[{"_1":2,"_184":-5,"_185":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","1ed3b00b191d67ef967325d666dac7a18ce9a124","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_158":159,"_181":182,"_183":-5},"handle","c15r","name","sync","path","mcp/db.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":112,"_113":-5,"_12":114,"_115":-5,"_116":20,"_117":-5,"_118":-5,"_119":120,"_14":121,"_122":123,"_124":125,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":136,"_139":140,"_144":145,"_157":20},"id","93e19588-0ebb-11f1-a6cd-42dde27851f2","createdAt",["D",1771633422787],"deletedAt","legacyEnvVars","privacy","public","description","Agent collaboration layer https://sync.parc.land","imageUrl","21f2e37e-8066-4730-9dc7-d27cf8d3c9f3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"0630d977-f678-453e-926c-52043293f59f","tursoName","93e195880ebb11f1a6cd42dde27851f2","tursoHostname","93e195880ebb11f1a6cd42dde27851f2-val-town.aws-us-east-2.turso.io","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_137":138},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yb2RJNlc1czZ1NlpZRmoxdGJ2eFVNNVhmeTYifQ","org",{"_95":96,"_141":138,"_12":114,"_142":143},"avatar","tier","pro","branch",{"_146":147,"_97":45,"_103":148,"_149":104,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":98,"_156":96},"version",639,"93e21602-0ebb-11f1-a6cd-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":160,"_97":161,"_162":163,"_164":165,"_166":148,"_167":168,"_169":170,"_105":171,"_146":172,"_173":174,"_175":176,"_177":20,"_178":-5,"_99":179},"d7b5ecf6-1e50-11f1-9153-42dde27851f2","db.ts","fileId","9f51169a-18a3-11f1-b05e-42dde27851f2","parentId","019cbe80-ea89-7462-9a69-79fbc30a3494","branchId","branchVersion",553,"latest",true,["D",1773346799033],7,"fileType","script","content","/**\n * db.ts — SQLite helpers for sync-mcp OAuth/WebAuthn/Vault\n *\n * Schema is managed by the parent ../schema.ts (unified migration).\n * This file provides CRUD helpers + ensures smcp_ tables exist.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { migrate } from \"../schema.ts\";\n\n// Re-export scope types and functions for backward compatibility\nexport {\n type ParsedScope,\n type RoomScope,\n parseScope,\n serializeScope,\n checkRoomInScope,\n} from \"./scope.ts\";\n\n// ─── Schema migration (delegates to unified schema + ensures smcp_ tables) ──\n\nexport async function ensureSchema() {\n // Run the unified migration (creates all tables including smcp_)\n await migrate();\n\n // Belt-and-suspenders: ensure smcp_ tables exist even if parent\n // schema.ts is cached at an older version without them.\n await sqlite.batch([\n { sql: `CREATE TABLE IF NOT EXISTS smcp_users (id TEXT PRIMARY KEY, username TEXT UNIQUE NOT NULL, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_credentials (id TEXT PRIMARY KEY, user_id TEXT NOT NULL, public_key BLOB NOT NULL, counter INTEGER NOT NULL DEFAULT 0, transports TEXT, device_type TEXT, backed_up INTEGER DEFAULT 0, rp_id TEXT, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_challenges (id TEXT PRIMARY KEY, challenge TEXT NOT NULL, user_id TEXT, type TEXT NOT NULL, expires_at TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_oauth_clients (client_id TEXT PRIMARY KEY, client_secret TEXT, redirect_uris TEXT NOT NULL, client_name TEXT, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_auth_codes (code TEXT PRIMARY KEY, client_id TEXT NOT NULL, user_id TEXT NOT NULL, redirect_uri TEXT NOT NULL, code_challenge TEXT NOT NULL, code_challenge_method TEXT NOT NULL DEFAULT 'S256', scope TEXT, resource TEXT, expires_at TEXT NOT NULL, used INTEGER DEFAULT 0)`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_access_tokens (token TEXT PRIMARY KEY, user_id TEXT NOT NULL, client_id TEXT NOT NULL, scope TEXT, expires_at TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_refresh_tokens (token TEXT PRIMARY KEY, user_id TEXT NOT NULL, client_id TEXT NOT NULL, scope TEXT, expires_at TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_vault (id TEXT PRIMARY KEY, user_id TEXT NOT NULL, room_id TEXT NOT NULL, token