[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","mcpconformance","name","mcp-client-conformance","path","src/scenarios/client/auth-checker.ts","project",{"_22":50,"_11":12,"_35":51,"_52":-5,"_53":44,"_54":55,"_56":55,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":34,"_64":-5,"_65":-5,"_66":38,"_67":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/mcpconformance/mcp-client-conformance/code/src/scenarios/client/auth-checker.ts","extension","id","ae5adfaf-4175-4bcb-b0fa-e6b9db5bf7fc","auth-checker.ts","fileId","ddeaad80-ad13-11f1-8de9-1607ee4eb77e","parentId","10de8c75-8bc0-4b41-a330-aa6a631a25cf","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","branchVersion",36,"latest",true,"createdAt",["D",1789043626411],"version",0,"fileType","script","content","/**\n * Auth checker — a stateless re-auth chain.\n *\n * One MCP server, three auth rungs. Each rung is reached by forcing the\n * client back through authorization under a DIFFERENT configuration, using\n * only the spec's own signals:\n *\n * rung 1 \"basic\" 401 challenge → PRM #1 → AS #1: PKCE S256 + DCR +\n * RFC 8707 resource indicator.\n * rung 2 \"scoped\" calling advance_to_scoped with a basic token → 401\n * whose WWW-Authenticate points at PRM #2 (different AS,\n * SEP-835: scope must be taken from scopes_supported).\n * rung 3 \"step-up\" calling advance_to_stepup with only conformance:read →\n * 403 insufficient_scope, scope=\"… conformance:write\"\n * (RFC 6750 step-up at the same AS).\n *\n * The access token IS the progress report: `ac.`, so\n * possession of a token with cfg=scoped and conformance:write proves the\n * client handled discovery, a challenge-driven AS switch, SEP-835 scope\n * selection, and 403 step-up — with zero server-side state. The final\n * auth_complete tool spells that out.\n *\n * Like the consent gate in checker-2026-07-28, the embedded ASs are\n * deliverers of specific challenge shapes, not auth conformance tests in\n * themselves — but unlike the consent gate they auto-redirect, so the whole\n * chain is automatable.\n */\n\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n CallToolResult,\n ListToolsRequestSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash } from 'node:crypto';\nimport type { ConformanceCheck } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\n\nconst SERVER_INFO = { name: 'mcp-checker-auth', version: '1.0.0' };\n\nconst SCOPE_READ = 'conformance:read';\nconst SCOPE_WRITE = 'conformance:write';\n\ntype Cfg = 'basic' | 'scoped' | 'isstrap';\n\ninterface TokenClaims {\n cfg: Cfg;\n scope: string;\n /** Set on tokens minted through the iss-mismatch trap — see rung 4. */\n trap?: string;\n}\n\nfunction mintToken(claims: TokenClaims): string {\n return `ac.${Buffer.from(JSON.stringify(claims)).toString('base64url')}`;\n}\n\nfunction parseToken(\n authorization: string | undefined\n): TokenClaims | undefined {\n const m = /^Bearer ac\\.([A-Za-z0-9_-]+)$/.exec(authorization ?? '');\n if (!m) return undefined;\n try {\n const claims = JSON.parse(Buffer.from(m[1], 'base64url').toString());\n if (!['basic', 'scoped', 'isstrap'].includes(claims.cfg)) return undefined;\n return {\n cfg: claims.cfg,\n scope: String(claims.scope ?? ''),\n ...(claims.trap ? { trap: String(claims.trap) } : {})\n };\n } catch {\n return undefined;\n }\n}\n\nconst hasScope = (t: TokenClaims, scope: string) =>\n t.scope.split(' ').includes(scope);\n\n/** What each successfully-reached rung proves about the client. */\nconst RUNG_PROOF: Record = {\n auth_status: 'you completed at least one full authorization flow',\n advance_to_scoped:\n 'your client handled a mid-session 401 whose WWW-Authenticate pointed ' +\n 'at a DIFFERENT resource_metadata, re-discovered, re-registered at the ' +\n 'second AS, and requested the scope advertised in scopes_supported ' +\n '(SEP-835)',\n advance_to_stepup:\n 'your client handled a 403 insufficient_scope challenge by ' +\n 're-authorizing with the broader scope from the challenge (RFC 6750 ' +\n 'step-up) while staying at the same AS',\n auth_complete:\n 'ALL AUTH RUNGS PASSED: initial discovery + PKCE S256 + DCR + RFC 8707 ' +\n 'resource indicator (rung 1), challenge-driven AS switch + SEP-835 ' +\n 'scope selection (rung 2), 403 insufficient_scope step-up (rung 3)'\n};\n\nconst TOOLS = [\n {\n name: 'auth_status',\n description:\n 'Reports which auth rung your current access token proves. Call this ' +\n 'first and after each advance.'