[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_103":85,"_27":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":58,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","acd8b71c-831c-11f1-a42c-1607ee4eb77e","name","fileType","http","content","// Captivate Podcast API — Remote MCP Server (JSON-RPC 2.0 over HTTP)\n\nconst CAPTIVATE_BASE = \"https://api.captivate.fm\";\n\n// ---------------------------------------------------------------------------\n// CORS — applied to EVERY response from this val\n// ---------------------------------------------------------------------------\n\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n};\n\n// Module-level bearer token cache\nlet cachedToken: string | null = null;\nlet tokenExpiry = 0;\n\nasync function getToken(): Promise {\n const now = Date.now();\n if (cachedToken && now < tokenExpiry) {\n return cachedToken;\n }\n\n const userId = Deno.env.get(\"CAPTIVATE_USER_ID\");\n const apiToken = Deno.env.get(\"CAPTIVATE_API_TOKEN\");\n\n if (!userId || !apiToken) {\n throw new Error(\n \"Missing CAPTIVATE_USER_ID or CAPTIVATE_API_TOKEN environment variables\",\n );\n }\n\n const form = new URLSearchParams();\n form.set(\"username\", userId);\n form.set(\"token\", apiToken);\n\n const res = await fetch(`${CAPTIVATE_BASE}/authenticate/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: form.toString(),\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new Error(`Captivate auth failed (${res.status}): ${text}`);\n }\n\n const data = await res.json();\n const token = data?.data?.user?.token ?? data?.token ?? data?.data?.token;\n\n if (!token) {\n throw new Error(\"Captivate auth response did not include a token\");\n }\n\n cachedToken = token;\n // Cache for 50 minutes\n tokenExpiry = now + 50 * 60 * 1000;\n return token;\n}\n\nasync function captivateGet(path: string): Promise {\n const token = await getToken();\n const res = await fetch(`${CAPTIVATE_BASE}${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new Error(`Captivate API error (${res.status}): ${text}`);\n }\n\n return await res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nconst TOOLS = [\n {\n name: \"list_my_shows\",\n description: \"List all shows the user manages\",\n inputSchema: {\n type: \"object\",\n properties: {},\n },\n },\n {\n name: \"get_show\",\n description: \"Get details for a specific show\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_show_episodes\",\n description: \"List episodes for a show with optional pagination offset\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n offset: {\n type: \"number\",\n description: \"Pagination offset (default 0)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_episode\",\n description: \"Get details for a specific episode\",\n inputSchema: {\n type: \"object\",\n properties: {\n episode_id: { type: \"string\", description: \"The episode ID\" },\n },\n required: [\"episode_id\"],\n },\n },\n {\n name: \"get_show_feed_url\",\n description: \"Get the RSS feed URL for a show\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_podcast_overview_analytics\",\n description:\n \"Get overview analytics for a podcast show, optionally filtered by date range\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n start: {\n type: \"string\",\n description: \"Start date (optional, e.g. YYYY-MM-DD)\",\n },\n end: {\n type: \"string\",\n description: \"End date (optional, e.g. YYYY-MM-DD)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_episode_overview_analytics\",\n description:\n \"Get overview analytics for a specific episode, optionally filtered by date range\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n episode_id: { type: \"string\", description: \"The episode ID\" },\n start: {\n type: \"string\",\n description: \"Start date (optional, e.g. YYYY-MM-DD)\",\n },\n end: {\n type: \"string\",\n description: \"End date (optional, e.g. YYYY-MM-DD)\",\n },\n },\n required: [\"show_id\", \"episode_id\"],\n },\n },\n {\n name: \"get_podcast_average_analytics\",\n description:\n \"Get average analytics for a podcast show over a given interval\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n intervalDays: {\n type: \"number\",\n description: \"Number of days for the averaging interval (default 28)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n];\n\n// ---------------------------------------------------------------------------\n// Tool dispatcher\n// ---------------------------------------------------------------------------\n\nasync function callTool(name: string, args: Record): Promise {\n const userId = Deno.env.get(\"CAPTIVATE_USER_ID\");\n\n switch (name) {\n case \"list_my_shows\":\n return captivateGet(`/users/${userId}/shows/manager`);\n\n case \"get_show\":\n return captivateGet(`/shows/${args.show_id}`);\n\n case \"get_show_episodes\":\n return captivateGet(\n `/shows/${args.show_id}/episodes?offset=${args.offset ?? 