TEXT NOT NULL, token_type TEXT NOT NULL, label TEXT, is_default INTEGER DEFAULT 0, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_sessions (id TEXT PRIMARY KEY, user_id TEXT NOT NULL, expires_at TEXT NOT NULL, scope TEXT DEFAULT 'consent', created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n { sql: `CREATE TABLE IF NOT EXISTS smcp_recovery_tokens (id TEXT PRIMARY KEY, user_id TEXT NOT NULL, token_hash TEXT NOT NULL, expires_at TEXT NOT NULL, used INTEGER DEFAULT 0, created_at TEXT NOT NULL DEFAULT (datetime('now')))`, args: [] },\n ]);\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────\n\nexport function generateId(): string {\n return crypto.randomUUID();\n}\n\nexport async function generateToken(prefix = \"\"): Promise {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n const b64 = btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return prefix ? `${prefix}_${b64}` : b64;\n}\n\n// Base64url encode/decode\nexport function b64urlEncode(buf: Uint8Array): string {\n return btoa(String.fromCharCode(...buf))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\nexport function b64urlDecode(str: string): Uint8Array {\n const padded = str + \"=\".repeat((4 - (str.length % 4)) % 4);\n const binary = atob(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n}\n\n// SHA-256 for PKCE\nexport async function sha256(input: string): Promise {\n const data = new TextEncoder().encode(input);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n return b64urlEncode(new Uint8Array(hash));\n}\n\n// ─── User CRUD ───────────────────────────────────────────────────\n\nexport async function createUser(id: string, username: string) {\n await sqlite.execute({\n sql: \"INSERT INTO smcp_users (id, username) VALUES (?, ?)\",\n args: [id, username],\n });\n}\n\nexport async function getUserByUsername(username: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_users WHERE username = ?\",\n args: [username],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n username: r[1] as string,\n created_at: r[2] as string,\n };\n}\n\nexport async function getUserById(id: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_users WHERE id = ?\",\n args: [id],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n username: r[1] as string,\n created_at: r[2] as string,\n };\n}\n\n// ─── Credential CRUD ────────────────────────────────────────────\n\nexport async function saveCredential(cred: {\n id: string;\n userId: string;\n publicKey: Uint8Array;\n counter: number;\n transports?: string[];\n deviceType?: string;\n backedUp?: boolean;\n rpId?: string;\n}) {\n await sqlite.execute({\n sql:\n `INSERT INTO smcp_credentials (id, user_id, public_key, counter, transports, device_type, backed_up, rp_id)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n cred.id,\n cred.userId,\n b64urlEncode(cred.publicKey),\n cred.counter,\n cred.transports ? JSON.stringify(cred.transports) : null,\n cred.deviceType ?? null,\n cred.backedUp ? 1 : 0,\n cred.rpId ?? null,\n ],\n });\n}\n\nexport async function getCredentialsByUserId(userId: string, rpId?: string) {\n let sql = \"SELECT * FROM smcp_credentials WHERE user_id = ?\";\n const args: any[] = [userId];\n if (rpId) {\n sql += \" AND (rp_id = ? OR rp_id IS NULL)\";\n args.push(rpId);\n }\n const res = await sqlite.execute({ sql, args });\n return res.rows.map((r) => ({\n id: r[0] as string,\n userId: r[1] as string,\n publicKey: b64urlDecode(r[2] as string),\n counter: r[3] as number,\n transports: r[4] ? JSON.parse(r[4] as string) : undefined,\n deviceType: r[5] as string | null,\n backedUp: r[6] === 1,\n rpId: r[7] as string | null,\n }));\n}\n\nexport async function getCredentialById(credId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_credentials WHERE id = ?\",\n args: [credId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n userId: r[1] as string,\n publicKey: b64urlDecode(r[2] as string),\n counter: r[3] as number,\n transports: r[4] ? JSON.parse(r[4] as string) : undefined,\n deviceType: r[5] as string | null,\n backedUp: r[6] === 1,\n rpId: r[7] as string | null,\n };\n}\n\nexport async function updateCredentialCounter(\n credId: string,\n newCounter: number,\n) {\n await sqlite.execute({\n sql: \"UPDATE smcp_credentials SET counter = ? WHERE id = ?