\n },\n {\n name: 'advance_to_scoped',\n description:\n 'Rung 2 gate. With a rung-1 (basic) token this returns HTTP 401 whose ' +\n 'WWW-Authenticate names a different resource_metadata — re-authorize ' +\n 'through it (note its scopes_supported) and retry.'\n },\n {\n name: 'advance_to_stepup',\n description:\n `Rung 3 gate. Requires ${SCOPE_WRITE}; with only ${SCOPE_READ} this ` +\n 'returns HTTP 403 insufficient_scope naming the scope to add — ' +\n 're-authorize with it and retry.'\n },\n {\n name: 'auth_complete',\n description:\n 'The finish line. Succeeds only with a token proving every rung; the ' +\n 'result is the full report.'\n },\n {\n name: 'check_iss_validation',\n description:\n 'OPTIONAL TRAP (RFC 9207 / SEP-2468). Calling this returns a 401 ' +\n 'pointing at an AS that advertises ' +\n 'authorization_response_iss_parameter_supported: true but sends a ' +\n 'WRONG iss in the authorization response. This tool can NEVER return ' +\n 'success: a conformant client refuses to exchange the code (your own ' +\n 'client errors about the iss mismatch — that error IS the pass). A ' +\n 'client that exchanges the code anyway receives a poisoned token, and ' +\n 'every request made with it fails with an explanation. Run this last; ' +\n 'it ends the session either way.'\n }\n].map((t) => ({ ...t, inputSchema: { type: 'object', properties: {} } }));\n\nexport class AuthCheckerScenario extends HandlerScenario {\n name = 'checker-auth';\n description =\n 'Stateless auth re-auth chain: each tool rung forces re-authorization ' +\n 'under a different configuration (401 with a different ' +\n 'resource_metadata, then 403 insufficient_scope step-up). The access ' +\n 'token encodes progress; auth_complete succeeds only after every rung.';\n readonly source = { introducedIn: '2025-06-18' } as const;\n mcpPath = '';\n\n private checks: ConformanceCheck[] = [];\n\n handler(getBaseUrl: () => string): express.Application {\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: false }));\n\n const base = () => new URL(getBaseUrl());\n const basePath = () => (base().pathname === '/' ? '' : base().pathname);\n const prmUrl = (cfg: Cfg) =>\n `${base().origin}/.well-known/oauth-protected-resource${basePath()}${cfg === 'basic' ? '' : `/cfg/${cfg}`}`;\n const issuer = (cfg: Cfg) => `${getBaseUrl()}/as/${cfg}`;\n /** The deliberately-wrong iss value the trap AS puts in its redirects. */\n const wrongIss = () => `${getBaseUrl()}/as/mixup-attacker`;\n\n const record = (\n id: string,\n ok: boolean,\n description: string,\n details?: Record\n ) => {\n this.checks.push({\n id,\n name: id,\n description,\n status: ok ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Auth',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization'\n }\n ],\n details\n });\n };\n\n // ---------------- protected resource metadata (three variants) --------\n const prmDoc = (cfg: Cfg) => ({\n resource: getBaseUrl(),\n authorization_servers: [issuer(cfg)],\n bearer_methods_supported: ['header'],\n // SEP-835: rung 2's PRM advertises the scope the client must request.\n // Deliberately ONLY the read scope — the write scope must be learned\n // from the rung-3 403 challenge, otherwise an SDK that requests all of\n // scopes_supported up front would never exercise the step-up path.\n ...(cfg === 'scoped' ? { scopes_supported: [SCOPE_READ] } : {})\n });\n app.get('/.well-known/oauth-protected-resource', (_req, res) => {\n res.json(prmDoc('basic'));\n });\n app.get('/.well-known/oauth-protected-resource/cfg/scoped', (_req, res) => {\n res.json(prmDoc('scoped'));\n });\n app.get(\n '/.well-known/oauth-protected-resource/cfg/isstrap',\n (_req, res) => {\n res.json(prmDoc('isstrap'));\n }\n );\n\n // ---------------- the two ASs (path-based issuers, stateless) ---------\n const asMetadata = (cfg: Cfg) => (_req: Request, res: Response) => {\n res.json({\n issuer: issuer(cfg),\n authorization_endpoint: `${issuer(cfg)}/authorize`,\n token_endpoint: `${issuer(cfg)}/token`,\n registration_endpoint: `${issuer(cfg)}/register`,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code'],\n code_challenge_methods_supported: ['S256'],\n token_endpoint_auth_methods_supported: ['none'],\n ...