next(input, { ...init, headers });\n\n if (response.status === 401) {\n // Access token expired — get a new one\n sessionStorage.removeItem(\"xaa_access_token\");\n accessToken = await getXaaAccessToken(idToken, tokenFetchFn);\n const retryHeaders = new Headers(init?.headers);\n retryHeaders.set(\"Authorization\", `Bearer ${accessToken}`);\n return next(input, { ...init, headers: retryHeaders });\n }\n\n return response;\n };\n};\n\n// --- Login/Logout UI ---\n\nfunction updateLoginUI(): void {\n const section = document.getElementById(\"loginSection\");\n if (!section) return;\n\n const idToken = sessionStorage.getItem(\"xaa_id_token\");\n\n if (idToken) {\n const decoded = decodeJWT(idToken);\n const email = decoded?.payload && (decoded.payload as any).sub || \"unknown\";\n\n section.innerHTML = `\n Identity Provider\n \n

\n `;\n\n document.getElementById(\"logoutBtn\")?.addEventListener(\"click\", handleLogout);\n\n // Wire up JWT decode badge\n const badge = document.getElementById(\"idTokenBadge\");\n const decodeContainer = document.getElementById(\"idTokenDecode\");\n if (badge && decodeContainer && decoded) {\n badge.addEventListener(\"click\", () => {\n if (decodeContainer.children.length === 0) {\n // Build decode view\n const wrapper = document.createElement(\"div\");\n wrapper.className = \"jwt-decoded visible\";\n\n const headerSection = document.createElement(\"div\");\n const headerTitle = document.createElement(\"div\");\n headerTitle.className = \"jwt-section-header\";\n headerTitle.textContent = \"Header\";\n const headerBody = document.createElement(\"div\");\n headerBody.className = \"jwt-section-body\";\n const headerPre = document.createElement(\"pre\");\n headerPre.textContent = JSON.stringify(decoded.header, null, 2);\n headerBody.appendChild(headerPre);\n headerSection.appendChild(headerTitle);\n headerSection.appendChild(headerBody);\n wrapper.appendChild(headerSection);\n\n const payloadSection = document.createElement(\"div\");\n const payloadTitle = document.createElement(\"div\");\n payloadTitle.className = \"jwt-section-header\";\n payloadTitle.textContent = \"Payload\";\n const payloadBody = document.createElement(\"div\");\n payloadBody.className = \"jwt-section-body\";\n const payloadPre = document.createElement(\"pre\");\n payloadPre.textContent = JSON.stringify(decoded.payload, null, 2);\n payloadBody.appendChild(payloadPre);\n payloadSection.appendChild(payloadTitle);\n payloadSection.appendChild(payloadBody);\n wrapper.appendChild(payloadSection);\n\n decodeContainer.appendChild(wrapper);\n } else {\n // Toggle visibility\n const existing = decodeContainer.querySelector(\".jwt-decoded\");\n existing?.classList.toggle(\"visible\");\n }\n });\n }\n } else {\n section.innerHTML = `\n Identity Provider\n \n `;\n document.getElementById(\"loginBtn\")?.addEventListener(\"click\", handleLogin);\n }\n}\n\nasync function handleLogin(): Promise {\n const callbackUrl = (document.getElementById(\"callbackUrl\") as HTMLInputElement)?.value;\n const loginBtn = document.getElementById(\"loginBtn\") as HTMLButtonElement;\n if (loginBtn) loginBtn.disabled = true;\n\n try {\n await startIdpLogin(callbackUrl);\n } catch (err: any) {\n log(`Login failed: ${err.message}`, \"error\");\n if (loginBtn) loginBtn.disabled = false;\n }\n}\n\nfunction handleLogout(): void {\n sessionStorage.removeItem(\"xaa_id_token\");\n sessionStorage.removeItem(\"xaa_access_token\");\n updateLoginUI();\n log(\"Logged out\", \"info\");\n}\n\n// --- App State ---\n\nlet client: Client | null = null;\nlet transport: StreamableHTTPClientTransport | null = null;\nlet oauthProvider: BrowserOAuthProvider | null = null;\n\n// --- App Logic ---\n\nfunction savePreferences(): void {\n const serverSelect = document.getElementById(\n \"serverSelect\"\n ) as HTMLSelectElement;\n const customUrl = document.getElementById(\"customUrl\") as HTMLInputElement;\n if (serverSelect && customUrl) {\n localStorage.setItem(\"mcp_server_select\", serverSelect.value);\n if (serverSelect.value === \"custom\") {\n localStorage.setItem(\"mcp_custom_url\", customUrl.value);\n }\n }\n const usePopup = document.getElementById(\"usePopup\") as HTMLInputElement;\n if (usePopup) {\n localStorage.setItem(\"mcp_use_popup\", usePopup.checked ? \"true\" : \"false\");\n }\n}\n\nfunction loadPreferences(): void {\n const savedServer = localStorage.getItem(\"mcp_server_select\");\n const savedCustomUrl = localStorage.getItem(\"mcp_custom_url\");\n if (savedServer) {\n const serverSelect = document.getElementById(\n \"serverSelect\"\n ) as HTMLSelectElement;\n if (serverSelect) {\n serverSelect.value = savedServer;\n if (savedServer === \"custom\") {\n const customUrlGroup = document.getElementById(\"customUrlGroup\");\n if (customUrlGroup) customUrlGroup.style.display = \"block\";\n if (savedCustomUrl) {\n const customUrl = document.getElementById(\n \"customUrl\"\n ) as HTMLInputElement;\n if (customUrl) customUrl.value = savedCustomUrl;\n }\n }\n }\n }\n const savedPopup = localStorage.getItem(\"mcp_use_popup\");\n if (savedPopup !== null) {\n const usePopup = document.getElementById(\"usePopup\") as HTMLInputElement;\n if (usePopup) usePopup.checked = savedPopup === \"true\";\n }\n}\n\nasync function connectToServer(): Promise {\n const serverSelect = document.getElementById(\n \"serverSelect\"\n ) as HTMLSelectElement;\n const callbackUrl = (\n document.getElementById(\"callbackUrl\") as HTMLInputElement\n )?.value;\n\n let serverUrl: string;\n if (serverSelect.value === \"custom\") {\n serverUrl =\n (document.getElementById(\"customUrl\") as HTMLInputElement)?.value || \"\";\n if (!serverUrl) {\n log(\"Please enter a custom server URL\", \"error\");\n return;\n }\n } else {\n serverUrl = serverSelect.value;\n }\n\n const connectBtn = document.getElementById(\n \"connectBtn\"\n ) as HTMLButtonElement;\n const listToolsBtn = document.getElementById(\n \"listToolsBtn\"\n ) as HTMLButtonElement;\n const disconnectBtn = document.getElementById(\n \"disconnectBtn\"\n ) as HTMLButtonElement;\n\n connectBtn.disabled = true;\n setStatus(\"connecting\");\n\n try {\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(serverUrl);\n } catch {\n log(\"Invalid server URL format\", \"error\");\n connectBtn.disabled = false;\n setStatus(\"disconnected\");\n return;\n }\n\n log(\"Initializing MCP client...\", \"info\");\n log(`Target: ${serverUrl}`, \"info\");\n\n const isXaaDev = parsedUrl.hostname === \"mcp.xaa.dev\";\n\n const clientMetadata: ClientMetadata = {\n client_name: \"MCP Auth Workbench\",\n redirect_uris: [callbackUrl],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: isXaaDev ? \"client_secret_post\" : \"none\",\n };\n\n const useLocalhostDev = (\n document.getElementById(\"useLocalhostDev\") as HTMLInputElement\n )?.checked;\n\n let clientMetadataUrl: string | undefined;\n if (useLocalhostDev) {\n // localhost dev mode uses http:// which the SDK rejects for CIMD — falls back to DCR\n clientMetadataUrl = undefined;\n log(\"Using localhost development mode\", \"info\");\n } else {\n clientMetadataUrl = `${window.location.origin}/client-metadata.json`;\n }\n\n oauthProvider = new BrowserOAuthProvider(callbackUrl, clientMetadata, clientMetadataUrl);\n\n if (isXaaDev) {\n // Check for id_token — user must be logged in first\n const idToken = sessionStorage.getItem(\"xaa_id_token\");\n if (!idToken) {\n log(\"Please log in with the IdP first before connecting to xaa.dev\", \"error\");\n connectBtn.disabled = false;\n setStatus(\"disconnected\");\n return;\n }\n log(\"Using XAA cross-app auth flow for xaa.dev\", \"info\");\n }\n\n client = new Client(\n { name: \"mcp-auth-workbench\", version: \"1.0.0\" },\n { capabilities: {} }\n );\n\n const fetchWrapper = isXaaDev\n ? applyMiddlewares(\n withProxy(window.location.origin),\n withRequestInspector(),\n withXaaAuth(),\n )(fetch)\n : applyMiddlewares(\n withProxy(window.location.origin),\n withRequestInspector(),\n withOAuth(oauthProvider, parsedUrl),\n )(fetch);\n\n transport = new StreamableHTTPClientTransport(parsedUrl, {\n fetch: fetchWrapper,\n });\n\n try {\n log(\"Connecting to server...\", \"info\");\n await client.connect(transport);\n log(\"Successfully connected to MCP server!