[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_203":204,"_205":206},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_105":84,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":118,"_119":120,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","http.ts","latestPath","fileId","019d4b7b-c9ea-74af-ac0c-8979a9180e7b","name","fileType","http","content","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Fake gmail. The point is the sub claim — prove that bob@tables.fake's\n// identity flowed Okta → as2 → here without a single consent screen.\n\nconst INBOX = [\n {\n id: \"m1\",\n from: \"aaron@okta.com\",\n subject: \"XAA beta access enabled for integrator-7089468\",\n snippet:\n \"Your tenant now supports token-exchange → id-jag. Try the Cross-App Access panel under Security.\",\n },\n {\n id: \"m2\",\n from: \"noreply@val.town\",\n subject: \"xaa-mcp-as2 deployed\",\n snippet: \"https://xaa-mcp-as2.val.run is live\",\n },\n {\n id: \"m3\",\n from: \"you@example.com\",\n subject: \"reminder: record demo before Apr 3\",\n snippet: \"todos → cal → gmail, zero clicks after the first Okta login\",\n },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-rs3\",\n selfUrl: \"https://xaa-mcp-rs3.val.run\",\n // asUrl: \"https://xaa-mcp-as2.val.run/\",\n asUrl: URLS.as2,\n port: 3004,\n tools: [\n {\n name: \"list_messages\",\n description: \"List inbox messages. Returns id + from + subject.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: (_args, claims) => ({\n content: [{\n type: \"text\",\n text: `Inbox for ${claims?.sub}:\\n` +\n INBOX.map((m) => ` [${m.id}] ${m.from} — ${m.subject}`).join(\"\\n\"),\n }],\n }),\n },\n {\n name: \"get_message\",\n description: \"Get one message by id.\",\n inputSchema: {\n type: \"object\",\n properties: { id: { type: \"string\" } },\n required: [\"id\"],\n },\n handler: ({ id }) => {\n const m = INBOX.find((x) => x.id === id);\n return {\n content: [{\n type: \"text\",\n text: m\n ? `From: ${m.from}\\nSubject: ${m.subject}\\n\\n${m.snippet}`\n : `No message ${id}`,\n }],\n };\n },\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3004 }, app.fetch);","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Fake gmail. The point is the sub claim — prove that bob@tables.fake's\n// identity flowed Okta → as2 → here without a single consent screen.\n\nconst INBOX = [\n {\n id: \"m1\",\n from: \"aaron@okta.com\",\n subject: \"XAA beta access enabled for integrator-7089468\",\n snippet:\n \"Your tenant now supports token-exchange → id-jag. Try the Cross-App Access panel under Security.\",\n },\n {\n id: \"m2\",\n from: \"noreply@val.town\",\n subject: \"xaa-mcp-as2 deployed\",\n snippet: \"https://xaa-mcp-as2.val.run is live\",\n },\n {\n id: \"m3\",\n from: \"you@example.com\",\n subject: \"reminder: record demo before Apr 3\",\n snippet: \"todos → cal → gmail, zero clicks after the first Okta login\",\n },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-rs3\",\n selfUrl: \"https://xaa-mcp-rs3.val.run/\",\n // asUrl: \"https://xaa-mcp-as2.val.run/\",\n asUrl: URLS.as2,\n port: 3004,\n tools: [\n {\n name: \"list_messages\",\n description: \"List inbox messages. Returns id + from + subject.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: (_args, claims) => ({\n content: [{\n type: \"text\",\n text: `Inbox for ${claims?.sub}:\\n` +\n INBOX.map((m) => ` [${m.id}] ${m.from} — ${m.subject}`).join(\"\\n\"),\n }],\n }),\n },\n {\n name: \"get_message\",\n description: \"Get one message by id.