(cfg === 'scoped'\n ? { scopes_supported: [SCOPE_READ, SCOPE_WRITE] }\n : {}),\n // RFC 9207: the trap AS PROMISES iss in authorization responses —\n // which obliges the client to validate it. The redirect then carries\n // a wrong one.\n ...(cfg === 'isstrap'\n ? { authorization_response_iss_parameter_supported: true }\n : {})\n });\n };\n for (const cfg of ['basic', 'scoped', 'isstrap'] as const) {\n app.get(\n `/.well-known/oauth-authorization-server/as/${cfg}`,\n asMetadata(cfg)\n );\n app.get(`/.well-known/openid-configuration/as/${cfg}`, asMetadata(cfg));\n\n app.post(`/as/${cfg}/register`, (req, res) => {\n res.status(201).json({\n ...req.body,\n client_id: `checker-auth-${cfg}-client`,\n token_endpoint_auth_method: 'none'\n });\n });\n\n app.get(`/as/${cfg}/authorize`, (req, res) => {\n const q = req.query as Record;\n const fail = (error: string, description: string) => {\n if (!q.redirect_uri) {\n res.status(400).json({ error, error_description: description });\n return;\n }\n const r = new URL(q.redirect_uri);\n r.searchParams.set('error', error);\n r.searchParams.set('error_description', description);\n if (q.state !== undefined) r.searchParams.set('state', q.state);\n res.redirect(r.toString());\n };\n if (\n q.code_challenge === undefined ||\n q.code_challenge_method !== 'S256'\n ) {\n fail('invalid_request', 'PKCE with S256 is required');\n return;\n }\n if (cfg === 'basic' && q.resource === undefined) {\n fail(\n 'invalid_target',\n 'RFC 8707: include the resource parameter naming the MCP server'\n );\n return;\n }\n const requested = (q.scope ?? '').split(' ').filter(Boolean);\n if (cfg === 'scoped' && !requested.includes(SCOPE_READ)) {\n fail(\n 'invalid_scope',\n `SEP-835: request the scopes advertised in the PRM scopes_supported (at least ${SCOPE_READ}); got '${q.scope ?? ''}'`\n );\n return;\n }\n record(\n `auth-checker-authorize-${cfg}`,\n true,\n `Conformant authorization request at the '${cfg}' AS`,\n { scope: q.scope }\n );\n if (!q.redirect_uri) {\n res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri required'\n });\n return;\n }\n const r = new URL(q.redirect_uri);\n r.searchParams.set(\n 'code',\n Buffer.from(\n JSON.stringify({\n cfg,\n challenge: q.code_challenge,\n scope: requested.join(' ')\n })\n ).toString('base64url')\n );\n if (q.state !== undefined) r.searchParams.set('state', q.state);\n // The trap: metadata promised iss, the response lies about it. A\n // conformant client compares this against the issuer it authorized\n // at and refuses to exchange the code (RFC 9207 §2.4).\n if (cfg === 'isstrap') r.searchParams.set('iss', wrongIss());\n res.redirect(r.toString());\n });\n\n app.post(`/as/${cfg}/token`, (req, res) => {\n const grant = req.body as Record;\n let code: { cfg?: string; challenge?: string; scope?: string };\n try {\n code = JSON.parse(\n Buffer.from(String(grant.code ?? ''), 'base64url').toString()\n );\n } catch {\n code = {};\n }\n if (grant.grant_type !== 'authorization_code' || code.cfg !== cfg) {\n res.status(400).json({ error: 'invalid_grant' });\n return;\n }\n const expected = createHash('sha256')\n .update(String(grant.code_verifier ?? ''))\n .digest('base64url');\n if (expected !== code.challenge) {\n res.status(400).json({\n error: 'invalid_grant',\n error_description: 'PKCE verification failed'\n });\n return;\n }\n const scope = code.scope ?? '';\n // Exchanging a trap code means the client ignored the iss mismatch —\n // the token records the offense and incriminates every later request.\n res.json({\n access_token: mintToken({\n cfg,\n scope,\n ...(cfg === 'isstrap'\n ? { trap: 'exchanged-code-despite-iss-mismatch' }\n : {})\n }),\n token_type: 'Bearer',\n expires_in: 3600,\n ...(scope ? { scope } : {})\n });\n });\n }\n\n // ---------------- landing -------------------------------------------\n app.get('/', (req, res) => {\n if (!String(req.headers.accept ?? '').includes('text/html')) {\n res.status(405).json({\n error: 'POST JSON-RPC to this URL (auth required)',\n docs: 'open this URL in a browser for a full explanation'\n });\n return;\n }\n res.type('html').send(`\nMCP Checker — Auth Chain\n\n\n

MCP Checker — Auth Chain

Checks a client's OAuth behavior by forcing it back through\nauthorization under different configurations, using only the spec's own signals.\nStateless: the access token itself encodes your progress.