\", \"success\");\n setStatus(\"connected\");\n } catch (error: any) {\n if (\n !isXaaDev &&\n (error instanceof UnauthorizedError ||\n error.message === \"Unauthorized\")\n ) {\n log(\n \"OAuth required - waiting for authorization code...\",\n \"auth\"\n );\n\n const authCode = await oauthProvider!.getAuthCode();\n await transport!.close();\n\n const result = await auth(oauthProvider, {\n serverUrl: parsedUrl,\n authorizationCode: authCode,\n fetchFn: fetchWrapper,\n });\n\n if (result !== \"AUTHORIZED\") {\n throw new UnauthorizedError(\"Failed to authorize\");\n }\n\n transport = new StreamableHTTPClientTransport(parsedUrl, {\n fetch: fetchWrapper,\n });\n\n await client.connect(transport);\n log(\"Successfully connected with authentication!\", \"success\");\n setStatus(\"connected\");\n } else {\n throw error;\n }\n }\n\n connectBtn.disabled = true;\n listToolsBtn.disabled = false;\n disconnectBtn.disabled = false;\n savePreferences();\n } catch (error: any) {\n log(\"Connection error: \" + error.message, \"error\");\n setStatus(\"disconnected\");\n connectBtn.disabled = false;\n }\n}\n\nasync function listTools(): Promise {\n if (!client) {\n log(\"Not connected to server\", \"error\");\n return;\n }\n\n try {\n log(\"Fetching available tools...\", \"info\");\n const result = await client.listTools();\n\n if (result.tools && result.tools.length > 0) {\n log(`Found ${result.tools.length} tools:`, \"success\");\n result.tools.forEach((tool: any) => {\n log(` \\u2022 ${tool.name}: ${tool.description || \"(no description)\"}`, \"info\");\n });\n } else {\n log(\"No tools available\", \"info\");\n }\n } catch (error: any) {\n log(\"Error listing tools: \" + error.message, \"error\");\n }\n}\n\nasync function disconnect(): Promise {\n if (transport) {\n try {\n log(\"Disconnecting...\", \"info\");\n await transport.close();\n log(\"Disconnected from server\", \"success\");\n } catch (error: any) {\n log(\"Error disconnecting: \" + error.message, \"error\");\n }\n }\n\n client = null;\n transport = null;\n oauthProvider = null;\n setStatus(\"disconnected\");\n\n const connectBtn = document.getElementById(\n \"connectBtn\"\n ) as HTMLButtonElement;\n const listToolsBtn = document.getElementById(\n \"listToolsBtn\"\n ) as HTMLButtonElement;\n const disconnectBtn = document.getElementById(\n \"disconnectBtn\"\n ) as HTMLButtonElement;\n\n if (connectBtn) connectBtn.disabled = false;\n if (listToolsBtn) listToolsBtn.disabled = true;\n if (disconnectBtn) disconnectBtn.disabled = true;\n}\n\nfunction clearLog(): void {\n const logDiv = document.getElementById(\"log\");\n if (logDiv) {\n logDiv.innerHTML = \"\";\n log(\"Log cleared\", \"info\");\n }\n}\n\nfunction setStatus(status: string): void {\n const statusEl = document.getElementById(\"status\");\n if (!statusEl) return;\n statusEl.className = \"status \" + status;\n statusEl.textContent = status.charAt(0).toUpperCase() + status.slice(1);\n}\n\n// --- Init ---\n\nwindow.addEventListener(\"DOMContentLoaded\", () => {\n loadPreferences();\n sessionStorage.removeItem(\"xaa_access_token\");\n updateLoginUI();\n log(\"MCP Auth Workbench ready\", \"info\");\n\n // Handle auth code or error returned via redirect\n const params = new URLSearchParams(window.location.search);\n const redirectError = params.get(\"error\");\n const redirectCode = params.get(\"code\");\n const idpLoginFlow = sessionStorage.getItem(\"idp_login_flow\");\n\n if (redirectError) {\n const errorDesc = params.get(\"error_description\") || \"\";\n window.history.replaceState({}, \"\", window.location.pathname);\n sessionStorage.removeItem(\"idp_login_flow\");\n sessionStorage.removeItem(\"idp_code_verifier\");\n log(`Authorization error: ${redirectError} — ${errorDesc}`, \"error\");\n } else if (idpLoginFlow === \"active\" && redirectCode) {\n // Returning from IdP login redirect (popup was blocked fallback)\n window.history.replaceState({}, \"\", window.location.pathname);\n log(\"Resuming IdP login flow...