0}`,\n );\n\n case \"get_episode\":\n return captivateGet(`/episodes/${args.episode_id}`);\n\n case \"get_show_feed_url\":\n return captivateGet(`/shows/${args.show_id}/feed`);\n\n case \"get_podcast_overview_analytics\": {\n const params = new URLSearchParams();\n if (args.start) params.set(\"start\", args.start);\n if (args.end) params.set(\"end\", args.end);\n params.set(\"includeTopEpisodes\", \"true\");\n const qs = params.toString();\n return captivateGet(`/insights/${args.show_id}/overview${qs ? `?${qs}` : \"\"}`);\n }\n\n case \"get_episode_overview_analytics\": {\n const params = new URLSearchParams();\n if (args.start) params.set(\"start\", args.start);\n if (args.end) params.set(\"end\", args.end);\n const qs = params.toString();\n return captivateGet(\n `/insights/${args.show_id}/overview/${args.episode_id}${qs ? `?${qs}` : \"\"}`,\n );\n }\n\n case \"get_podcast_average_analytics\":\n return captivateGet(\n `/insights/${args.show_id}/averages?intervalDays=${args.intervalDays ?? 28}`,\n );\n\n default:\n throw new Error(`Unknown tool: ${name}`);\n }\n}\n\n// ---------------------------------------------------------------------------\n// JSON-RPC helpers (all include CORS_HEADERS)\n// ---------------------------------------------------------------------------\n\nfunction jsonrpcResponse(id: any, result: any): Response {\n return new Response(JSON.stringify({ jsonrpc: \"2.0\", id, result }), {\n status: 200,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}\n\nfunction jsonrpcError(\n id: any,\n code: number,\n message: string,\n status = 400,\n): Response {\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n error: { code, message },\n }),\n {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n },\n );\n}\n\n// ---------------------------------------------------------------------------\n// OAuth 2.1 shim — no-login, satisfies Claude's remote connector flow\n// ---------------------------------------------------------------------------\n\nfunction randomString(len = 32): string {\n const bytes = new Uint8Array(len);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction oauthMetadata(origin: string) {\n return {\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n scopes_supported: [\"mcp\"],\n };\n}\n\nasync function handleOAuth(req: Request, url: URL): Promise {\n const origin = url.origin;\n\n // OAuth Authorization Server metadata (RFC 8414)\n if (\n req.method === \"GET\" &&\n url.pathname === \"/.well-known/oauth-authorization-server\"\n ) {\n return new Response(JSON.stringify(oauthMetadata(origin)), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n });\n }\n\n // OAuth Protected Resource metadata (RFC 9728)\n if (\n req.method === \"GET\" &&\n url.pathname === \"/.well-known/oauth-protected-resource\"\n ) {\n return new Response(\n JSON.stringify({\n resource: origin,\n authorization_servers: [origin],\n bearer_methods_supported: [\"header\"],\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n // Dynamic client registration\n if (req.method === \"POST\" && url.pathname === \"/register\") {\n let body: any = {};\n try {\n body = await req.json();\n } catch {\n // ignore parse errors\n }\n return new Response(\n JSON.stringify({\n client_id: randomString(16),\n client_name: body.client_name ?? \"mcp-client\",\n redirect_uris: body.redirect_uris ?? [],\n client_id_issued_at: Math.floor(Date.now() / 1000),\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n // Authorization endpoint — auto-approve, no login form\n if (req.method === \"GET\" && url.pathname === \"/authorize\") {\n const redirectUri = url.searchParams.get(\"redirect_uri\");\n const state = url.searchParams.get(\"state\");\n if (!redirectUri) {\n return new Response(\"Missing redirect_uri\", {\n status: 400,\n headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS },\n });\n }\n const code = randomString(16);\n const params = new