\",\n inputSchema: {\n type: \"object\",\n properties: { id: { type: \"string\" } },\n required: [\"id\"],\n },\n handler: ({ id }) => {\n const m = INBOX.find((x) => x.id === id);\n return {\n content: [{\n type: \"text\",\n text: m\n ? `From: ${m.from}\\nSubject: ${m.subject}\\n\\n${m.snippet}`\n : `No message ${id}`,\n }],\n };\n },\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3004 }, app.fetch);","createdAt",["D",1775166242015],"branchVersion","branchId","a6feaf40-2e26-11f1-b865-42dde27851f2","id","a6f9b3f0-2e26-11f1-b865-42dde27851f2","xaa-mcp-rs3",["D",1775087897007],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":100},"org",{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},"branch",{"_13":83,"_32":84,"_43":42,"_85":44,"_86":87,"_88":89,"_90":50,"_91":92,"_93":62,"_94":45,"_95":96},"isOwned",12,"main","projectId","forkedBranchId","b36964aa-18a0-11f1-bc84-42dde27851f2","forkedBranchVersion",7,"forkedProjectPrivacy","forkedProjectId","b3690820-18a0-11f1-bc84-42dde27851f2","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":199,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":200,"_78":201,"_80":202,"_82":25},"tree",[164,168],"files",[164,165,166,167,168],"counts",{"_154":60,"_155":150,"_156":60,"_157":158,"_159":160},"contents",[138,139],"upstreamProject",{"_43":92,"_32":136,"_52":-5,"_53":-5,"_49":50,"_76":137},"upstreamBranch",{"_43":87,"_38":130,"_131":132,"_32":84,"_85":92,"_13":133,"_86":-5,"_88":-5,"_134":135,"_47":-5,"_82":25,"_49":50,"_95":96,"_61":62,"_94":136},"emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},["D",1772721390899],"updatedAt",["D",1775845333565],9,"lockfileKey","1775845344377-esm.town_v_pcarleton_xaa-mcp-rs2@9-main","xaa-mcp-rs2",{"_97":96,"_104":100},{"_43":147,"_32":148,"_30":149,"_141":-5,"_41":42,"_40":150,"_142":125,"_38":151,"_13":60,"_33":152,"_35":-5,"_24":25,"_145":-5,"_27":153},{"_43":140,"_32":28,"_30":31,"_141":-5,"_41":42,"_40":14,"_142":25,"_38":143,"_13":144,"_33":34,"_35":37,"_24":25,"_145":45,"_27":146},"104097aa-2edd-11f1-ad80-42dde27851f2","parentId","latest",["D",1775166242015],6,"label",[28],"a70336be-2e26-11f1-b865-42dde27851f2","shared","019d4b7b-c9ea-74af-ac0c-859008f0fb06",1,["D",1775087897007],"directory",[148],"pulls","branches","forks","envVars",{"_161":60,"_163":60},"connections",{"_161":60,"_162":60},"count","unfilledCount","emptyCount",{"_43":147,"_32":148,"_30":149,"_141":-5,"_41":42,"_40":150,"_142":125,"_38":196,"_13":60,"_33":152,"_35":-5,"_24":25,"_145":-5,"_170":197,"_27":198},{"_43":189,"_32":190,"_30":191,"_141":149,"_41":42,"_40":150,"_142":125,"_38":192,"_13":60,"_33":178,"_35":193,"_24":25,"_145":-5,"_170":194,"_27":195},{"_43":182,"_32":183,"_30":184,"_141":149,"_41":42,"_40":150,"_142":125,"_38":185,"_13":60,"_33":178,"_35":186,"_24":25,"_145":-5,"_170":187,"_27":188},{"_43":173,"_32":174,"_30":175,"_141":149,"_41":42,"_40":176,"_142":125,"_38":177,"_13":150,"_33":178,"_35":179,"_24":25,"_145":-5,"_170":180,"_27":181},{"_43":140,"_32":28,"_30":31,"_141":-5,"_41":42,"_40":14,"_142":25,"_38":169,"_13":144,"_33":34,"_35":37,"_24":25,"_145":45,"_170":171,"_27":172},["D",1775166242015],"children",[],[28],"ea445f46-2edc-11f1-a3db-42dde27851f2","mcp-rs.ts","019d4b7b-c9ea-74af-ac0c-818ed984f178",5,["D",1775166178314],"script","/**\n * Shared MCP resource-server scaffolding. A tiny Hono app with:\n * - RFC 9728 PRM at /.well-known/oauth-protected-resource/mcp\n * - /mcp gated by AS-issued JWT bearer (aud-bound to this resource)\n * - stateless JSON-RPC dispatch (initialize, tools/list, tools/call)\n *\n * Skips the SDK transport + fetch-to-node — see rs/rs.ts history for why.\n */\n\nimport { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { OKTA_ISSUER, URLS } from \"./config.ts\";\nimport { indexPage } from \"./html.ts\";\n\nexport interface Tool {\n name: string;\n description: string;\n inputSchema: Record;\n handler: (\n args: Record,\n claims?: jose.JWTPayload,\n ) => { content: { type: \"text\"; text: string }[] };\n}\n\nexport function createResourceServer(opts: {\n name: string;\n selfUrl: string; // e.g. URLS.rs or URLS.cal — origin only, we add /mcp\n asUrl?: string; // defaults to URLS.as — the AS whose JWKS gates /mcp\n tools: Tool[];\n port: number;\n}): Hono {\n