[{"_1":2,"_173":-5,"_174":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","8ede82b6c3c0033bf75cd83d1f274deb7a3fbc13","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_151":152,"_170":171,"_172":-5},"handle","cameronpak","name","mcp-registry-subregistry-api","path","main.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":111,"_112":113,"_12":114,"_115":-5,"_116":20,"_117":-5,"_118":-5,"_119":120,"_14":121,"_122":123,"_124":123,"_125":126,"_127":126,"_128":126,"_129":123,"_130":123,"_23":131,"_134":135,"_137":138,"_150":20},"id","51d870cc-a097-11f0-b09c-0224a6c84d84","createdAt",["D",1759523222208],"deletedAt","legacyEnvVars","privacy","public","description","A Subregistry API for the official MCP Registry","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/d6a72ebf-a436-4879-84af-204c8360fa00/square512","35ef5666-3780-42d5-ade0-86fe3fdb6bb1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"47e0b4b2-7d41-46e6-8dce-0ae3d76e1a8f","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_132":133},"profileImageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/7fcc9ac1-f8fb-41e2-0168-af29ef7c6400/square512","org",{"_94":95,"_136":133,"_12":114},"avatar","branch",{"_139":140,"_96":44,"_102":141,"_142":103,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":97,"_149":95},"version",26,"51d9b5fe-a097-11f0-b09c-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":153,"_96":99,"_154":155,"_156":-5,"_157":141,"_158":140,"_159":160,"_104":161,"_139":162,"_163":164,"_165":166,"_167":20,"_168":-5,"_98":169},"197762a8-a12b-11f0-aa22-0224a6c84d84","fileId","51e4ada6-a097-11f0-b09c-0224a6c84d84","parentId","branchId","branchVersion","latest",true,["D",1759586693129],5,"fileType","script","content","import { Hono } from 'npm:hono@4.9.9';\nimport type { Context } from 'npm:hono@4.9.9';\nimport { HTTPResponseError } from \"npm:hono@4.9.9/types\";\nimport type {\n ErrorModel,\n HealthBody,\n PingBody,\n ServerJSON,\n ServerListResponse,\n ServerResponse,\n} from 'npm:mcp-registry-spec-sdk@0.2.0';\nimport {\n ServerJSONSchema,\n} from 'npm:mcp-registry-spec-sdk@0.2.0';\nimport {\n getLatestServerByName,\n getServerById,\n getServerByNameVersion,\n listServerVersions,\n listServers as listServersQuery,\n publishServerVersion,\n updateServerVersion,\n updateServerStatus,\n} from './backend/database/queries.ts';\n\nconst API_VERSION = '2025-09-29';\nconst START_TIME = Date.now();\nconst metricsState = {\n publishTotal: 0,\n updateTotal: 0,\n authExchanges: new Map(),\n};\n\ntype ServerStatus = 'active' | 'deprecated' | 'deleted';\nconst STATUS_VALUES: readonly ServerStatus[] = ['active', 'deprecated', 'deleted'];\nconst STATUS_SET = new Set(STATUS_VALUES);\n\nfunction isServerStatus(value: string): value is ServerStatus {\n return STATUS_SET.has(value as ServerStatus);\n}\n\ntype RegistryBindings = {\n REGISTRY_AUTH_SECRET?: string;\n GITHUB_AT_SHARED_SECRET?: string;\n GITHUB_OIDC_SHARED_SECRET?: string;\n DNS_SHARED_SECRET?: string;\n HTTP_SHARED_SECRET?: string;\n OIDC_SHARED_SECRET?: string;\n};\n\ntype NormalizedIssue = {\n path: (string | number)[];\n message: string;\n received?: unknown;\n};\n\ntype RegistryTokenClaims = {\n version: 1;\n namespaces: string[];\n methods: string[];\n iat: number;\n exp: number;\n};\n\ntype AuthFieldSpec = {\n names: readonly string[];\n description: string;\n};\n\ntype AuthRequestSpec = {\n required: readonly AuthFieldSpec[];\n extractSecret: (\n body: Record,\n getField: (field: string) => string | undefined,\n ) => string | undefined;\n};\n\nconst TEXT_ENCODER = new TextEncoder();\nconst TEXT_DECODER = new TextDecoder();\nconst HMAC_KEY_CACHE = new Map>();\n\nclass ProblemError extends Error {\n problem: ErrorModel;\n\n constructor(problem: ErrorModel) {\n super(problem.detail ?? problem.title ?? 'Registry error');\n this.problem = problem;\n }\n}\n\nconst app = new Hono<{ Bindings: RegistryBindings }>();\n\napp.onError((err: Error | HTTPResponseError, c: Context) => {\n if (err instanceof ProblemError) {\n return problemResponse(c, (err as ProblemError).problem);\n }\n console.error(err);\n return problemResponse(\n c,\n createProblem(500, 'Internal Server Error', 'An unexpected error occurred.', c),\n );\n});\n\napp.get('/', (c: Context) =>\n c.json({\n message: 'faith.tools MCP Subregistry API',\n documentation: 'https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/generic-registry-api.md',\n }),\n);\n\napp.get('/v0/servers', async (c: Context) => {\n const q = c.req.query();\n const cursor = q.cursor ?? undefined;\n const search = q.search ?? undefined;\n const limitRaw = q.limit ?? undefined;\n const limit = limitRaw != null ? Number(limitRaw) : undefined;\n const updatedSinceRaw = q.updated_since ?? q.updatedSince ?? undefined;\n const versionRaw = q.version ?? undefined;\n\n if (limitRaw != null && (Number.isNaN(limit) || limit! <= 0)) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid limit parameter',\n 'limit must be a positive integer.',\n c,\n [\n {\n location: 'query.limit',\n message: 'Expected positive integer',\n value: limitRaw,\n },\n ],\n ),\n );\n }\n\n let updatedSince: string | undefined;\n if (updatedSinceRaw != null) {\n const parsedDate = new Date(updatedSinceRaw);\n if (Number.isNaN(parsedDate.getTime())) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid updated_since parameter',\n 'updated_since must be a valid RFC3339 timestamp.',\n c,\n [\n {\n location: 'query.updated_since',\n message: 'Expected RFC3339 timestamp',\n value: updatedSinceRaw,\n },\n ],\n ),\n );\n }\n updatedSince = parsedDate.toISOString();\n }\n\n const version = typeof versionRaw === 'string' && versionRaw.trim().length > 0\n ? versionRaw.trim()\n : undefined;\n\n const result: ServerListResponse = await listServersQuery({\n cursor,\n limit,\n search,\n updatedSince,\n version,\n });\n\n return c.json(result);\n});\n\napp.get('/v0/servers/:id{[0-9]+}', async (c: Context) => {\n const idParam = c.req.param('id');\n const id = Number(idParam);\n if (!Number.isInteger(id) || id <= 0) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid server id',\n 'id must be a positive integer.',\n c,\n [\n {\n location: 'path.id',\n message: 'Expected positive integer',\n value: idParam,\n },\n ],\n ),\n );\n }\n\n const result = await getServerById(id);\n if (!result) {\n throw new ProblemError(\n createProblem(404, 'Server not found', `No server registered with id ${id}.`, c),\n );\n }\n return c.json(result);\n});\n\napp.get('/v0/servers/:serverName', async (c: Context) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const result = await getLatestServerByName(serverName);\n if (!result) {\n throw new ProblemError(\n createProblem(404, 'Server not found', `No server registered for ${serverName}.`, c),\n );\n }\n return c.json(result);\n});\n\napp.get('/v0/servers/:serverName/versions', async (c: Context) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const versions: ServerResponse[] = await listServerVersions(serverName);\n return c.json(versions);\n});\n\napp.get('/v0/servers/:serverName/versions/:version', async (c: Context) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const version = decodePathParam(c.req.param('version'));\n const result = await getServerByNameVersion(serverName, version);\n if (!result) {\n throw new ProblemError(\n createProblem(\n 404,\n 'Server version not found',\n `No version ${version} found for ${serverName}.`,\n c,\n ),\n );\n }\n return c.json(result);\n});\n\napp.post('/v0/publish', async (c: Context) => {\n const auth = await ensurePublishAuth(c);\n const payload = await readJson(c);\n\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n const issues = toValidationIssues(parsed.error.issues);\n throw new ProblemError(\n createValidationProblem(\n 422,\n 'Invalid server payload',\n 'Request body failed validation.',\n c,\n issues,\n ),\n );\n }\n\n assertNamespaceAuthorized(auth, parsed.data.name, c);\n validateOfficialPolicies(parsed.data, c);\n\n const result = await publishServerVersion(parsed.data);\n metricsState.publishTotal += 1;\n return c.json(result);\n});\n\napp.put('/v0/servers/:serverName/versions/:version', async (c: Context) => {\n const auth = await ensurePublishAuth(c);\n const serverName = decodePathParam(c.req.param('serverName'));\n const version = decodePathParam(c.req.param('version'));\n const statusParamRaw = c.req.query('status');\n let desiredStatus: ServerStatus | undefined;\n\n if (statusParamRaw != null) {\n const normalized = statusParamRaw.trim().toLowerCase();\n if (!isServerStatus(normalized)) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid status parameter',\n 'status must be one of active, deprecated, or deleted.',\n c,\n [\n {\n location: 'query.status',\n message: 'Expected active, deprecated, or deleted',\n value: statusParamRaw,\n },\n ],\n ),\n );\n }\n desiredStatus = normalized;\n }\n\n const payload = await readJson(c);\n\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n const issues = toValidationIssues(parsed.error.issues);\n throw new ProblemError(\n createValidationProblem(\n 422,\n 'Invalid server payload',\n 'Request body failed validation.',\n c,\n issues,\n ),\n );\n }\n\n if (parsed.data.name.toLowerCase() !