[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_204":205,"_206":207},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_154":-5,"_20":155,"_22":156,"_157":158,"_159":160,"_25":161,"_24":-5,"_162":-5,"_163":-5,"_164":54,"_165":166,"_167":45,"_168":-5,"_169":-5,"_170":171},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","pcarleton","name","xaa-mcp-cal","branchName","main","version","path","","project",{"_34":101,"_13":14,"_46":102,"_103":-5,"_104":54,"_105":106,"_107":106,"_108":-5,"_109":-5,"_110":111,"_112":-5,"_113":54,"_114":-5,"_115":-5,"_116":48,"_117":118,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_132":133,"_134":135,"_136":137,"_138":54},"tree",[64,65],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":48,"_49":62,"_51":-5,"_53":54,"_55":-5,"_18":63},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_18":56},"id","bb62dfc6-17e0-11f1-af21-42dde27851f2","http.ts","fileId","bb62e098-17e0-11f1-af21-42dde27851f2","parentId","branchId","bb11c51e-17e0-11f1-a058-42dde27851f2","branchVersion",1,"latest",true,"createdAt",["D",1772638940904],0,"fileType","http","content","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Second RS — proves the point of XAA: add this one AFTER todos, and the\n// id_token is already cached → zero clicks, zero consent screens.\n\nconst EVENTS = [\n { id: 1, title: \"XAA conformance working session\", when: \"2026-03-04 14:00\", where: \"this terminal\" },\n { id: 2, title: \"QCon London: Agent Sandbox talk\", when: \"2026-03-18 14:45 GMT\", where: \"London\" },\n { id: 3, title: \"MCP Dev Summit: XAA demo\", when: \"2026-04-03 14:25 EDT\", where: \"NYC\" },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-cal\",\n selfUrl: URLS.cal,\n port: 3003,\n tools: [\n {\n name: \"list_events\",\n description: \"List upcoming events. You got here with the same id_token you used for todos.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: () => ({\n content: [{ type: \"text\", text: EVENTS.map((e) => `${e.when} ${e.title} (${e.where})`).join(\"\\n\") }],\n }),\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3003 }, app.fetch);\n","deleted",false,"label",[36],"bba0d98e-17e0-11f1-af21-42dde27851f2","shared","86315d95-d1b5-4d30-931b-2c8320705072",2,["D",1772638941295],"directory",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":70,"_17":48,"_49":62,"_51":-5,"_53":54,"_55":-5,"_67":71,"_18":72},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":66,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_67":68,"_18":69},["D",1772638940904],"children",[],[36],["D",1772638941295],[73,74,75],[58],{"_34":93,"_13":94,"_37":95,"_39":59,"_40":41,"_42":96,"_44":45,"_46":97,"_17":60,"_49":81,"_51":98,"_53":54,"_55":-5,"_67":99,"_18":100},{"_34":85,"_13":86,"_37":87,"_39":59,"_40":41,"_42":88,"_44":45,"_46":89,"_17":48,"_49":81,"_51":90,"_53":54,"_55":-5,"_67":91,"_18":92},{"_34":76,"_13":77,"_37":78,"_39":59,"_40":41,"_42":79,"_44":45,"_46":80,"_17":60,"_49":81,"_51":82,"_53":54,"_55":-5,"_67":83,"_18":84},"82ff1864-2d40-11f1-99a2-42dde27851f2","mcp-rs.ts","bc214bfa-17e0-11f1-a74e-42dde27851f2",8,["D",1774989052399],"script","/**\n * Shared MCP resource-server scaffolding. A tiny Hono app with:\n * - RFC 9728 PRM at /.well-known/oauth-protected-resource/mcp\n * - /mcp gated by AS-issued JWT bearer (aud-bound to this resource)\n * - stateless JSON-RPC dispatch (initialize, tools/list, tools/call)\n *\n * Skips the SDK transport + fetch-to-node — see rs/rs.ts history for why.\n */\n\nimport { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, OKTA_ISSUER } from \"./config.ts\";\nimport { indexPage } from \"./html.ts\";\n\nexport interface Tool {\n name: string;\n description: string;\n inputSchema: Record;\n handler: (args: Record, claims?: jose.JWTPayload) => { content: { type: \"text\"; text: string }[] };\n}\n\nexport function createResourceServer(opts: {\n name: string;\n selfUrl: string; // e.g. URLS.rs or URLS.cal — origin only, we add /mcp\n asUrl?: string; // defaults to URLS.as — the AS whose JWKS gates /mcp\n tools: Tool[];\n port: number;\n}): Hono {\n const resource = `${opts.selfUrl}/mcp`;\n const asUrl = opts.asUrl ?? URLS.as;\n const asJwks = jose.createRemoteJWKSet(new URL(`${asUrl}/.well-known/jwks.json`));\n const prmPath = \"/.well-known/oauth-protected-resource/mcp\";\n\n const app = new Hono();\n app.