URLSearchParams({ code });\n if (state) params.set(\"state\", state);\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n return new Response(null, {\n status: 302,\n headers: { Location: `${redirectUri}${sep}${params.toString()}`, ...CORS_HEADERS },\n });\n }\n\n // Token endpoint — issue token without validation, parse both form & JSON\n if (req.method === \"POST\" && url.pathname === \"/token\") {\n const contentType = req.headers.get(\"Content-Type\") ?? \"\";\n\n if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n const form = await req.formData();\n const grantType = form.get(\"grant_type\") as string;\n // We accept any grant_type — no validation needed\n void grantType;\n } else {\n // Try JSON; if it fails, ignore — we issue a token regardless\n try {\n const json = await req.json();\n void json;\n } catch {\n // Body is empty or unparseable — still return a token\n }\n }\n\n return new Response(\n JSON.stringify({\n access_token: randomString(32),\n token_type: \"bearer\",\n expires_in: 3600,\n refresh_token: randomString(32),\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n return null;\n}\n\n// ---------------------------------------------------------------------------\n// Main handler\n// ---------------------------------------------------------------------------\n\nexport default async (req: Request): Promise => {\n const url = new URL(req.url);\n\n // CORS preflight — applies to ALL routes (OAuth + MCP)\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n }\n\n // OAuth 2.1 shim routes\n const oauthResponse = await handleOAuth(req, url);\n if (oauthResponse) return oauthResponse;\n\n // Non-POST info response\n if (req.method !== \"POST\") {\n return new Response(\"Captivate MCP Server — send JSON-RPC 2.0 POST requests.\", {\n status: 200,\n headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS },\n });\n }\n\n // MCP Authorization spec: if the POST to root has no Authorization header,\n // respond with 401 + WWW-Authenticate to trigger OAuth discovery flow\n if (!req.headers.get(\"Authorization\")) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 401,\n headers: {\n \"Content-Type\": \"application/json\",\n \"WWW-Authenticate\": `Bearer resource_metadata=\"${url.origin}/.well-known/oauth-protected-resource\"`,\n ...CORS_HEADERS,\n },\n });\n }\n\n // Parse JSON-RPC body\n let body: any;\n try {\n body = await req.json();\n } catch {\n return jsonrpcError(null, -32700, \"Parse error\");\n }\n\n const { id, method, params } = body;\n\n // notifications/initialized — return 202 empty\n if (method === \"notifications/initialized\") {\n return new Response(null, { status: 202, headers: CORS_HEADERS });\n }\n\n switch (method) {\n case \"initialize\":\n return jsonrpcResponse(id, {\n protocolVersion: \"2024-11-05\",\n capabilities: { tools: {} },\n serverInfo: { name: \"captivate-mcp\", version: \"1.0.0\" },\n });\n\n case \"tools/list\":\n return jsonrpcResponse(id, { tools: TOOLS });\n\n case \"tools/call\": {\n const { name, arguments: toolArgs } = params ?? {};\n try {\n const result = await callTool(name, toolArgs ?? {});\n return jsonrpcResponse(id, {\n content: [\n { type: \"text\", text: JSON.stringify(result, null, 2) },\n ],\n });\n } catch (err) {\n return jsonrpcResponse(id, {\n isError: true,\n content: [\n {\n type: \"text\",\n text: err instanceof Error ? err.message : String(err),\n },\n ],\n });\n }\n }\n\n default:\n return jsonrpcError(id, -32601, `Method not found: ${method}`);\n }\n};\n","// Captivate Podcast API — Remote MCP Server (JSON-RPC 2.0 over HTTP)\n\nconst CAPTIVATE_BASE = \"https://api.captivate.fm\";\n\n// ---------------------------------------------------------------------------\n// CORS — applied to EVERY response from this val\n// ---------------------------------------------------------------------------\n\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n};\n\n// Module-level bearer token cache\nlet cachedToken: string | null = null;\nlet tokenExpiry = 0;\n\nasync function getToken(): Promise {\n const now = Date.now();\n if (cachedToken && now < tokenExpiry) {\n return cachedToken;\n }\n\n const userId = Deno.env.get(\"CAPTIVATE_USER_ID\");\n const apiToken = Deno.env.get(\"CAPTIVATE_API_TOKEN\");\n\n if (!userId || !apiToken) {\n throw new Error(\n \"Missing CAPTIVATE_USER_ID or CAPTIVATE_API_TOKEN environment variables\",\n );\n }\n\n const form = new