${opts.name}

\n${rows}\n

`;\n}\n",[],[162,192],{"_108":200,"_99":201,"_163":202,"_165":164,"_166":148,"_167":105,"_169":170,"_110":203,"_104":185,"_172":186,"_174":204,"_175":22,"_176":-5,"_177":205,"_102":206},"835176a4-2d40-11f1-bb88-42dde27851f2","mcp-rs.ts","b4395ebc-18a0-11f1-85e4-42dde27851f2",["D",1774989052929],"/**\n * Shared MCP resource-server scaffolding. A tiny Hono app with:\n * - RFC 9728 PRM at /.well-known/oauth-protected-resource/mcp\n * - /mcp gated by AS-issued JWT bearer (aud-bound to this resource)\n * - stateless JSON-RPC dispatch (initialize, tools/list, tools/call)\n *\n * Skips the SDK transport + fetch-to-node — see rs/rs.ts history for why.\n */\n\nimport { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, OKTA_ISSUER } from \"./config.ts\";\nimport { indexPage } from \"./html.ts\";\n\nexport interface Tool {\n name: string;\n description: string;\n inputSchema: Record;\n handler: (args: Record, claims?: jose.JWTPayload) => { content: { type: \"text\"; text: string }[] };\n}\n\nexport function createResourceServer(opts: {\n name: string;\n selfUrl: string; // e.g. URLS.rs or URLS.cal — origin only, we add /mcp\n asUrl?: string; // defaults to URLS.as — the AS whose JWKS gates /mcp\n tools: Tool[];\n port: number;\n}): Hono {\n const resource = `${opts.selfUrl}/mcp`;\n const asUrl = opts.asUrl ?? URLS.as;\n const asJwks = jose.createRemoteJWKSet(new URL(`${asUrl}/.well-known/jwks.json`));\n const prmPath = \"/.well-known/oauth-protected-resource/mcp\";\n\n const app = new Hono();\n app.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n exposeHeaders: [\"WWW-Authenticate\"],\n }));\n\n app.get(prmPath, (c) => c.json({ resource, authorization_servers: [asUrl] }));\n\n app.post(\"/mcp\", async (c) => {\n const authz = c.req.header(\"Authorization\");\n const unauthorized = (msg: string) =>\n c.json(\n { jsonrpc: \"2.0\", error: { code: -32001, message: msg }, id: null },\n 401,\n { \"WWW-Authenticate\": `Bearer resource_metadata=\"${opts.selfUrl}${prmPath}\"` },\n );\n\n if (!authz?.startsWith(\"Bearer \")) return unauthorized(\"Authentication required\");\n\n const token = authz.slice(7);\n let tokenClaims: jose.JWTPayload;\n try {\n const peek = jose.decodeJwt(token);\n if (peek.iss === OKTA_ISSUER) {\n // ID-JAG from Okta — iss check only, sig verification TODO\n tokenClaims = peek;\n } else {\n const { payload } = await jose.jwtVerify(token, asJwks, { issuer: asUrl, audience: resource });\n tokenClaims = payload;\n }\n } catch (e) {\n return unauthorized(`Invalid token: ${e instanceof Error ? e.message : e}`);\n }\n\n const msg = await c.req.json();\n if (msg.id === undefined) return c.body(null, 202); // notification\n\n try {\n return c.json({ jsonrpc: \"2.0\", id: msg.id, result: dispatch(msg, opts, tokenClaims) });\n } catch (err) {\n const error = (err && typeof err === \"object\" && \"code\" in err)\n ? err\n : { code: -32603, message: String(err) };\n return c.json({ jsonrpc: \"2.0\", id: msg.id, error });\n }\n });\n\n app.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"RS\",\n name: opts.name,\n endpoints: [\n { method: \"GET\", path: prmPath },\n { method: \"POST\", path: \"/mcp\", note: `bearer-gated; tools: ${opts.tools.map((t) => t.name).join(\", \")}` },\n ],\n })));\n\n app.onError((err) => { throw err; });\n return app;\n}\n\nfunction dispatch(msg: { method: string; params?: any }, opts: { name: string; tools: Tool[] }, claims?: jose.JWTPayload): unknown {\n switch (msg.method) {\n case \"initialize\":\n return {\n protocolVersion: msg.params?.protocolVersion ?? \"2025-06-18\",\n serverInfo: { name: opts.name, version: \"1.0.0\" },\n capabilities: { tools: { listChanged: false } },\n };\n case \"tools/list\":\n return { tools: opts.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) };\n case \"tools/call\": {\n const { name, arguments: args } = msg.params ?? {};\n const tool = opts.tools.find((t) => t.name === name);\n if (!tool) throw { code: -32602, message: `Unknown tool: ${name}` };\n return tool.handler(args ?? {}, claims);\n }\n default:\n throw { code: -32601, message: `Method not found: ${msg.method}` };\n }\n}\n",[],[162,201],[162],{"_108":209,"_99":103,"_163":210,"_165":-5,"_166":148,"_167":185,"_169":22,"_110":211,"_104":33,"_172":212,"_174":213,"_175":22,"_176":100,"_177":214,"_102":215},"b3a9bce4-18a0-11f1-a028-42dde27851f2","b3a9bdb6-18a0-11f1-a028-42dde27851f2",["D",1772721391322],"http","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Fake gmail. The point is the sub claim — prove that bob@tables.fake's\n// identity flowed Okta → as2 → here without a single consent screen.