\", \"auth\");\n\n const callbackUrl = (\n document.getElementById(\"callbackUrl\") as HTMLInputElement\n )?.value;\n\n const proxyFetch = applyMiddlewares(\n withProxy(window.location.origin),\n withRequestInspector(),\n )(fetch);\n\n completeIdpLogin(redirectCode, callbackUrl, proxyFetch)\n .then((idToken) => {\n const decoded = decodeJWT(idToken);\n const email = decoded?.payload && (decoded.payload as any).sub;\n log(`Logged in as ${email || \"unknown\"}`, \"success\");\n updateLoginUI();\n })\n .catch((err) => {\n log(`IdP login failed: ${err.message}`, \"error\");\n });\n } else if (redirectCode) {\n // Standard OAuth redirect flow (non-XAA)\n window.history.replaceState({}, \"\", window.location.pathname);\n sessionStorage.setItem(\"mcp_auth_code\", redirectCode);\n log(\"Authorization code received via redirect\", \"auth\");\n // Auto-connect with the saved server selection\n setTimeout(() => connectToServer(), 100);\n }\n\n const serverSelect = document.getElementById(\"serverSelect\");\n if (serverSelect) {\n serverSelect.addEventListener(\"change\", (e) => {\n const target = e.target as HTMLSelectElement;\n const customUrlGroup = document.getElementById(\"customUrlGroup\");\n if (customUrlGroup) {\n customUrlGroup.style.display =\n target.value === \"custom\" ? \"block\" : \"none\";\n }\n savePreferences();\n });\n }\n\n const customUrl = document.getElementById(\"customUrl\");\n if (customUrl) {\n customUrl.addEventListener(\"change\", savePreferences);\n }\n\n // Config toggle\n const configToggle = document.getElementById(\"configToggle\");\n const configContent = document.getElementById(\"configContent\");\n if (configToggle && configContent) {\n configToggle.addEventListener(\"click\", () => {\n const expanded = configContent.classList.toggle(\"expanded\");\n configToggle.textContent = expanded ? \"▼ Configuration\" : \"▶ Configuration\";\n });\n }\n\n // Popup toggle — sticky\n document.getElementById(\"usePopup\")?.addEventListener(\"change\", savePreferences);\n\n // Expose scriptable popup toggle for browser automation\n (window as any).setPopupMode = (enabled: boolean) => {\n const checkbox = document.getElementById(\"usePopup\") as HTMLInputElement;\n if (checkbox) checkbox.checked = enabled;\n localStorage.setItem(\"mcp_use_popup\", enabled ? \"true\" : \"false\");\n };\n\n document\n .getElementById(\"connectBtn\")\n ?.addEventListener(\"click\", connectToServer);\n document\n .getElementById(\"listToolsBtn\")\n ?.addEventListener(\"click\", listTools);\n document\n .getElementById(\"disconnectBtn\")\n ?.addEventListener(\"click\", disconnect);\n document\n .getElementById(\"clearLogBtn\")\n ?.addEventListener(\"click\", clearLog);\n});\n\nexport default true;\n",[],[91,100],"bc462798-fbae-11f0-adf8-42dde27851f2","backend","bc462856-fbae-11f0-adf8-42dde27851f2",4,["D",1769538835002],[116],[110],{"_33":117,"_13":118,"_35":119,"_37":111,"_38":39,"_40":120,"_42":43,"_44":121,"_17":122,"_47":123,"_48":124,"_50":51,"_52":14,"_67":125,"_18":126},"3e8beaf4-fc3f-11f0-9d3c-42dde27851f2","index.http.tsx","bc88f3ac-fbae-11f0-9910-42dde27851f2",56,["D",1769600901076],11,"http","/** @jsxImportSource https://esm.sh/hono@4/jsx */\nimport { Hono } from \"https://esm.sh/hono@4\";\nimport { serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\nconst app = new Hono();\n\nconst SDK_VERSION = \"1.25.3\";\n\n// Serve frontend files\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\n\n// Client metadata endpoint (CIMD)\napp.get(\"/client-metadata.json\", (c) => {\n const url = new URL(c.req.url);\n const clientMetadata = {\n client_id: `${url.origin}/client-metadata.json`,\n client_uri: `${url.origin}`,\n client_name: \"MCP Auth Workbench\",\n redirect_uris: [`${url.origin}/callback`],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: \"none\",\n };\n\n return c.json(clientMetadata, 200, {\n \"Access-Control-Allow-Origin\": \"*\",\n });\n});\n\n// OAuth callback handler\napp.get(\"/callback\", (c) => {\n const code = c.req.query(\"code\") || \"\";\n const state = c.req.query(\"state\") || \"\";\n const error = c.req.query(\"error\") || \"\";\n const errorDescription = c.req.query(\"error_description\") || \"\";\n\n if (error) {\n return c.html(`\n\n OAuth Error\n \n