URLSearchParams();\n form.set(\"username\", userId);\n form.set(\"token\", apiToken);\n\n const res = await fetch(`${CAPTIVATE_BASE}/authenticate/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: form.toString(),\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new Error(`Captivate auth failed (${res.status}): ${text}`);\n }\n\n const data = await res.json();\n const token = data?.data?.user?.token ?? data?.token ?? data?.data?.token;\n\n if (!token) {\n throw new Error(\"Captivate auth response did not include a token\");\n }\n\n cachedToken = token;\n // Cache for 50 minutes\n tokenExpiry = now + 50 * 60 * 1000;\n return token;\n}\n\nasync function captivateGet(path: string): Promise {\n const token = await getToken();\n const res = await fetch(`${CAPTIVATE_BASE}${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new Error(`Captivate API error (${res.status}): ${text}`);\n }\n\n return await res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Tool definitions\n// ---------------------------------------------------------------------------\n\nconst TOOLS = [\n {\n name: \"list_my_shows\",\n description: \"List all shows the user manages\",\n inputSchema: {\n type: \"object\",\n properties: {},\n },\n },\n {\n name: \"get_show\",\n description: \"Get details for a specific show\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_show_episodes\",\n description: \"List episodes for a show with optional pagination offset\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n offset: {\n type: \"number\",\n description: \"Pagination offset (default 0)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_episode\",\n description: \"Get details for a specific episode\",\n inputSchema: {\n type: \"object\",\n properties: {\n episode_id: { type: \"string\", description: \"The episode ID\" },\n },\n required: [\"episode_id\"],\n },\n },\n {\n name: \"get_show_feed_url\",\n description: \"Get the RSS feed URL for a show\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_podcast_overview_analytics\",\n description:\n \"Get overview analytics for a podcast show, optionally filtered by date range\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n start: {\n type: \"string\",\n description: \"Start date (optional, e.g. YYYY-MM-DD)\",\n },\n end: {\n type: \"string\",\n description: \"End date (optional, e.g. YYYY-MM-DD)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n {\n name: \"get_episode_overview_analytics\",\n description:\n \"Get overview analytics for a specific episode, optionally filtered by date range\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n episode_id: { type: \"string\", description: \"The episode ID\" },\n start: {\n type: \"string\",\n description: \"Start date (optional, e.g. YYYY-MM-DD)\",\n },\n end: {\n type: \"string\",\n description: \"End date (optional, e.g. YYYY-MM-DD)\",\n },\n },\n required: [\"show_id\", \"episode_id\"],\n },\n },\n {\n name: \"get_podcast_average_analytics\",\n description:\n \"Get average analytics for a podcast show over a given interval\",\n inputSchema: {\n type: \"object\",\n properties: {\n show_id: { type: \"string\", description: \"The show ID\" },\n intervalDays: {\n type: \"number\",\n description: \"Number of days for the averaging interval (default 28)\",\n },\n },\n required: [\"show_id\"],\n },\n },\n];\n\n// ---------------------------------------------------------------------------\n// Tool dispatcher\n// ---------------------------------------------------------------------------\n\nasync function callTool(name: string, args: Record): Promise {\n const userId = Deno.env.get(\"CAPTIVATE_USER_ID\");\n\n switch (name) {\n case \"list_my_shows\":\n return captivateGet(`/users/${userId}/shows/manager`);\n\n case \"get_show\":\n return captivateGet(`/shows/${args.show_id}`);\n\n case \"get_show_episodes\":\n return captivateGet(\n `/shows/${args.show_id}/episodes?offset=${args.offset ?? 0}`,\n );\n\n case \"get_episode\":\n return captivateGet(`/episodes/${args.episode_id}`);\n\n case \"get_show_feed_url\":\n return captivateGet(`/shows/${args.show_id}/feed`);\n\n case \"get_podcast_overview_analytics\": {\n const params = new URLSearchParams();\n if (args.start) params.set(\"start\", args.start);\n if (args.end) params.set(\"end\", args.end);\n params.set(\"includeTopEpisodes\", \"true\");\n const qs = params.toString();\n return captivateGet(\n `/insights/${args.show_id}/overview${qs ? `?