const resource = `${opts.selfUrl}/mcp`;\n const asUrl = opts.asUrl ?? URLS.as;\n const asJwks = jose.createRemoteJWKSet(\n new URL(`${asUrl}/.well-known/jwks.json`),\n );\n const prmPath = \"/.well-known/oauth-protected-resource/mcp\";\n\n const app = new Hono();\n app.use(\n \"*\",\n cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n exposeHeaders: [\"WWW-Authenticate\"],\n }),\n );\n\n app.get(prmPath, (c) => c.json({ resource, authorization_servers: [asUrl] }));\n\n app.post(\"/mcp\", async (c) => {\n const authz = c.req.header(\"Authorization\");\n const unauthorized = (msg: string) =>\n c.json(\n { jsonrpc: \"2.0\", error: { code: -32001, message: msg }, id: null },\n 401,\n {\n \"WWW-Authenticate\":\n `Bearer resource_metadata=\"${opts.selfUrl}${prmPath}\"`,\n },\n );\n\n if (!authz?.startsWith(\"Bearer \")) {\n return unauthorized(\"Authentication required\");\n }\n\n const token = authz.slice(7);\n let tokenClaims: jose.JWTPayload;\n try {\n const peek = jose.decodeJwt(token);\n if (peek.iss === OKTA_ISSUER) {\n // ID-JAG from Okta — iss check only, sig verification TODO\n tokenClaims = peek;\n } else {\n const { payload } = await jose.jwtVerify(token, asJwks, {\n issuer: asUrl,\n audience: resource,\n });\n tokenClaims = payload;\n }\n } catch (e) {\n return unauthorized(\n `Invalid token: ${e instanceof Error ? e.message : e}`,\n );\n }\n\n const msg = await c.req.json();\n if (msg.id === undefined) return c.body(null, 202); // notification\n\n try {\n return c.json({\n jsonrpc: \"2.0\",\n id: msg.id,\n result: dispatch(msg, opts, tokenClaims),\n });\n } catch (err) {\n const error = (err && typeof err === \"object\" && \"code\" in err)\n ? err\n : { code: -32603, message: String(err) };\n return c.json({ jsonrpc: \"2.0\", id: msg.id, error });\n }\n });\n\n app.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"RS\",\n name: opts.name,\n endpoints: [\n { method: \"GET\", path: prmPath },\n {\n method: \"POST\",\n path: \"/mcp\",\n note: `bearer-gated; tools: ${\n opts.tools.map((t) => t.name).join(\", \")\n }`,\n },\n ],\n })));\n\n app.onError((err) => {\n throw err;\n });\n return app;\n}\n\nfunction dispatch(\n msg: { method: string; params?: any },\n opts: { name: string; tools: Tool[] },\n claims?: jose.JWTPayload,\n): unknown {\n switch (msg.method) {\n case \"initialize\":\n return {\n protocolVersion: msg.params?.protocolVersion ?? \"2025-06-18\",\n serverInfo: { name: opts.name, version: \"1.0.0\" },\n capabilities: { tools: { listChanged: false } },\n };\n case \"tools/list\":\n return {\n tools: opts.tools.map(({ name, description, inputSchema }) => ({\n name,\n description,\n inputSchema,\n })),\n };\n case \"tools/call\": {\n const { name, arguments: args } = msg.params ?? {};\n const tool = opts.tools.find((t) => t.name === name);\n if (!tool) throw { code: -32602, message: `Unknown tool: ${name}` };\n return tool.handler(args ?? {}, claims);\n }\n default:\n throw { code: -32601, message: `Method not found: ${msg.method}` };\n }\n}",[],[148,174],"a7031558-2e26-11f1-b865-42dde27851f2","html.ts","019d4b7b-c9ea-74af-ac0c-7cd14dd50b40",["D",1775087897007],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[148,183],"a70306a8-2e26-11f1-b865-42dde27851f2","config.ts","019d4b7b-c9ea-74af-ac0c-7bf96265e6cb",["D",1775087897007],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[148,190],["D",1775087897007],[165,166,167],[148],["D",1775087897007],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},{"_13":83,"_32":84,"_43":42,"_85":44,"_86":87,"_88":89,"_90":50,"_91":92,"_93":62,"_94":45,"_95":96},"ctx",{"_76":-5,"_127":236,"_237":238,"_239":240,"_241":25,"_242":25,"_243":25,"_244":125,"_245":-5,"_246":-7,"_247":-7,"_248":60,"_249":25,"_250":25,"_251":-5,"_252":25,"_253":25,"_254":25,"_255":-5},"ENV",{"_207":208,"_209":210,"_211":84,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8