Authorization failed

Error: ${error}

${errorDescription}

\n \n \n`);\n }\n\n return c.html(`\n\n OAuth Callback\n \n

Authorization successful!

This window will close automatically...

\n \n \n`);\n});\n\n// CORS proxy — forwards browser fetch requests to the real MCP server\n// so everything is same-origin from the browser's perspective.\napp.all(\"/proxy\", async (c) => {\n const targetUrl = c.req.query(\"url\");\n if (!targetUrl) return c.text(\"Missing url parameter\", 400);\n\n const headers = new Headers(c.req.raw.headers);\n headers.delete(\"host\");\n headers.delete(\"connection\");\n\n const method = c.req.method;\n const body = method !== \"GET\" && method !== \"HEAD\" ? c.req.raw.body : undefined;\n\n const response = await fetch(targetUrl, { method, headers, body });\n\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers: response.headers,\n });\n});\n\n// Main page\napp.get(\"/\", (c) => {\n const url = new URL(c.req.url);\n const isLocal =\n url.hostname === \"localhost\" ||\n url.hostname === \"127.0.0.1\" ||\n url.hostname === \"0.0.0.0\";\n const frontendUrl = isLocal\n ? \"/frontend/app.ts\"\n : \"/frontend/app.ts\";\n\n return c.html(`\n\n \n MCP Auth Workbench\n \n \n \n \n