${qs}` : \"\"}`,\n );\n }\n\n case \"get_episode_overview_analytics\": {\n const params = new URLSearchParams();\n if (args.start) params.set(\"start\", args.start);\n if (args.end) params.set(\"end\", args.end);\n const qs = params.toString();\n return captivateGet(\n `/insights/${args.show_id}/overview/${args.episode_id}${\n qs ? `?${qs}` : \"\"\n }`,\n );\n }\n\n case \"get_podcast_average_analytics\":\n return captivateGet(\n `/insights/${args.show_id}/averages?intervalDays=${\n args.intervalDays ?? 28\n }`,\n );\n\n default:\n throw new Error(`Unknown tool: ${name}`);\n }\n}\n\n// ---------------------------------------------------------------------------\n// JSON-RPC helpers (all include CORS_HEADERS)\n// ---------------------------------------------------------------------------\n\nfunction jsonrpcResponse(id: any, result: any): Response {\n return new Response(JSON.stringify({ jsonrpc: \"2.0\", id, result }), {\n status: 200,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}\n\nfunction jsonrpcError(\n id: any,\n code: number,\n message: string,\n status = 400,\n): Response {\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n error: { code, message },\n }),\n {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n },\n );\n}\n\n// ---------------------------------------------------------------------------\n// OAuth 2.1 shim — no-login, satisfies Claude's remote connector flow\n// ---------------------------------------------------------------------------\n\nfunction randomString(len = 32): string {\n const bytes = new Uint8Array(len);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction oauthMetadata(origin: string) {\n return {\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"none\"],\n scopes_supported: [\"mcp\"],\n };\n}\n\nasync function handleOAuth(req: Request, url: URL): Promise {\n const origin = url.origin;\n\n // OAuth Authorization Server metadata (RFC 8414)\n if (\n req.method === \"GET\" &&\n url.pathname === \"/.well-known/oauth-authorization-server\"\n ) {\n return new Response(JSON.stringify(oauthMetadata(origin)), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n });\n }\n\n // OAuth Protected Resource metadata (RFC 9728)\n if (\n req.method === \"GET\" &&\n url.pathname === \"/.well-known/oauth-protected-resource\"\n ) {\n return new Response(\n JSON.stringify({\n resource: origin,\n authorization_servers: [origin],\n bearer_methods_supported: [\"header\"],\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n // Dynamic client registration\n if (req.method === \"POST\" && url.pathname === \"/register\") {\n let body: any = {};\n try {\n body = await req.json();\n } catch {\n // ignore parse errors\n }\n return new Response(\n JSON.stringify({\n client_id: randomString(16),\n client_name: body.client_name ?? \"mcp-client\",\n redirect_uris: body.redirect_uris ?? [],\n client_id_issued_at: Math.floor(Date.now() / 1000),\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n // Authorization endpoint — auto-approve, no login form\n if (req.method === \"GET\" && url.pathname === \"/authorize\") {\n const redirectUri = url.searchParams.get(\"redirect_uri\");\n const state = url.searchParams.get(\"state\");\n if (!redirectUri) {\n return new Response(\"Missing redirect_uri\", {\n status: 400,\n headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS },\n });\n }\n const code = randomString(16);\n const params = new URLSearchParams({ code });\n if (state) params.set(\"state\", state);\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n return new Response(null, {\n status: 302,\n headers: {\n Location: `${redirectUri}${sep}${params.toString()}`,\n ...CORS_HEADERS,\n },\n });\n }\n\n // Token endpoint — issue token without validation, parse both form & JSON\n if (req.method === \"POST\" && url.pathname === \"/token\") {\n const contentType = req.headers.get(\"Content-Type\") ?? \"\";\n\n if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n const form = await req.formData();\n const grantType = form.get(\"grant_type\") as string;\n // We accept any grant_type — no validation needed\n void grantType;\n } else {\n // Try JSON; if it fails, ignore — we issue a token regardless\n try {\n const json = await req.json();\n void json;\n } catch {\n // Body is empty or unparseable — still return a token\n }\n }\n\n return new Response(\n JSON.stringify({\n