== serverName.toLowerCase()) {\n throw new ProblemError(\n createProblem(\n 409,\n 'Server name mismatch',\n 'Path serverName does not match payload.name.',\n c,\n [\n {\n location: 'body.name',\n message: `Expected ${serverName}`,\n value: parsed.data.name,\n },\n ],\n ),\n );\n }\n\n if (parsed.data.version !== version) {\n throw new ProblemError(\n createProblem(\n 409,\n 'Version mismatch',\n 'Path version does not match payload.version.',\n c,\n [\n {\n location: 'body.version',\n message: `Expected ${version}`,\n value: parsed.data.version,\n },\n ],\n ),\n );\n }\n\n assertNamespaceAuthorized(auth, parsed.data.name, c);\n validateOfficialPolicies(parsed.data, c);\n\n let versionResponse: ServerResponse;\n try {\n versionResponse = await updateServerVersion(serverName, version, parsed.data);\n } catch (err) {\n const error = err as { code?: string; message?: string };\n if (error.code === 'ImmutableVersionConflict') {\n throw new ProblemError(\n createProblem(\n 409,\n 'Immutable server version',\n 'Published server versions are immutable. Publish a new version to change metadata.',\n c,\n ),\n );\n }\n if (error.message === 'Server version not found') {\n throw new ProblemError(\n createProblem(\n 404,\n 'Server version not found',\n `No version ${version} found for ${serverName}.`,\n c,\n ),\n );\n }\n throw err;\n }\n\n const officialMeta = versionResponse._meta?.['io.modelcontextprotocol.registry/official'] as\n | { status?: string }\n | undefined;\n const currentStatus = (officialMeta?.status ?? 'active').toLowerCase() as ServerStatus;\n\n let finalResponse = versionResponse;\n if (desiredStatus && desiredStatus !== currentStatus) {\n try {\n finalResponse = await updateServerStatus(serverName, version, desiredStatus);\n } catch (err) {\n const error = err as { code?: string; message?: string };\n if (error.message === 'Server version not found') {\n throw new ProblemError(\n createProblem(\n 404,\n 'Server version not found',\n `No version ${version} found for ${serverName}.`,\n c,\n ),\n );\n }\n if (error.code === 'StatusTransitionNotAllowed') {\n throw new ProblemError(\n createProblem(\n 409,\n 'Invalid status transition',\n 'Deleted versions cannot transition back to active or deprecated.',\n c,\n [\n {\n location: 'query.status',\n message: 'Cannot transition from deleted to another status',\n value: desiredStatus,\n },\n ],\n ),\n );\n }\n throw err;\n }\n }\n\n metricsState.updateTotal += 1;\n return c.json(finalResponse);\n});\n\napp.get('/v0/health', (c: Context) => {\n const uptimeSeconds = Math.floor((Date.now() - START_TIME) / 1000);\n const payload: HealthBody & {\n uptimeSeconds: number;\n timestamp: string;\n metrics: { publishTotal: number; updateTotal: number; authExchangeTotal: number };\n } = {\n status: 'ok',\n uptimeSeconds,\n timestamp: new Date().toISOString(),\n metrics: {\n publishTotal: metricsState.publishTotal,\n updateTotal: metricsState.updateTotal,\n authExchangeTotal: Array.from(metricsState.authExchanges.values()).reduce(\n (sum, value) => sum + value,\n 0,\n ),\n },\n };\n return c.json(payload);\n});\n\napp.get('/v0/ping', (c: Context) => {\n const payload: PingBody = {\n environment: 'subregistry',\n version: API_VERSION,\n };\n return c.json(payload);\n});\n\napp.post('/v0/auth/github-at', (c: Context) =>\n handleAuthExchange(c, {\n method: 'github-at',\n secretEnvKey: 'GITHUB_AT_SHARED_SECRET',\n namespaceMode: 'github',\n request: {\n required: [\n { names: ['github_access_token'], description: 'GitHub access token' },\n ],\n extractSecret: (_body, getField) => getField('github_access_token'),\n },\n }),\n);\n\napp.post('/v0/auth/github-oidc', (c: Context) =>\n handleAuthExchange(c, {\n method: 'github-oidc',\n secretEnvKey: 'GITHUB_OIDC_SHARED_SECRET',\n namespaceMode: 'github',\n request: {\n required: [\n { names: ['github_oidc_token'], description: 'GitHub OIDC token' },\n ],\n extractSecret: (_body, getField) => getField('github_oidc_token'),\n },\n }),\n);\n\napp.post('/v0/auth/dns', (c: Context) =>\n handleAuthExchange(c, {\n method: 'dns',\n secretEnvKey: 'DNS_SHARED_SECRET',\n namespaceMode: 'domain',\n request: {\n required: [\n { names: ['challenge'], description: 'DNS challenge' },\n { names: ['dns_record', 'dnsRecord'], description: 'DNS record' },\n ],\n extractSecret: (_body, getField) => getField('challenge'),\n },\n }),\n);\n\napp.post('/v0/auth/http', (c: Context) =>\n handleAuthExchange(c, {\n method: 'http',\n secretEnvKey: 'HTTP_SHARED_SECRET',\n namespaceMode: 'domain',\n request: {\n required: [\n { names: ['challenge'], description: 'HTTP challenge' },\n { names: ['signature'], description: 'HTTP challenge signature' },\n ],\n extractSecret: (_body, getField) => getField('signature'),\n },\n }),\n);\n\napp.post('/v0/auth/oidc', (c: Context) =>\n handleAuthExchange(c, {\n method: 'oidc',\n secretEnvKey: 'OIDC_SHARED_SECRET',\n namespaceMode: 'generic',\n request: {\n required: [\n { names: ['oidc_token', 'google_oidc_token'], description: 'OIDC token' },\n ],\n extractSecret: (_body, getField) =>\n getField('oidc_token') ?? getField('google_oidc_token'),\n },\n }),\n);\n\napp.get('/metrics', (c: Context) => {\n const uptimeSeconds = Math.floor((Date.now() - START_TIME) / 1000);\n const lines: string[] = [];\n lines.push('# HELP registry_publish_total Total successful server publish operations.');\n lines.push('# TYPE registry_publish_total counter');\n lines.push(`registry_publish_total ${metricsState.publishTotal}`);\n\n lines.push('# HELP registry_update_total Total successful server update operations.');\n lines.push('# TYPE registry_update_total counter');\n lines.push(`registry_update_total ${metricsState.updateTotal}`);\n\n lines.push('# HELP registry_auth_exchange_total Total auth exchanges by method.');\n lines.push('# TYPE registry_auth_exchange_total counter');\n for (const [method, count] of metricsState.authExchanges.entries()) {\n lines.push(`registry_auth_exchange_total{method=\"${method}\"} ${count}`);\n }\n\n lines.push('# HELP registry_uptime_seconds Process uptime in seconds.');\n lines.push('# TYPE registry_uptime_seconds gauge');\n lines.push(`registry_uptime_seconds ${uptimeSeconds}`);\n\n return new Response(lines.join('\\n') + '\\n', {\n status: 200,\n headers: {\n 'content-type': 'text/plain; version=0.0.4',\n },\n });\n});\n\nexport default app.fetch;\n\nasync function ensurePublishAuth(\n c: Context<{ Bindings: RegistryBindings }>,\n): Promise {\n const secret = c.env?.REGISTRY_AUTH_SECRET;\n if (!secret) {\n throw new ProblemError(\n createProblem(\n 500,\n 'Server configuration error',\n 'REGISTRY_AUTH_SECRET is not configured for this subregistry.',\n c,\n ),\n );\n }\n const header = c.req.header('authorization');\n if (!header?.startsWith('Bearer ')) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Bearer token is required for this operation.', c),\n );\n }\n const token = header.slice('Bearer '.length).trim();\n const claims = await verifyRegistryToken(token, secret, c);\n if (claims.exp * 1000 <= Date.now()) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token has expired.', c),\n );\n }\n return claims;\n}\n\nasync function readJson(c: Context<{ Bindings: RegistryBindings }>): Promise {\n try {\n return await c.req.json();\n } catch {\n throw new ProblemError(\n createProblem(400, 'Invalid JSON body', 'Failed to parse request body as JSON.', c),\n );\n }\n}\n\nexport type IssueTokenParams = {\n namespaces: string[];\n method: string;\n secret: string | undefined;\n expiresInSeconds?: number;\n context: Context<{ Bindings: RegistryBindings }>;\n};\n\nexport type AuthMethodConfig = {\n method: string;\n secretEnvKey: keyof RegistryBindings;\n namespaceMode: 'github' | 'domain' | 'generic';\n request: AuthRequestSpec;\n};\n\nasync function handleAuthExchange(\n c: Context<{ Bindings: RegistryBindings }>,\n config: AuthMethodConfig,\n): Promise {\n const sharedSecret = c.env?.[config.secretEnvKey];\n if (!sharedSecret) {\n throw new ProblemError(\n createProblem(\n 501,\n 'Not Implemented',\n `${config.method} auth exchange is not configured on this subregistry.`,\n c,\n ),\n );\n }\n\n const body = await readJson>(c);\n\n const fieldValues = new Map();\n for (const spec of config.request.required) {\n let matchedValue: string | undefined;\n let matchedField: string | undefined;\n for (const fieldName of spec.names) {\n const raw = body[fieldName];\n if (typeof raw === 'string') {\n const trimmed = raw.trim();\n if (trimmed.length > 0) {\n matchedValue = trimmed;\n matchedField = fieldName;\n break;\n }\n }\n }\n if (!matchedValue || !matchedField) {\n const primary = spec.names[0];\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid request',\n `${spec.description} is required.`,\n c,\n [\n {\n location: `body.${primary}`,\n message: `Expected ${spec.description} as a non-empty string.