\",\n args: [newCounter, credId],\n });\n}\n\n// ─── Challenge CRUD ─────────────────────────────────────────────\n\nexport async function saveChallenge(\n id: string,\n challenge: string,\n type: string,\n userId?: string,\n) {\n const expires = new Date(Date.now() + 5 * 60 * 1000).toISOString(); // 5 min\n await sqlite.execute({\n sql:\n \"INSERT INTO smcp_challenges (id, challenge, user_id, type, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, challenge, userId ?? null, type, expires],\n });\n}\n\nexport async function getChallenge(id: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT * FROM smcp_challenges WHERE id = ? AND expires_at > datetime('now')\",\n args: [id],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n challenge: r[1] as string,\n userId: r[2] as string | null,\n type: r[3] as string,\n };\n}\n\nexport async function deleteChallenge(id: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_challenges WHERE id = ?\",\n args: [id],\n });\n}\n\n// ─── OAuth Client CRUD ──────────────────────────────────────────\n\nexport async function saveOAuthClient(client: {\n clientId: string;\n clientSecret?: string;\n redirectUris: string[];\n clientName?: string;\n}) {\n await sqlite.execute({\n sql:\n `INSERT OR REPLACE INTO smcp_oauth_clients (client_id, client_secret, redirect_uris, client_name)\n VALUES (?, ?, ?, ?)`,\n args: [\n client.clientId,\n client.clientSecret ?? null,\n JSON.stringify(client.redirectUris),\n client.clientName ?? null,\n ],\n });\n}\n\nexport async function getOAuthClient(clientId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_oauth_clients WHERE client_id = ?\",\n args: [clientId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n clientId: r[0] as string,\n clientSecret: r[1] as string | null,\n redirectUris: JSON.parse(r[2] as string) as string[],\n clientName: r[3] as string | null,\n };\n}\n\n// ─── Auth Code CRUD ─────────────────────────────────────────────\n\nexport async function saveAuthCode(code: {\n code: string;\n clientId: string;\n userId: string;\n redirectUri: string;\n codeChallenge: string;\n codeChallengeMethod: string;\n scope?: string;\n resource?: string;\n}) {\n const expires = new Date(Date.now() + 10 * 60 * 1000).toISOString(); // 10 min\n await sqlite.execute({\n sql:\n `INSERT INTO smcp_auth_codes (code, client_id, user_id, redirect_uri, code_challenge, code_challenge_method, scope, resource, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n code.code,\n code.clientId,\n code.userId,\n code.redirectUri,\n code.codeChallenge,\n code.codeChallengeMethod,\n code.scope ?? null,\n code.resource ?? null,\n expires,\n ],\n });\n}\n\nexport async function consumeAuthCode(code: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT * FROM smcp_auth_codes WHERE code = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [code],\n });\n if (res.rows.length === 0) return null;\n await sqlite.execute({\n sql: \"UPDATE smcp_auth_codes SET used = 1 WHERE code = ?\",\n args: [code],\n });\n const r = res.rows[0];\n return {\n code: r[0] as string,\n clientId: r[1] as string,\n userId: r[2] as string,\n redirectUri: r[3] as string,\n codeChallenge: r[4] as string,\n codeChallengeMethod: r[5] as string,\n scope: r[6] as string | null,\n resource: r[7] as string | null,\n };\n}\n\n// ─── Token CRUD ─────────────────────────────────────────────────\n\nexport async function saveAccessToken(t: {\n token: string;\n userId: string;\n clientId: string;\n scope?: string;\n expiresInSec?: number;\n}) {\n const expires = new Date(Date.now() + (t.expiresInSec ?? 