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n exposeHeaders: [\"WWW-Authenticate\"],\n }));\n\n app.get(prmPath, (c) => c.json({ resource, authorization_servers: [asUrl] }));\n\n app.post(\"/mcp\", async (c) => {\n const authz = c.req.header(\"Authorization\");\n const unauthorized = (msg: string) =>\n c.json(\n { jsonrpc: \"2.0\", error: { code: -32001, message: msg }, id: null },\n 401,\n { \"WWW-Authenticate\": `Bearer resource_metadata=\"${opts.selfUrl}${prmPath}\"` },\n );\n\n if (!authz?.startsWith(\"Bearer \")) return unauthorized(\"Authentication required\");\n\n const token = authz.slice(7);\n let tokenClaims: jose.JWTPayload;\n try {\n const peek = jose.decodeJwt(token);\n if (peek.iss === OKTA_ISSUER) {\n // ID-JAG from Okta — iss check only, sig verification TODO\n tokenClaims = peek;\n } else {\n const { payload } = await jose.jwtVerify(token, asJwks, { issuer: asUrl, audience: resource });\n tokenClaims = payload;\n }\n } catch (e) {\n return unauthorized(`Invalid token: ${e instanceof Error ? e.message : e}`);\n }\n\n const msg = await c.req.json();\n if (msg.id === undefined) return c.body(null, 202); // notification\n\n try {\n return c.json({ jsonrpc: \"2.0\", id: msg.id, result: dispatch(msg, opts, tokenClaims) });\n } catch (err) {\n const error = (err && typeof err === \"object\" && \"code\" in err)\n ? err\n : { code: -32603, message: String(err) };\n return c.json({ jsonrpc: \"2.0\", id: msg.id, error });\n }\n });\n\n app.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"RS\",\n name: opts.name,\n endpoints: [\n { method: \"GET\", path: prmPath },\n { method: \"POST\", path: \"/mcp\", note: `bearer-gated; tools: ${opts.tools.map((t) => t.name).join(\", \")}` },\n ],\n })));\n\n app.onError((err) => { throw err; });\n return app;\n}\n\nfunction dispatch(msg: { method: string; params?: any }, opts: { name: string; tools: Tool[] }, claims?: jose.JWTPayload): unknown {\n switch (msg.method) {\n case \"initialize\":\n return {\n protocolVersion: msg.params?.protocolVersion ?? \"2025-06-18\",\n serverInfo: { name: opts.name, version: \"1.0.0\" },\n capabilities: { tools: { listChanged: false } },\n };\n case \"tools/list\":\n return { tools: opts.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) };\n case \"tools/call\": {\n const { name, arguments: args } = msg.params ?? {};\n const tool = opts.tools.find((t) => t.name === name);\n if (!tool) throw { code: -32602, message: `Unknown tool: ${name}` };\n return tool.handler(args ?? {}, claims);\n }\n default:\n throw { code: -32601, message: `Method not found: ${msg.method}` };\n }\n}\n",[],[58,77],"bbe02d00-17e0-11f1-956c-42dde27851f2","html.ts","bbe02ef4-17e0-11f1-956c-42dde27851f2",3,["D",1772638941685],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[58,86],"82d899be-2d40-11f1-a4cc-42dde27851f2","config.ts","bba0cd72-17e0-11f1-af21-42dde27851f2",7,["D",1774989052139],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[58,94],"bb118518-17e0-11f1-a058-42dde27851f2",["D",1772638940377],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_153":149},"org",{"_11":12,"_147":-5,"_148":149,"_110":111,"_150":151,"_152":54},"branch",{"_17":79,"_13":16,"_34":41,"_139":101,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":14,"_146":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":101,"_13":14,"_46":200,"_103":-5,"_104":54,"_105":106,"_107":106,"_108":-5,"_109":-5,"_110":111,"_112":-5,"_113":54,"_114":-5,"_115":-5,"_116":48,"_117":118,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_132":201,"_134":202,"_136":203,"_138":54},[185,189],"files",[185,186,187,188,189],"counts",{"_176":48,"_177":43,"_178":48,"_31":179,"_180":181},[172,173],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":48,"_49":62,"_51":-5,"_53":54,"_55":-5,"_18":175},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_18":174},[36],[58],"pulls","branches","forks",{"_182":48,"_184":48},"connections",{"_182":48,"_183":48},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":70,"_17":48,"_49":62,"_51":-5,"_53":54,"_55":-5,"_67":198,"_18":199},{"_34":93,"_13":94,"_37":95,"_39":59,"_40":41,"_42":96,"_44":45,"_46":97,"_17":60,"_49":81,"_51":98,"_53":54,"_55":-5,"_67":196,"_18":197},{"_34":85,"_13":86,"_37":87,"_39":59,"_40":41,"_42":88,"_44":45,"_46":89,"_17":48,"_49":81,"_51":90,"_53":54,"_55":-5,"_67":194,"_18":195},{"_34":76,"_13":77,"_37":78,"_39":59,"_40":41,"_42":79,"_44":45,"_46":80,"_17":60,"_49":81,"_51":82,"_53":54,"_55":-5,"_67":192,"_18":193},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":66,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_67":190,"_18":191},[],[36],[],[58,77],[],[58,86],[],[58,94],[186,187,188],[58],["D",1772638940377],{"_11":12,"_153":149},{"_11":12,"_147":-5,"_148":149,"_110":111,"_150":151,"_152":54},{"_17":79,"_13":16,"_34":41,"_139":101,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":14,"_146":12},"ctx",{"_132":-5,"_169":237,"_238":239,"_240":241,"_242":54,"_243":54,"_244":54,"_245":45,"_246":-5,"_247":-7,"_248":-7,"_249":48,"_250":54,"_251":54,"_252":-5,"_253":54,"_254":54,"_255":54,"_256":-5},"ENV",{"_208":209,"_210":211,"_212":16,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e8c4b7030cb7600e4eb0736b15f422c8b8bd130f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code