`,\n },\n ],\n ),\n );\n }\n for (const alias of spec.names) {\n if (!fieldValues.has(alias)) {\n fieldValues.set(alias, matchedValue);\n }\n }\n }\n\n const getField = (field: string): string | undefined => {\n const cached = fieldValues.get(field);\n if (cached) {\n return cached;\n }\n const raw = body[field];\n if (typeof raw === 'string') {\n const trimmed = raw.trim();\n return trimmed.length > 0 ? trimmed : undefined;\n }\n return undefined;\n };\n\n const credential = config.request.extractSecret(body, getField);\n if (!credential) {\n const hint = config.request.required[0]?.names[0] ?? 'credential';\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid request',\n `Missing credential required for ${config.method} authentication.`,\n c,\n [\n {\n location: `body.${hint}`,\n message: 'Provide a non-empty credential value.',\n },\n ],\n ),\n );\n }\n\n if (credential !== sharedSecret) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', `Authentication failed for ${config.method}.`, c),\n );\n }\n\n const namespacesRaw = body['namespaces'];\n if (!Array.isArray(namespacesRaw) || namespacesRaw.length === 0) {\n throw new ProblemError(\n createProblem(400, 'Invalid request', 'namespaces must be a non-empty array of strings.', c),\n );\n }\n const namespacesInput: string[] = [];\n for (const ns of namespacesRaw) {\n if (typeof ns !== 'string') {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid request',\n 'namespaces must only contain string values.',\n c,\n ),\n );\n }\n namespacesInput.push(ns);\n }\n\n let expiresInSeconds: number | undefined;\n const expiresRaw =\n body['expires_in_seconds'] ??\n body['expiresInSeconds'];\n if (typeof expiresRaw === 'number' && Number.isFinite(expiresRaw)) {\n expiresInSeconds = expiresRaw;\n } else if (typeof expiresRaw === 'string' && expiresRaw.trim()) {\n const parsed = Number(expiresRaw);\n if (!Number.isNaN(parsed) && Number.isFinite(parsed)) {\n expiresInSeconds = parsed;\n }\n }\n\n const normalizedNamespaces = normalizeNamespaceList(namespacesInput);\n validateNamespaceList(normalizedNamespaces, config.namespaceMode, c);\n\n const { token, claims } = await issueRegistryToken({\n namespaces: normalizedNamespaces,\n method: config.method,\n secret: c.env?.REGISTRY_AUTH_SECRET,\n expiresInSeconds,\n context: c,\n });\n recordAuthExchange(config.method);\n\n return c.json({\n token,\n registry_token: token,\n expires_at: new Date(claims.exp * 1000).toISOString(),\n namespaces: claims.namespaces,\n methods: claims.methods,\n });\n}\n\nfunction normalizeNamespaceList(values: string[]): string[] {\n const unique = new Set();\n for (const raw of values) {\n const normalized = raw.trim().toLowerCase();\n if (normalized) {\n unique.add(normalized);\n }\n }\n return Array.from(unique);\n}\n\nfunction validateNamespaceList(\n namespaces: string[],\n mode: 'github' | 'domain' | 'generic',\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n if (namespaces.length === 0) {\n throw new ProblemError(\n createProblem(400, 'Invalid request', 'At least one namespace must be provided.', c),\n );\n }\n\n const invalid: string[] = [];\n for (const ns of namespaces) {\n if (!isNamespaceFormatValid(ns) || !namespaceModeMatches(ns, mode)) {\n invalid.push(ns);\n }\n }\n\n if (invalid.length > 0) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid namespaces',\n `The following namespaces are invalid for ${mode} auth: ${invalid.join(', ')}`,\n c,\n ),\n );\n }\n}\n\nfunction isNamespaceFormatValid(ns: string): boolean {\n if (!ns) return false;\n const segments = ns.split('.');\n if (segments.length === 0) return false;\n return segments.every((segment) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(segment));\n}\n\nfunction namespaceModeMatches(ns: string, mode: 'github' | 'domain' | 'generic'): boolean {\n if (mode === 'github') {\n return ns.startsWith('io.github.') && ns.split('.').length >= 3;\n }\n if (mode === 'domain') {\n const segments = ns.split('.');\n return segments.length >= 2 && segments.every(Boolean);\n }\n return true;\n}\n\nfunction namespaceIsAllowed(allowed: string, actual: string): boolean {\n if (actual === allowed) return true;\n return actual.startsWith(`${allowed}.