3600) * 1000)\n .toISOString();\n await sqlite.execute({\n sql:\n `INSERT INTO smcp_access_tokens (token, user_id, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [t.token, t.userId, t.clientId, t.scope ?? null, expires],\n });\n}\n\nexport async function validateAccessToken(token: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT * FROM smcp_access_tokens WHERE token = ? AND expires_at > datetime('now')\",\n args: [token],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n token: r[0] as string,\n userId: r[1] as string,\n clientId: r[2] as string,\n scope: r[3] as string | null,\n expiresAt: r[4] as string,\n };\n}\n\nexport async function saveRefreshToken(t: {\n token: string;\n userId: string;\n clientId: string;\n scope?: string;\n}) {\n const expires = new Date(Date.now() + 30 * 24 * 3600 * 1000).toISOString(); // 30 days\n await sqlite.execute({\n sql:\n `INSERT INTO smcp_refresh_tokens (token, user_id, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [t.token, t.userId, t.clientId, t.scope ?? null, expires],\n });\n}\n\nexport async function consumeRefreshToken(token: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT * FROM smcp_refresh_tokens WHERE token = ? AND expires_at > datetime('now')\",\n args: [token],\n });\n if (res.rows.length === 0) return null;\n await sqlite.execute({\n sql: \"DELETE FROM smcp_refresh_tokens WHERE token = ?\",\n args: [token],\n });\n const r = res.rows[0];\n return {\n token: r[0] as string,\n userId: r[1] as string,\n clientId: r[2] as string,\n scope: r[3] as string | null,\n };\n}\n\n// ─── Session CRUD ───────────────────────────────────────────────\n\nexport async function createSession(\n userId: string,\n scope: string = \"consent\",\n): Promise {\n const id = await generateToken(\"sess\");\n const expires = new Date(Date.now() + 15 * 60 * 1000).toISOString(); // 15 min\n await sqlite.execute({\n sql:\n \"INSERT INTO smcp_sessions (id, user_id, expires_at, scope) VALUES (?, ?, ?, ?)\",\n args: [id, userId, expires, scope],\n });\n return id;\n}\n\nexport async function validateSession(sessionId: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT id, user_id, scope FROM smcp_sessions WHERE id = ? AND expires_at > datetime('now')\",\n args: [sessionId],\n });\n if (res.rows.length === 0) return null;\n return {\n userId: res.rows[0][1] as string,\n scope: (res.rows[0][2] as string) ?? \"consent\",\n };\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_sessions WHERE id = ?\",\n args: [sessionId],\n });\n}\n\n// ─── Recovery Token CRUD ─────────────────────────────────────────\n\nconst RECOVERY_EXPIRY_DAYS = 90;\nconst MAX_ACTIVE_RECOVERY_TOKENS = 3;\n\nexport async function createRecoveryToken(\n userId: string,\n): Promise<{ token: string; expiresAt: string } | { error: string }> {\n const countRes = await sqlite.execute({\n sql:\n \"SELECT COUNT(*) FROM smcp_recovery_tokens WHERE user_id = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [userId],\n });\n const activeCount = Number(countRes.rows[0][0]);\n if (activeCount >= MAX_ACTIVE_RECOVERY_TOKENS) {\n return {\n error:\n `Maximum ${MAX_ACTIVE_RECOVERY_TOKENS} active recovery tokens. Revoke one first.`,\n };\n }\n\n const token = await generateToken(\"recover\");\n const tokenHash = await sha256(token);\n const id = generateId();\n const expiresAt = new Date(\n Date.now() + RECOVERY_EXPIRY_DAYS * 24 * 3600 * 1000,\n ).toISOString();\n\n await sqlite.execute({\n sql:\n \"INSERT INTO smcp_recovery_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)\",\n args: [id, userId, tokenHash, expiresAt],\n });\n\n return { token, expiresAt };\n}\n\nexport async function validateRecoveryToken(\n token: string,\n): Promise<{ userId: string; tokenId: string } | null> {\n const tokenHash = await sha256(token);\n const res = await sqlite.execute({\n sql:\n \"SELECT id, user_id FROM smcp_recovery_tokens WHERE token_hash = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [tokenHash],\n });\n if (res.rows.length === 0) return null;\n return {\n tokenId: res.rows[0][0] as string,\n userId: res.rows[0][1] as string,\n };\n}\n\nexport async function consumeRecoveryToken(tokenId: string) {\n await sqlite.execute({\n sql: \"UPDATE smcp_recovery_tokens SET used = 1 WHERE id = ?