\n\nconst INBOX = [\n { id: \"m1\", from: \"aaron@okta.com\", subject: \"XAA beta access enabled for integrator-7089468\", snippet: \"Your tenant now supports token-exchange → id-jag. Try the Cross-App Access panel under Security.\" },\n { id: \"m2\", from: \"noreply@val.town\", subject: \"xaa-mcp-as2 deployed\", snippet: \"https://xaa-mcp-as2.val.run is live\" },\n { id: \"m3\", from: \"you@example.com\", subject: \"reminder: record demo before Apr 3\", snippet: \"todos → cal → gmail, zero clicks after the first Okta login\" },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-rs2\",\n selfUrl: URLS.rs2,\n asUrl: URLS.as2,\n port: 3004,\n tools: [\n {\n name: \"list_messages\",\n description: \"List inbox messages. Returns id + from + subject.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: (_args, claims) => ({\n content: [{\n type: \"text\",\n text: `Inbox for ${claims?.sub}:\\n` +\n INBOX.map((m) => ` [${m.id}] ${m.from} — ${m.subject}`).join(\"\\n\"),\n }],\n }),\n },\n {\n name: \"get_message\",\n description: \"Get one message by id.\",\n inputSchema: { type: \"object\", properties: { id: { type: \"string\" } }, required: [\"id\"] },\n handler: ({ id }) => {\n const m = INBOX.find((x) => x.id === id);\n return { content: [{ type: \"text\", text: m ? `From: ${m.from}\\nSubject: ${m.subject}\\n\\n${m.snippet}` : `No message ${id}` }] };\n },\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3004 }, app.fetch);\n",[],[103],"files",[160,179,190,199,208],"counts",{"_220":33,"_221":185,"_222":185,"_223":224,"_227":228},"pulls","branches","forks","envVars",{"_225":33,"_226":33},"count","emptyCount","connections",{"_225":33,"_229":33},"unfilledCount","contents",[],"file",{"_108":209,"_99":103,"_163":210,"_165":-5,"_166":148,"_167":185,"_169":22,"_110":234,"_104":33,"_172":212,"_174":213,"_175":22,"_176":100,"_102":235},["D",1772721391322],[103],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.code.$",{"_97":98,"_99":100,"_101":45,"_104":105,"_102":103,"_106":244,"_158":249,"_216":270,"_232":271,"_230":274,"_275":-5,"_276":-5,"_277":-5,"_278":-5,"_279":280,"_223":-5},{"_108":109,"_99":100,"_110":245,"_112":-5,"_113":22,"_114":115,"_116":-5,"_117":-5,"_14":118,"_119":-5,"_120":22,"_121":-5,"_122":-5,"_123":33,"_16":124,"_125":-5,"_126":-5,"_127":-5,"_128":129,"_130":129,"_131":132,"_133":132,"_134":132,"_135":129,"_136":129,"_23":246,"_140":247,"_145":248,"_157":22},["D",1772721390899],{"_97":98,"_138":139},{"_97":98,"_142":139,"_14":118,"_143":144},{"_104":147,"_99":45,"_108":148,"_149":109,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":100,"_156":98},[250,266],{"_108":161,"_99":162,"_163":164,"_165":-5,"_166":148,"_167":168,"_169":170,"_110":251,"_104":33,"_172":173,"_174":-5,"_175":22,"_176":-5,"_177":252,"_102":265},["D",1772721391623],[253,257,261],{"_108":180,"_99":181,"_163":182,"_165":164,"_166":148,"_167":183,"_169":170,"_110":254,"_104":185,"_172":186,"_174":187,"_175":22,"_176":-5,"_177":255,"_102":256},["D",1774989052695],[],[162,181],{"_108":191,"_99":192,"_163":193,"_165":164,"_166":148,"_167":194,"_169":170,"_110":258,"_104":33,"_172":186,"_174":196,"_175":22,"_176":-5,"_177":259,"_102":260},["D",1772721391937],[],[162,192],{"_108":200,"_99":201,"_163":202,"_165":164,"_166":148,"_167":105,"_169":170,"_110":262,"_104":185,"_172":186,"_174":204,"_175":22,"_176":-5,"_177":263,"_102":264},["D",1774989052929],[],[162,201],[162],{"_108":209,"_99":103,"_163":210,"_165":-5,"_166":148,"_167":185,"_169":22,"_110":267,"_104":33,"_172":212,"_174":213,"_175":22,"_176":100,"_177":268,"_102":269},["D",1772721391322],[],[103],[250,253,257,261,266],{"_108":209,"_99":103,"_163":210,"_165":-5,"_166":148,"_167":185,"_169":22,"_110":272,"_104":33,"_172":212,"_174":213,"_175":22,"_176":100,"_102":273},["D",1772721391322],[103],[],"upstream","pull","ahead","behind","templates",[],"actionData","errors"]

pcarleton

xaa-mcp-rs2