`);\n}\n\nfunction extractNamespacePrefix(serverName: string): string {\n const trimmed = serverName.trim().toLowerCase();\n if (!trimmed) return '';\n const slashIndex = trimmed.indexOf('/');\n return slashIndex === -1 ? trimmed : trimmed.slice(0, slashIndex);\n}\n\nfunction assertNamespaceAuthorized(\n claims: RegistryTokenClaims,\n serverName: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const namespace = extractNamespacePrefix(serverName);\n if (!namespace) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid server name',\n 'Server name must include a namespace prefix (e.g., io.github.user/server).',\n c,\n ),\n );\n }\n\n const authorized = claims.namespaces.some((allowed) => namespaceIsAllowed(allowed, namespace));\n if (!authorized) {\n throw new ProblemError(\n createProblem(\n 403,\n 'Forbidden',\n `Token is not authorized for namespace ${namespace}.`,\n c,\n ),\n );\n }\n}\n\nasync function issueRegistryToken(params: IssueTokenParams): Promise<{\n token: string;\n claims: RegistryTokenClaims;\n}> {\n const { namespaces, method, secret, expiresInSeconds, context } = params;\n if (!secret) {\n throw new ProblemError(\n createProblem(\n 500,\n 'Server configuration error',\n 'REGISTRY_AUTH_SECRET is not configured for this subregistry.',\n context,\n ),\n );\n }\n\n const uniqueNamespaces = Array.from(new Set(namespaces)).sort();\n const issuedAt = Math.floor(Date.now() / 1000);\n const ttl = expiresInSeconds != null && Number.isFinite(expiresInSeconds)\n ? Math.min(Math.max(Math.floor(expiresInSeconds), 60), 86_400)\n : 3_600;\n const claims: RegistryTokenClaims = {\n version: 1,\n namespaces: uniqueNamespaces,\n methods: [method],\n iat: issuedAt,\n exp: issuedAt + ttl,\n };\n\n const token = await signRegistryToken(claims, secret);\n return { token, claims };\n}\n\nasync function signRegistryToken(claims: RegistryTokenClaims, secret: string): Promise {\n const header = { alg: 'HS256', typ: 'JWT' };\n const headerSegment = base64UrlEncodeString(JSON.stringify(header));\n const payloadSegment = base64UrlEncodeString(JSON.stringify(claims));\n const data = `${headerSegment}.${payloadSegment}`;\n const key = await getHmacKey(secret);\n const signatureBuffer = await crypto.subtle.sign('HMAC', key, TEXT_ENCODER.encode(data));\n const signatureSegment = base64UrlEncode(new Uint8Array(signatureBuffer));\n return `${data}.${signatureSegment}`;\n}\n\nasync function verifyRegistryToken(\n token: string,\n secret: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): Promise {\n const parts = token.split('.');\n if (parts.length !== 3) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Invalid registry token format.', c),\n );\n }\n\n const [headerSegment, payloadSegment, signatureSegment] = parts;\n const data = `${headerSegment}.${payloadSegment}`;\n const key = await getHmacKey(secret);\n const signatureBytes = base64UrlDecode(signatureSegment);\n const signatureCopy = new Uint8Array(signatureBytes);\n const verified = await crypto.subtle.verify(\n 'HMAC',\n key,\n signatureCopy,\n TEXT_ENCODER.encode(data),\n );\n if (!verified) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token signature is invalid.', c),\n );\n }\n\n try {\n const claimsJson = base64UrlDecodeToString(payloadSegment);\n return normalizeClaims(JSON.parse(claimsJson), c);\n } catch {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token payload could not be parsed.', c),\n );\n }\n}\n\nfunction normalizeClaims(\n raw: unknown,\n c: Context<{ Bindings: RegistryBindings }>,\n): RegistryTokenClaims {\n if (!raw || typeof raw !== 'object') {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token payload is malformed.', c),\n );\n }\n\n const obj = raw as Record;\n if (obj['version'] !== 1) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token version is unsupported.', c),\n );\n }\n\n const namespacesRaw = obj['namespaces'];\n if (!Array.isArray(namespacesRaw) || namespacesRaw.length === 0) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token namespaces are missing.', c),\n );\n }\n const namespaceStrings: string[] = [];\n for (const ns of namespacesRaw) {\n if (typeof ns !== 'string') {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token namespaces are invalid.', c),\n );\n }\n namespaceStrings.push(ns);\n }\n const namespaces = normalizeNamespaceList(namespaceStrings);\n validateNamespaceList(namespaces, 'generic', c);\n\n const methodsRaw = Array.isArray(obj['methods']) ? obj['methods'] : [];\n const methods: string[] = [];\n for (const method of methodsRaw) {\n if (typeof method === 'string' && method.trim()) {\n methods.push(method.trim());\n }\n }\n if (methods.length === 0) {\n methods.push('unknown');\n }\n\n const iat = Number(obj['iat']);\n const exp = Number(obj['exp']);\n if (!Number.isFinite(iat) || !Number.isFinite(exp) || exp <= iat) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token