\",\n args: [tokenId],\n });\n}\n\nexport async function listRecoveryTokens(userId: string) {\n const res = await sqlite.execute({\n sql:\n \"SELECT id, expires_at, used, created_at FROM smcp_recovery_tokens WHERE user_id = ? ORDER BY created_at DESC\",\n args: [userId],\n });\n return res.rows.map((r) => ({\n id: r[0] as string,\n expiresAt: r[1] as string,\n used: r[2] === 1,\n createdAt: r[3] as string,\n }));\n}\n\nexport async function revokeRecoveryToken(userId: string, tokenId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_recovery_tokens WHERE id = ? AND user_id = ?\",\n args: [tokenId, userId],\n });\n}\n\n// ─── Cleanup ────────────────────────────────────────────────────\n\nexport async function cleanupExpired() {\n await sqlite.batch([\n {\n sql: \"DELETE FROM smcp_challenges WHERE expires_at < datetime('now')\",\n args: [],\n },\n {\n sql: \"DELETE FROM smcp_auth_codes WHERE expires_at < datetime('now')\",\n args: [],\n },\n {\n sql: \"DELETE FROM smcp_sessions WHERE expires_at < datetime('now')\",\n args: [],\n },\n {\n sql:\n \"DELETE FROM smcp_recovery_tokens WHERE expires_at < datetime('now') OR used = 1\",\n args: [],\n },\n ]);\n}\n\n// ─── User-Room CRUD ─────────────────────────────────────────────\n\nexport async function upsertUserRoom(\n userId: string, roomId: string, access: string,\n label?: string, isDefault?: boolean,\n) {\n if (isDefault) {\n await sqlite.execute({\n sql: \"UPDATE smcp_user_rooms SET is_default = 0 WHERE user_id = ?\",\n args: [userId],\n });\n }\n await sqlite.execute({\n sql: `INSERT INTO smcp_user_rooms (user_id, room_id, access, label, is_default)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(user_id, room_id) DO UPDATE SET\n access = excluded.access,\n label = COALESCE(excluded.label, smcp_user_rooms.label),\n is_default = COALESCE(excluded.is_default, smcp_user_rooms.is_default)`,\n args: [userId, roomId, access, label ?? null, isDefault ? 1 : 0],\n });\n}\n\nexport async function getUserRoom(userId: string, roomId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT user_id, room_id, access, is_default, label, created_at FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?\",\n args: [userId, roomId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n userId: r[0] as string, roomId: r[1] as string,\n access: r[2] as string, isDefault: r[3] === 1,\n label: r[4] as string | null, createdAt: r[5] as string,\n };\n}\n\nexport async function listUserRooms(userId: string) {\n const res = await sqlite.execute({\n sql: `SELECT user_id, room_id, access, is_default, label, created_at\n FROM smcp_user_rooms WHERE user_id = ?\n ORDER BY is_default DESC, created_at DESC`,\n args: [userId],\n });\n return res.rows.map((r) => ({\n userId: r[0] as string, roomId: r[1] as string,\n access: r[2] as string, isDefault: r[3] === 1,\n label: r[4] as string | null, createdAt: r[5] as string,\n }));\n}\n\nexport async function deleteUserRoom(userId: string, roomId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?\",\n args: [userId, roomId],\n });\n}\n\n// ─── User Session CRUD (OAuth-token-level) ──────────────────────\n\nexport async function createUserSession(params: {\n tokenHash: string; userId: string; clientId: string;\n scope: string; expiresAt: string;\n}) {\n await sqlite.execute({\n sql: `INSERT INTO smcp_user_sessions\n (token_hash, user_id, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [params.tokenHash, params.userId, params.clientId,\n params.scope, params.expiresAt],\n });\n}\n\nexport async function getUserSession(tokenHash: string) {\n const res = await sqlite.execute({\n sql: `SELECT token_hash, user_id, client_id, scope, created_at, expires_at\n FROM smcp_user_sessions\n WHERE token_hash = ? AND expires_at > datetime('now')`,\n args: [tokenHash],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n tokenHash: r[0] as string, userId: r[1] as string,\n clientId: r[2] as string, scope: r[3] as string,\n createdAt: r[4] as string, expiresAt: r[5] as string,\n };\n}\n\nexport async function updateSessionScope(tokenHash: string, scope: string) {\n await sqlite.execute({\n sql: `UPDATE smcp_user_sessions SET scope = ? WHERE token_hash = ?`,\n args: [scope, tokenHash],\n });\n}\n\nexport async function deleteUserSession(tokenHash: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_embodiments WHERE session_hash = ?