\n \n

\n Identity Provider\n \n

\n\n

\n Server Endpoint\n \n

\n\n

\n Custom Server URL\n \n

\n\n

\n ▶ Configuration\n

\n \n \n Use Pop-up for Auth\n \n

\n OAuth Callback URL\n \n

\n\n

\n Client ID Metadata Document\n

\n \n View\n

\n\n

\n \n \n Use Localhost Development Mode\n \n

\n Use http://localhost/ as client_id for local development\n

\n\n

\n \n \n \n \n

\n\n

\n SDK: @modelcontextprotocol/sdk@${SDK_VERSION}\n

Request Log

\n\n \n \n \n`);\n});\n\n// Favicon\napp.get(\"/favicon.svg\", (c) => {\n return c.body(\n ``,\n 200,\n { \"Content-Type\": \"image/svg+xml\" }\n );\n});\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\nexport default app.fetch;\n",[],[110,118],"bc1861dc-fbae-11f0-83e3-42dde27851f2",".claude","bc1862cc-fbae-11f0-83e3-42dde27851f2",["D",1769538834701],[133],[128],{"_33":134,"_13":135,"_35":136,"_37":129,"_38":39,"_40":137,"_42":43,"_44":138,"_17":41,"_47":24,"_48":139,"_50":51,"_52":-5,"_67":140,"_18":141},"11f615e0-fc40-11f0-9dcd-42dde27851f2","settings.local.json","bc67ca10-fbae-11f0-a0e0-42dde27851f2",60,["D",1769601255770],"{\n \"permissions\": {\n \"allow\": [\n \"WebFetch(domain:xaa.dev)\",\n \"Bash(vt me)\",\n \"mcp__claude-in-chrome__read_console_messages\",\n \"mcp__claude-in-chrome__find\",\n \"Skill(claude-in-chrome)\",\n \"Bash(curl:*)\",\n \"mcp__claude-in-chrome__javascript_tool\",\n \"mcp__claude-in-chrome__computer\",\n \"mcp__claude-in-chrome__read_page\",\n \"mcp__claude-in-chrome__read_network_requests\",\n \"mcp__claude-in-chrome__navigate\",\n \"mcp__claude-in-chrome__tabs_create_mcp\",\n \"mcp__claude-in-chrome__form_input\",\n \"Bash(open:*)\",\n \"Bash(vt push)\",\n \"Skill(commit)\"\n ]\n }\n}\n",[],[128,135],"857afe34-fbac-11f0-93cf-42dde27851f2",["D",1769537884081],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_195":191},"org",{"_11":12,"_189":-5,"_190":191,"_152":153,"_192":193,"_194":51},"branch",{"_17":102,"_13":16,"_33":39,"_181":142,"_182":-5,"_183":-5,"_184":-5,"_185":-5,"_186":-5,"_187":14,"_188":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":142,"_13":14,"_44":255,"_144":-5,"_145":51,"_146":147,"_148":147,"_149":150,"_151":-5,"_152":153,"_154":-5,"_155":51,"_156":-5,"_157":-5,"_158":46,"_159":160,"_161":-5,"_162":-5,"_163":-5,"_164":-5,"_165":166,"_167":166,"_168":169,"_170":169,"_171":169,"_172":166,"_173":166,"_174":256,"_176":257,"_178":258,"_180":51},[225,227,229,231,232,233,234],"files",[225,226,227,228,229,230,231,232,233,234],"counts",{"_216":46,"_217":85,"_218":46,"_32":219,"_220":221},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_18":215},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches","forks",{"_222":46,"_224":46},"connections",{"_222":46,"_223":46},"count","unfilledCount","emptyCount",{"_33":127,"_13":128,"_35":129,"_37":-5,"_38":39,"_40":75,"_42":43,"_44":130,"_17":46,"_47":95,"_48":-5,"_50":51,"_52":-5,"_67":253,"_18":254},{"_33":134,"_13":135,"_35":136,"_37":129,"_38":39,"_40":137,"_42":43,"_44":138,"_17":41,"_47":24,"_48":139,"_50":51,"_52":-5,"_67":251,"_18":252},{"_33":109,"_13":110,"_35":111,"_37":-5,"_38":39,"_40":112,"_42":43,"_44":113,"_17":46,"_47":95,"_48":-5,"_50":51,"_52":-5,"_67":249,"_18":250},{"_33":117,"_13":118,"_35":119,"_37":111,"_38":39,"_40":120,"_42":43,"_44":121,"_17":122,"_47":123,"_48":124,"_50":51,"_52":14,"_67":247,"_18":248},{"_33":90,"_13":91,"_35":92,"_37":-5,"_38":39,"_40":93,"_42":43,"_44":94,"_17":46,"_47":95,"_48":-5,"_50":51,"_52":-5,"_67":245,"_18":246},{"_33":99,"_13":100,"_35":101,"_37":92,"_38":39,"_40":102,"_42":43,"_44":103,"_17":104,"_47":105,"_48":106,"_50":51,"_52":-5,"_67":243,"_18":244},{"_33":82,"_13":83,"_35":84,"_37":-5,"_38":39,"_40":85,"_42":43,"_44":86,"_17":46,"_47":24,"_48":87,"_50":51,"_52":-5,"_67":241,"_18":242},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":79,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_67":239,"_18":240},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":75,"_47":24,"_48":76,"_50":51,"_52":-5,"_67":237,"_18":238},{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":46,"_47":24,"_48":66,"_50":51,"_52":-5,"_67":235,"_18":236},[],[62],[],[71],[],[19],[],[83],[],[91,100],[230],[91],[],[110,118],[228],[110],[],[128,135],[226],[128],["D",1769537884081],{"_11":12,"_195":191},{"_11":12,"_189":-5,"_190":191,"_152":153,"_192":193,"_194":51},{"_17":102,"_13":16,"_33":39,"_181":142,"_182":-5,"_183":-5,"_184":-5,"_185":-5,"_186":-5,"_187":14,"_188":12},"ctx",{"_174":-5,"_212":292,"_293":294,"_295":296,"_297":51,"_298":51,"_299":51,"_300":43,"_301":-5,"_302":-7,"_303":-7,"_304":46,"_305":51,"_306":51,"_307":-5,"_308":51,"_309":51,"_310":51,"_311":-5},"ENV",{"_263":264,"_265":266,"_267":16,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]