timestamps are invalid.', c),\n );\n }\n\n return {\n version: 1,\n namespaces,\n methods,\n iat: Math.floor(iat),\n exp: Math.floor(exp),\n };\n}\n\nfunction base64UrlEncode(data: Uint8Array): string {\n let binary = '';\n for (const byte of data) {\n binary += String.fromCharCode(byte);\n }\n return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/g, '');\n}\n\nfunction base64UrlEncodeString(value: string): string {\n return base64UrlEncode(TEXT_ENCODER.encode(value));\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n const padLength = (4 - (value.length % 4)) % 4;\n const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(padLength);\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\nfunction base64UrlDecodeToString(value: string): string {\n return TEXT_DECODER.decode(base64UrlDecode(value));\n}\n\nasync function getHmacKey(secret: string): Promise {\n let cached = HMAC_KEY_CACHE.get(secret);\n if (!cached) {\n cached = crypto.subtle.importKey(\n 'raw',\n TEXT_ENCODER.encode(secret),\n { name: 'HMAC', hash: 'SHA-256' },\n false,\n ['sign', 'verify'],\n );\n HMAC_KEY_CACHE.set(secret, cached);\n }\n return cached;\n}\n\nfunction validateOfficialPolicies(\n payload: ServerJSON,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const namespace = extractNamespacePrefix(payload.name ?? '');\n if (!namespace) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid server name',\n 'Server name must include a namespace prefix before the first slash.',\n c,\n ),\n );\n }\n\n validateMetaNamespace(payload as Record, c);\n validatePackagesNamespace(payload as Record, namespace, c);\n validateRemoteNamespace(payload as Record, namespace, c);\n}\n\nfunction validateMetaNamespace(\n payload: Record,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const meta = payload._meta;\n if (meta == null) return;\n if (typeof meta !== 'object' || Array.isArray(meta)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n '_meta must be an object containing only the `publisher` key.',\n c,\n ),\n );\n }\n\n const metaRecord = meta as Record;\n const invalidKeys = Object.keys(metaRecord).filter((key) => key !== 'publisher');\n if (invalidKeys.length > 0) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n `_meta may only contain the \\`publisher\\` key when publishing to the official registry.`,\n c,\n invalidKeys.map((key) => ({\n location: `_meta.${key}`,\n message: 'Unexpected key present in `_meta`.',\n })),\n ),\n );\n }\n\n try {\n const serialized = JSON.stringify(metaRecord);\n if (serialized.length > 4096) {\n throw new ProblemError(\n createProblem(\n 413,\n '_meta too large',\n '_meta.publisher must be at most 4KB when serialized.',\n c,\n ),\n );\n }\n } catch {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n 'Failed to serialize `_meta.publisher` while checking size limits.',\n c,\n ),\n );\n }\n}\n\nconst PACKAGE_REGISTRY_BASE_URLS: Record = {\n npm: 'https://registry.npmjs.org',\n pypi: 'https://pypi.org',\n nuget: 'https://api.nuget.org',\n oci: 'https://docker.io',\n mcpb: null,\n};\n\nfunction validatePackagesNamespace(\n payload: Record,\n namespace: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const packages = Array.isArray(payload.packages) ? payload.packages : [];\n for (const [index, pkg] of packages.entries()) {\n if (!pkg || typeof pkg !== 'object') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid package entry',\n `packages[${index}] must be an object describing a package option.`,\n c,\n ),\n );\n }\n const pkgRecord = pkg as Record;\n const registryType = (pkgRecord.registryType ??\n pkgRecord.registry_type) as string | undefined;\n if (!registryType || !(registryType in PACKAGE_REGISTRY_BASE_URLS)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported package registry',\n `packages[${index}].registryType must be one of npm, pypi, nuget, oci, or mcpb.`,\n c,\n ),\n );\n }\n\n const identifier = (pkgRecord.identifier ?? pkgRecord.name) as string | undefined;\n if (!identifier || typeof identifier !== 'string') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Missing package identifier',\n `packages[${index}] must include an identifier string.`,\n c,\n ),\n );\n }\n\n const baseUrl = (pkgRecord.registryBaseUrl ??\n pkgRecord.registry_base_url) as string | undefined;\n const allowedBase = PACKAGE_REGISTRY_BASE_URLS[registryType];\n if (allowedBase) {\n if (!baseUrl || baseUrl !== allowedBase) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Disallowed registry base URL',\n `packages[${index}] must use registry_base_url \"${allowedBase}\".