${opts.name}

\n${rows}\n

`;\n}\n",[],[163,191],{"_106":198,"_99":199,"_164":200,"_166":165,"_167":146,"_168":201,"_170":171,"_108":202,"_103":169,"_173":185,"_175":203,"_176":22,"_177":-5,"_178":204,"_102":205},"ea445f46-2edc-11f1-a3db-42dde27851f2","mcp-rs.ts","019d4b7b-c9ea-74af-ac0c-818ed984f178",5,["D",1775166178314],"/**\n * Shared MCP resource-server scaffolding. A tiny Hono app with:\n * - RFC 9728 PRM at /.well-known/oauth-protected-resource/mcp\n * - /mcp gated by AS-issued JWT bearer (aud-bound to this resource)\n * - stateless JSON-RPC dispatch (initialize, tools/list, tools/call)\n *\n * Skips the SDK transport + fetch-to-node — see rs/rs.ts history for why.\n */\n\nimport { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { OKTA_ISSUER, URLS } from \"./config.ts\";\nimport { indexPage } from \"./html.ts\";\n\nexport interface Tool {\n name: string;\n description: string;\n inputSchema: Record;\n handler: (\n args: Record,\n claims?: jose.JWTPayload,\n ) => { content: { type: \"text\"; text: string }[] };\n}\n\nexport function createResourceServer(opts: {\n name: string;\n selfUrl: string; // e.g. URLS.rs or URLS.cal — origin only, we add /mcp\n asUrl?: string; // defaults to URLS.as — the AS whose JWKS gates /mcp\n tools: Tool[];\n port: number;\n}): Hono {\n const resource = `${opts.selfUrl}/mcp`;\n const asUrl = opts.asUrl ?? URLS.as;\n const asJwks = jose.createRemoteJWKSet(\n new URL(`${asUrl}/.well-known/jwks.json`),\n );\n const prmPath = \"/.well-known/oauth-protected-resource/mcp\";\n\n const app = new Hono();\n app.use(\n \"*\",\n cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n exposeHeaders: [\"WWW-Authenticate\"],\n }),\n );\n\n app.get(prmPath, (c) => c.json({ resource, authorization_servers: [asUrl] }));\n\n app.post(\"/mcp\", async (c) => {\n const authz = c.req.header(\"Authorization\");\n const unauthorized = (msg: string) =>\n c.json(\n { jsonrpc: \"2.0\", error: { code: -32001, message: msg }, id: null },\n 401,\n {\n \"WWW-Authenticate\":\n `Bearer resource_metadata=\"${opts.selfUrl}${prmPath}\"`,\n },\n );\n\n if (!authz?.startsWith(\"Bearer \")) {\n return unauthorized(\"Authentication required\");\n }\n\n const token = authz.slice(7);\n let tokenClaims: jose.JWTPayload;\n try {\n const peek = jose.decodeJwt(token);\n if (peek.iss === OKTA_ISSUER) {\n // ID-JAG from Okta — iss check only, sig verification TODO\n tokenClaims = peek;\n } else {\n const { payload } = await jose.jwtVerify(token, asJwks, {\n issuer: asUrl,\n audience: resource,\n });\n tokenClaims = payload;\n }\n } catch (e) {\n return unauthorized(\n `Invalid token: ${e instanceof Error ? e.message : e}`,\n );\n }\n\n const msg = await c.req.json();\n if (msg.id === undefined) return c.body(null, 202); // notification\n\n try {\n return c.json({\n jsonrpc: \"2.0\",\n id: msg.id,\n result: dispatch(msg, opts, tokenClaims),\n });\n } catch (err) {\n const error = (err && typeof err === \"object\" && \"code\" in err)\n ? err\n : { code: -32603, message: String(err) };\n return c.json({ jsonrpc: \"2.0\", id: msg.id, error });\n }\n });\n\n app.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"RS\",\n name: opts.name,\n endpoints: [\n { method: \"GET\", path: prmPath },\n {\n method: \"POST\",\n path: \"/mcp\",\n note: `bearer-gated; tools: ${\n opts.tools.map((t) => t.name).join(\", \")\n }`,\n },\n ],\n })));\n\n app.onError((err) => {\n throw err;\n });\n return app;\n}\n\nfunction dispatch(\n msg: { method: string; params?: any },\n opts: { name: string; tools: Tool[] },\n claims?: jose.JWTPayload,\n): unknown {\n switch (msg.method) {\n case \"initialize\":\n return {\n protocolVersion: msg.params?.protocolVersion ?? \"2025-06-18\",\n serverInfo: { name: opts.name, version: \"1.0.0\" },\n capabilities: { tools: { listChanged: false } },\n };\n case \"tools/list\":\n return {\n tools: opts.tools.map(({ name, description, inputSchema }) => ({\n name,\n description,\n inputSchema,\n })),\n };\n case \"tools/call\": {\n const { name, arguments: args } = msg.params ?? {};\n const tool = opts.tools.find((t) => t.name === name);\n if (!tool) throw { code: -32602, message: `Unknown tool: ${name}` };\n return tool.handler(args ?? {}, claims);\n }\n default:\n throw { code: -32601, message: `Method not found: ${msg.method}` };\n }\n}",[],[163,199],[163],{"_106":208,"_99":209,"_164":210,"_166":-5,"_167":146,"_168":145,"_170":171,"_108":211,"_103":212,"_173":213,"_175":214,"_176":22,"_177":100,"_178":215,"_102":216},"7929b274-2edd-11f1-bc52-42dde27851f2","http.ts","019d4b7b-c9ea-74af-ac0c-8979a9180e7b",["D",1775166418044],10,"http","import { createResourceServer } from \"./shared/mcp-rs.ts\";\nimport { URLS } from \"./shared/config.ts\";\n\n// Fake gmail. The point is the sub claim — prove that bob@tables.fake's\n// identity flowed Okta → as2 → here without a single consent screen.\n\nconst INBOX = [\n {\n id: \"t1\",\n from: \"aaron@okta.com\",\n subject: \"XAA beta access enabled for integrator-7089468\",\n snippet:\n \"Your tenant now supports token-exchange → id-jag. Try the Cross-App Access panel under Security.\",\n },\n {\n id: \"t2\",\n from: \"noreply@val.town\",\n subject: \"xaa-mcp-as2 deployed\",\n snippet: \"https://xaa-mcp-as2.val.run is live\",\n },\n {\n id: \"t3\",\n from: \"you@example.com\",\n subject: \"reminder: record demo before Apr 3\",\n snippet:\n \"todos → cal → gmail, zero clicks after the first Okta login. XAA means Cross-App Access\",\n },\n];\n\nconst app = createResourceServer({\n name: \"xaa-mcp-rs3\",\n selfUrl: \"https://xaa-mcp-rs3.val.run\",\n // asUrl: \"https://xaa-mcp-as2.val.run/\",\n asUrl: URLS.as2,\n port: 3004,\n tools: [\n {\n name: \"list_tasks\",\n description: \"List inbox messages. Returns id + from + subject.\",\n inputSchema: { type: \"object\", properties: {} },\n handler: (_args, claims) => ({\n content: [{\n type: \"text\",\n text: `Inbox for ${claims?.sub}:\\n` +\n INBOX.map((m) => ` [${m.id}] ${m.from} — ${m.subject}`).join(\"\\n\"),\n }],\n }),\n },\n {\n name: \"get_message\",\n description: \"Get one message by id.\",\n inputSchema: {\n type: \"object\",\n properties: { id: { type: \"string\" } },\n required: [\"id\"],\n },\n handler: ({ id }) => {\n const m = INBOX.find((x) => x.id === id);\n return {\n content: [{\n type: \"text\",\n text: m\n ? `From: ${m.from}\\nSubject: ${m.subject}\\n\\n${m.snippet}`\n : `No message ${id}`,\n }],\n };\n },\n },\n ],\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3004 }, app.fetch);",[],[209],"files",[161,180,189,197,207],"counts",{"_221":33,"_222":169,"_223":33,"_224":225,"_228":229},"pulls","branches","forks","envVars",{"_226":33,"_227":33},"count","emptyCount","connections",{"_226":33,"_230":33},"unfilledCount","contents",[233,236],{"_106":162,"_99":163,"_164":165,"_166":-5,"_167":146,"_168":169,"_170":171,"_108":234,"_103":33,"_173":174,"_175":-5,"_176":22,"_177":-5,"_102":235},["D",1775087897007],[163],{"_106":208,"_99":209,"_164":210,"_166":-5,"_167":146,"_168":145,"_170":171,"_108":237,"_103":212,"_173":213,"_175":214,"_176":22,"_177":100,"_102":238},["D",1775166418044],[209],"file","upstreamProject",{"_106":154,"_99":242,"_114":-5,"_115":-5,"_112":113,"_23":243},"xaa-mcp-rs2",{"_97":98,"_136":137},"upstreamBranch",{"_106":149,"_108":246,"_247":248,"_99":45,"_147":154,"_103":151,"_148":-5,"_150":-5,"_249":250,"_110":-5,"_158":22,"_112":113,"_157":98,"_16":122,"_156":242},["D",1772721390899],"updatedAt",["D",1775086279675],"lockfileKey","1775086973981-esm.town_v_pcarleton_xaa-mcp-rs2@7-main","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.remixes",{"_97":98,"_99":100,"_104":257,"_223":262,"_263":22,"_264":33,"_265":33,"_266":267},{"_106":107,"_99":100,"_108":258,"_110":-5,"_111":22,"_112":113,"_114":-5,"_115":-5,"_14":116,"_117":-5,"_118":22,"_119":-5,"_120":-5,"_121":33,"_16":122,"_123":-5,"_124":-5,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_23":259,"_138":260,"_143":261,"_158":22},["D",1775087897007],{"_97":98,"_136":137},{"_97":98,"_140":137,"_14":116,"_141":142},{"_103":145,"_99":45,"_106":146,"_147":107,"_148":149,"_150":151,"_152":113,"_153":154,"_155":122,"_156":100,"_157":98},[],"hasNext","page","forkCount","upstream",{"_106":154,"_99":242,"_114":-5,"_115":-5,"_112":113,"_23":268},{"_97":98,"_136":137},"actionData","errors"]