access_token: randomString(32),\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: randomString(32),\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n },\n );\n }\n\n return null;\n}\n\n// ---------------------------------------------------------------------------\n// Main handler\n// ---------------------------------------------------------------------------\n\nexport default async (req: Request): Promise => {\n const url = new URL(req.url);\n\n // CORS preflight — applies to ALL routes (OAuth + MCP)\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n }\n\n // OAuth 2.1 shim routes\n const oauthResponse = await handleOAuth(req, url);\n if (oauthResponse) return oauthResponse;\n\n // Non-POST info response\n if (req.method !== \"POST\") {\n return new Response(\n \"Captivate MCP Server — send JSON-RPC 2.0 POST requests.\",\n {\n status: 200,\n headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS },\n },\n );\n }\n\n // MCP Authorization spec: if the POST to root has no Authorization header,\n // respond with 401 + WWW-Authenticate to trigger OAuth discovery flow\n if (!req.headers.get(\"Authorization\")) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 401,\n headers: {\n \"Content-Type\": \"application/json\",\n \"WWW-Authenticate\":\n `Bearer resource_metadata=\"${url.origin}/.well-known/oauth-protected-resource\"`,\n ...CORS_HEADERS,\n },\n });\n }\n\n // Parse JSON-RPC body\n let body: any;\n try {\n body = await req.json();\n } catch {\n return jsonrpcError(null, -32700, \"Parse error\");\n }\n\n const { id, method, params } = body;\n\n // notifications/initialized — return 202 empty\n if (method === \"notifications/initialized\") {\n return new Response(null, { status: 202, headers: CORS_HEADERS });\n }\n\n switch (method) {\n case \"initialize\":\n return jsonrpcResponse(id, {\n protocolVersion: \"2024-11-05\",\n capabilities: { tools: {} },\n serverInfo: { name: \"captivate-mcp\", version: \"1.0.0\" },\n });\n\n case \"tools/list\":\n return jsonrpcResponse(id, { tools: TOOLS });\n\n case \"tools/call\": {\n const { name, arguments: toolArgs } = params ?? {};\n try {\n const result = await callTool(name, toolArgs ?? {});\n return jsonrpcResponse(id, {\n content: [\n { type: \"text\", text: JSON.stringify(result, null, 2) },\n ],\n });\n } catch (err) {\n return jsonrpcResponse(id, {\n isError: true,\n content: [\n {\n type: \"text\",\n text: err instanceof Error ? err.message : String(err),\n },\n ],\n });\n }\n }\n\n default:\n return jsonrpcError(id, -32601, `Method not found: ${method}`);\n }\n};","createdAt",["D",1784447712154],"branchVersion","branchId","8ed4c7b2-d245-4d4c-a597-b49e36b6be76","id","c6c86151-1c19-4950-9fb3-7ff6806b13c8","mcp-server",["D",1784429445384],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","A minimal MCP server with a sample tool","imageUrl","08c30eeb-afbc-482a-b9b2-3f14b39b3476","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f7848-33dc-7189-a01b-4995e51048ab","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":-5},"org",{"_95":94,"_96":97,"_98":-5,"_18":-5,"_99":100,"_101":25},"branch",{"_13":14,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","therelaunch","handle","displayName","Therelaunch","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":151,"_80":152,"_82":153,"_84":25},"tree",[145],"files",[145],"counts",{"_133":62,"_134":135,"_136":62,"_137":138,"_139":140},"contents",[125],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":58,"_38":129,"_13":130,"_33":34,"_35":37,"_24":25,"_131":-5,"_27":132},"f1f731ba-bf93-498a-9adb-ad6098f6b464","parentId","latest",["D",1784447712154],8,"label",[28],"pulls","branches",1,"forks","envVars",{"_141":143,"_144":62},"connections",{"_141":62,"_142":62},"count","unfilledCount",2,"emptyCount",{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":58,"_38":146,"_13":130,"_33":34,"_35":37,"_24":25,"_131":-5,"_147":148,"_27":149},["D",1784447712154],"children",[],[28],["D",1784429445384],{"_95":94,"_102":-5},{"_95":94,"_96":97,"_98":-5,"_18":-5,"_99":100,"_101":25},{"_13":14,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_78":-5,"_122":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":58,"_196":-5,"_197":-7,"_198":-7,"_199":62,"_200":25,"_201":25,"_202":-5,"_203":25,"_204":25,"_205":25,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":85,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v9