`,\n c,\n ),\n );\n }\n }\n\n if (registryType === 'mcpb') {\n const identifierHasMcp = identifier.toLowerCase().includes('mcp');\n if (!identifierHasMcp) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid MCPB identifier',\n `packages[${index}].identifier must contain \"mcp\" when publishing MCPB bundles.`,\n c,\n ),\n );\n }\n\n const sha =\n (pkgRecord.fileSha256 as string | undefined) ??\n (pkgRecord.file_sha256 as string | undefined);\n if (!sha || !/^[a-f0-9]{64}$/i.test(sha)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Missing MCPB SHA-256',\n `packages[${index}] must include file_sha256 with a 64-character hex digest.`,\n c,\n ),\n );\n }\n\n if (!identifier.startsWith('https://github.com/') && !identifier.startsWith('https://gitlab.com/')) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported MCPB host',\n `packages[${index}].identifier must point to a GitHub or GitLab release asset.`,\n c,\n ),\n );\n }\n }\n }\n}\n\nfunction validateRemoteNamespace(\n payload: Record,\n namespace: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const remotes = Array.isArray(payload.remotes) ? payload.remotes : [];\n if (remotes.length === 0) return;\n\n const domain = namespaceToDomain(namespace);\n for (const [index, remote] of remotes.entries()) {\n if (!remote || typeof remote !== 'object') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid remote entry',\n `remotes[${index}] must be an object describing a remote transport.`,\n c,\n ),\n );\n }\n const remoteRecord = remote as Record;\n const urlRaw = remoteRecord.url as string | undefined;\n if (!urlRaw) {\n throw new ProblemError(\n createProblem(422, 'Missing remote URL', `remotes[${index}] is missing a url.`, c),\n );\n }\n\n let parsed: URL;\n try {\n parsed = new URL(urlRaw);\n } catch {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid remote URL',\n `remotes[${index}].url must be a valid absolute URL.`,\n c,\n ),\n );\n }\n\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported remote protocol',\n `remotes[${index}].url must use http or https.`,\n c,\n ),\n );\n }\n\n if (domain) {\n const host = parsed.hostname.toLowerCase();\n if (host !== domain && !host.endsWith(`.${domain}`)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Remote URL mismatch',\n `remotes[${index}].url must be hosted on ${domain} or its subdomains for namespace ${namespace}.`,\n c,\n ),\n );\n }\n }\n }\n}\n\nfunction namespaceToDomain(namespace: string): string | null {\n const lower = namespace.toLowerCase();\n if (lower.startsWith('io.github.')) {\n return null;\n }\n const segments = lower.split('.');\n if (segments.length < 2) {\n return null;\n }\n const reversed = [...segments].reverse();\n return reversed.join('.');\n}\n\nfunction decodePathParam(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\nfunction createProblem(\n status: number,\n title: string,\n detail: string,\n c: Context<{ Bindings: RegistryBindings }>,\n errors?: ErrorModel['errors'],\n): ErrorModel {\n return {\n type: 'about:blank',\n title,\n status,\n detail,\n instance: c.req.path,\n errors: errors?.length ? errors : undefined,\n };\n}\n\nfunction createValidationProblem(\n status: number,\n title: string,\n detail: string,\n c: Context<{ Bindings: RegistryBindings }>,\n issues: NormalizedIssue[],\n): ErrorModel {\n const errors = issues.map((issue) => ({\n location: issue.path.length ? issue.path.join('.') : 'body',\n message: issue.message,\n value: issue.received,\n }));\n return createProblem(status, title, detail, c, errors);\n}\n\nfunction problemResponse(\n c: Context<{ Bindings: RegistryBindings }>,\n problem: ErrorModel,\n): Response {\n const status = problem.status ?? 500;\n return new Response(JSON.stringify(problem), {\n status,\n headers: {\n 'content-type': 'application/problem+json',\n },\n });\n}\n\nfunction toValidationIssues(\n issues: ReadonlyArray<{ path: (string | number)[]; message: string }>,\n): NormalizedIssue[] {\n return issues.map((issue) => ({\n path: Array.isArray(issue.path) ? issue.path : [],\n message: issue.message ?? 'Invalid value',\n received: (issue as Record).received,\n }));\n}\n\nfunction recordAuthExchange(method: string): void {\n const current = metricsState.authExchanges.get(method) ?? 0;\n metricsState.authExchanges.set(method, current + 1);\n}\n","deleted","label",[99],"permalink","https://www.val.town/x/cameronpak/mcp-registry-subregistry-api/code/main.ts","extension","actionData","errors"]