\",\n args: [tokenHash],\n });\n await sqlite.execute({\n sql: \"DELETE FROM smcp_user_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n}\n\nexport async function transferEmbodiments(\n oldTokenHash: string, newTokenHash: string,\n) {\n const res = await sqlite.execute({\n sql: \"SELECT room_id, agent_id FROM smcp_embodiments WHERE session_hash = ?\",\n args: [oldTokenHash],\n });\n if (res.rows.length === 0) return;\n const stmts = res.rows.map((r) => ({\n sql: `INSERT OR IGNORE INTO smcp_embodiments\n (session_hash, room_id, agent_id, embodied_at)\n VALUES (?, ?, ?, datetime('now'))`,\n args: [newTokenHash, r[0] as string, r[1] as string],\n }));\n await sqlite.batch(stmts);\n await sqlite.execute({\n sql: \"DELETE FROM smcp_embodiments WHERE session_hash = ?\",\n args: [oldTokenHash],\n });\n}\n\n// ─── Embodiment CRUD ────────────────────────────────────────────\n\nexport async function setEmbodiment(\n sessionHash: string, roomId: string, agentId: string,\n) {\n await sqlite.execute({\n sql: `INSERT INTO smcp_embodiments (session_hash, room_id, agent_id)\n VALUES (?, ?, ?)\n ON CONFLICT(session_hash, room_id) DO UPDATE SET\n agent_id = excluded.agent_id,\n embodied_at = datetime('now')`,\n args: [sessionHash, roomId, agentId],\n });\n}\n\nexport async function getEmbodiment(sessionHash: string, roomId: string) {\n const res = await sqlite.execute({\n sql: `SELECT agent_id FROM smcp_embodiments\n WHERE session_hash = ? AND room_id = ?`,\n args: [sessionHash, roomId],\n });\n if (res.rows.length === 0) return null;\n return res.rows[0][0] as string;\n}\n\nexport async function listEmbodiments(sessionHash: string) {\n const res = await sqlite.execute({\n sql: `SELECT room_id, agent_id, embodied_at FROM smcp_embodiments\n WHERE session_hash = ? ORDER BY embodied_at DESC`,\n args: [sessionHash],\n });\n return res.rows.map((r) => ({\n roomId: r[0] as string, agentId: r[1] as string,\n embodiedAt: r[2] as string,\n }));\n}\n\nexport async function removeEmbodiment(sessionHash: string, roomId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_embodiments WHERE session_hash = ? AND room_id = ?\",\n args: [sessionHash, roomId],\n });\n}\n\nexport async function removeAllEmbodiments(sessionHash: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_embodiments WHERE session_hash = ?\",\n args: [sessionHash],\n });\n}\n\nexport async function findSessionsByUserClient(\n userId: string, clientId: string, excludeHash?: string,\n) {\n let sql = `SELECT token_hash FROM smcp_user_sessions\n WHERE user_id = ? AND client_id = ? AND expires_at > datetime('now')`;\n const args: any[] = [userId, clientId];\n if (excludeHash) {\n sql += ` AND token_hash != ?`;\n args.push(excludeHash);\n }\n const res = await sqlite.execute({ sql, args });\n return res.rows.map(r => r[0] as string);\n}\n\n\n// ═══════════════════════════════════════════════════════════════════\n// Unified Tokens (Phase 1 — v7 auth model)\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function mintToken(params: {\n userId: string;\n scope: string;\n label?: string;\n roomId?: string;\n agentId?: string;\n clientId?: string;\n expiresInSec?: number;\n withRefresh?: boolean;\n}): Promise<{ id: string; token: string; refreshToken?: string; expiresAt: string | null }> {\n const id = generateId();\n const token = await generateToken(\"tok\");\n const tokenHash = await sha256(token);\n const expiresAt = params.expiresInSec\n ? new Date(Date.now() + params.expiresInSec * 1000).toISOString()\n : null;\n\n let refreshToken: string | undefined;\n let refreshHash: string | null = null;\n if (params.withRefresh) {\n refreshToken = await generateToken(\"ref\");\n refreshHash = await sha256(refreshToken);\n }\n\n await sqlite.execute({\n sql: `INSERT INTO tokens (id, token_hash, refresh_hash, minted_by, scope, label,\n room_id, agent_id, client_id, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [id, tokenHash, refreshHash, params.userId, params.scope,\n params.label ?? null, params.roomId ?? null, params.agentId ?? null,\n params.clientId ?? null, expiresAt],\n });\n\n return { id, token, refreshToken, expiresAt };\n}\n\nexport async function validateTokenByHash(hash: string): Promise<{\n id: string; mintedBy: string; scope: string; label: string | null;\n roomId: string | null; agentId: string | null; clientId: string | null;\n expiresAt: string | null; createdAt: string;\n} | null> {\n const res = await sqlite.execute({\n sql: `SELECT id, minted_by, scope, label, room_id, agent_id, client_id,\n expires_at, created_at\n FROM tokens\n WHERE token_hash = ? AND revoked = 0\n AND (expires_at IS NULL OR expires_at > datetime('now'))`,\n args: [hash],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string, mintedBy: r[1] as string, scope: r[2] as string,\n label: r[3] as string | null, roomId: r[4] as string | null,\n agentId: r[5] as string | null, clientId: r[6] as string | null,\n expiresAt: r[7] as string | null, createdAt: r[8] as string,\n };\n}\n\nexport async function validateRefreshByHash(hash: string): Promise<{\n id: string; mintedBy: string; scope: string; clientId: string | null;\n} | null> {\n const res = await sqlite.execute({\n sql: `SELECT id, minted_by, scope, client_id\n FROM tokens\n WHERE refresh_hash = ? AND revoked = 0\n AND (expires_at IS NULL OR expires_at > datetime('now'))`,\n args: [hash],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string, mintedBy: r[1] as string,\n scope: r[2] as string, clientId: r[3] as string | null,\n };\n}\n\nexport async function refreshUnifiedToken(oldRefreshHash: string, newExpiresInSec = 3600): Promise<{\n id: string; token: string; refreshToken: string; expiresAt: string;\n} | null> {\n const old = await validateRefreshByHash(oldRefreshHash);\n if (!old) return null;\n\n // Revoke old token\n await sqlite.execute({\n sql: `UPDATE tokens SET revoked = 1 WHERE id = ?`,\n args: [old.id],\n });\n\n // Mint new with same scope\n const result = await mintToken({\n userId: old.mintedBy,\n scope: old.scope,\n clientId: old.clientId ?? undefined,\n expiresInSec: newExpiresInSec,\n withRefresh: true,\n });\n\n // Transfer embodiments from old token to new\n await sqlite.execute({\n sql: `UPDATE smcp_embodiments SET session_hash = ?\n WHERE session_hash = (SELECT token_hash FROM tokens WHERE id = ?)`,\n args: [await sha256(result.token), old.id],\n }).catch(() => {});\n\n return {\n id: result.id,\n token: result.token,\n refreshToken: result.refreshToken!,\n expiresAt: result.expiresAt!,\n };\n}\n\nexport async function revokeToken(tokenId: string, userId: string): Promise {\n const res = await sqlite.execute({\n sql: `UPDATE tokens SET revoked = 1 WHERE id = ? AND minted_by = ?`,\n args: [tokenId, userId],\n });\n return (res.rowsAffected ?? 0) > 0;\n}\n\nexport async function listUserTokens(userId: string): Promise> {\n const res = await sqlite.execute({\n sql: `SELECT id, scope, label, room_id, agent_id, client_id, revoked,\n expires_at, created_at\n FROM tokens WHERE minted_by = ?\n ORDER BY created_at DESC LIMIT 100`,\n args: [userId],\n });\n return res.rows.map((r: any[]) => ({\n id: r[0] as string, scope: r[1] as string, label: r[2] as string | null,\n roomId: r[3] as string | null, agentId: r[4] as string | null,\n clientId: r[5] as string | null, revoked: r[6] === 1,\n expiresAt: r[7] as string | null, createdAt: r[8] as string,\n }));\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// Device Authorization Codes\n// ═══════════════════════════════════════════════════════════════════\n\nfunction generateUserCode(): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // no I/O/0/1\n const left = Array.from({ length: 4 }, () => chars[Math.floor(Math.random() * chars.length)]).join(\"\");\n const right = Array.from({ length: 4 }, () => chars[Math.floor(Math.random() * chars.length)]).join(\"\");\n return `${left}-${right}`;\n}\n\nexport async function createDeviceCode(scope: string, clientId?: string): Promise<{\n deviceCode: string; userCode: string; expiresAt: string;\n}> {\n const deviceCode = await generateToken(\"dev\");\n let userCode = generateUserCode();\n\n // Ensure unique user_code (unlikely collision but be safe)\n for (let i = 0; i < 5; i++) {\n try {\n const expiresAt = new Date(Date.now() + 15 * 60 * 1000).toISOString(); // 15 min\n await sqlite.execute({\n sql: `INSERT INTO device_codes (device_code, user_code, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [deviceCode, userCode, clientId ?? \"cli\", scope, expiresAt],\n });\n return { deviceCode, userCode, expiresAt };\n } catch (e: any) {\n if (e.message?.includes(\"UNIQUE\") && e.message?.includes(\"user_code\")) {\n userCode = generateUserCode();\n continue;\n }\n throw e;\n }\n }\n throw new Error(\"Failed to generate unique user code\");\n}\n\nexport async function getDeviceCode(deviceCode: string): Promise<{\n deviceCode: string; userCode: string; scope: string; status: string;\n approvedBy: string | null; expiresAt: string;\n} | null> {\n const res = await sqlite.execute({\n sql: `SELECT device_code, user_code, scope, status, approved_by, expires_at\n FROM device_codes WHERE device_code = ?`,\n args: [deviceCode],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n deviceCode: r[0] as string, userCode: r[1] as string,\n scope: r[2] as string, status: r[3] as string,\n approvedBy: r[4] as string | null, expiresAt: r[5] as string,\n };\n}\n\nexport async function getDeviceCodeByUserCode(userCode: string): Promise<{\n deviceCode: string; userCode: string; scope: string; status: string;\n approvedBy: string | null; expiresAt: string;\n} | null> {\n const res = await sqlite.execute({\n sql: `SELECT device_code, user_code, scope, status, approved_by, expires_at\n FROM device_codes\n WHERE user_code = ? AND expires_at > datetime('now')`,\n args: [userCode],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n deviceCode: r[0] as string, userCode: r[1] as string,\n scope: r[2] as string, status: r[3] as string,\n approvedBy: r[4] as string | null, expiresAt: r[5] as string,\n };\n}\n\nexport async function approveDeviceCode(deviceCode: string, userId: string): Promise {\n const res = await sqlite.execute({\n sql: `UPDATE device_codes SET status = 'approved', approved_by = ?\n WHERE device_code = ? AND status = 'pending'\n AND expires_at > datetime('now')`,\n args: [userId, deviceCode],\n });\n return (res.rowsAffected ?? 0) > 0;\n}\n\nexport async function denyDeviceCode(deviceCode: string): Promise {\n const res = await sqlite.execute({\n sql: `UPDATE device_codes SET status = 'denied'\n WHERE device_code = ? AND status = 'pending'`,\n args: [deviceCode],\n });\n return (res.rowsAffected ?? 0) > 0;\n}\n\nexport async function consumeDeviceCode(deviceCode: string): Promise<{\n scope: string; approvedBy: string;\n} | null> {\n const dc = await getDeviceCode(deviceCode);\n if (!dc || dc.status !== \"approved\" || !dc.approvedBy) return null;\n if (new Date(dc.expiresAt) < new Date()) return null;\n // Mark consumed by setting status\n await sqlite.execute({\n sql: `UPDATE device_codes SET status = 'consumed' WHERE device_code = ?`,\n args: [deviceCode],\n });\n return { scope: dc.scope, approvedBy: dc.approvedBy };\n}\n\nexport async function cleanupDeviceCodes() {\n await sqlite.execute({\n sql: `DELETE FROM device_codes WHERE expires_at < datetime('now')`,\n args: [],\n });\n}\n\n// ─── Room invitation ─────────────────────────────────────────────\n\nexport async function inviteUserToRoom(\n userId: string, roomId: string, role: string, invitedBy: string, label?: string,\n) {\n await sqlite.execute({\n sql: `INSERT INTO smcp_user_rooms (user_id, room_id, access, invited_by, label)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(user_id, room_id) DO UPDATE SET\n access = excluded.access, invited_by = excluded.invited_by`,\n args: [userId, roomId, role, invitedBy, label ?? null],\n });\n}\n\n\nexport async function updateDeviceCodeScope(deviceCode: string, scope: string) {\n await sqlite.execute({\n sql: `UPDATE device_codes SET scope = ? WHERE device_code = ?`,\n args: [scope, deviceCode],\n });\n}\n","deleted","label",[180,161],"mcp","permalink","https://www.val.town/x/c15r/sync/code/mcp/db.ts","extension","actionData","errors"]