Rung 1 — basic: any unauthenticated request → 401. Complete\ndiscovery, DCR, PKCE (S256), and send the RFC 8707 resource parameter.
Rung 2 — AS switch + scopes: call advance_to_scoped →\n401 whose WWW-Authenticate names a different resource_metadata.\nRe-authorize there, requesting the scope from scopes_supported (SEP-835).
Rung 3 — step-up: call advance_to_stepup →\n403 insufficient_scope naming ${SCOPE_WRITE}. Re-authorize with it.
Finish: auth_complete succeeds only with the final token\nand prints the full report.
Optional trap — iss validation (RFC 9207): check_iss_validation\nchallenges you toward an AS whose metadata promises iss in authorization\nresponses, then sends a wrong one. A conformant client refuses to exchange the\ncode — your client's own iss-mismatch error is the pass. A client that exchanges anyway\ngets a poisoned token and every request with it fails with the explanation. Run it last;\nit ends the session either way.

Your token is readable: ac.<base64url JSON> — decode it any time to\nsee what your client has proven.

\n`);\n });\n\n // ---------------- the MCP endpoint, gated per rung -------------------\n // HTTP header values must be Latin-1; keep the rich text in the body.\n const headerSafe = (s: string) => s.replace(/[^\\x20-\\x7e]/g, '-');\n const challenge401 = (res: Response, cfg: Cfg, description: string) => {\n res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"invalid_token\", error_description=\"${headerSafe(description)}\", resource_metadata=\"${prmUrl(cfg)}\"`\n )\n .json({ error: 'invalid_token', error_description: description });\n };\n\n app.post('/', async (req: Request, res: Response) => {\n const token = parseToken(req.headers.authorization);\n const body =\n req.body && !Array.isArray(req.body)\n ? (req.body as { method?: string; params?: { name?: string } })\n : {};\n\n if (!token) {\n challenge401(\n res,\n 'basic',\n 'Rung 1: authorize via the resource_metadata in this challenge'\n );\n return;\n }\n\n // NOTE: a poisoned token (minted by exchanging a wrong-iss code) is\n // NOT rejected at the HTTP layer. Doing so delivered the verdict on the\n // SDK's reconnect/initialize POST — a layer the agent never sees, so\n // the failure surfaced as an opaque \"reconnect failed: HTTP 400\". We\n // accept the token (the session stays alive) and instead fail the\n // check_iss_validation TOOL CALL in-band below, matching every other\n // rung's verdict style. Safe: the harness controls both ASs.\n\n // Gate the advance tools at the HTTP layer so the failures are real\n // OAuth challenges, not tool errors — that is the whole trick.\n const toolName =\n body.method === 'tools/call' ? body.params?.name : undefined;\n\n // The iss trap. A non-poisoned token gets challenged toward the trap AS\n // (a conformant client refuses mid-OAuth and never comes back — that\n // out-of-band refusal is the PASS). A poisoned token means the client\n // exchanged the wrong-iss code: fall through to the SDK dispatch, which\n // returns the FAIL verdict as an in-band tool result.\n if (toolName === 'check_iss_validation' && !token.trap) {\n record(\n 'auth-checker-iss-trap-armed',\n true,\n 'iss trap challenge issued'\n );\n challenge401(\n res,\n 'isstrap',\n 'iss validation check: re-authorize via the resource_metadata in this challenge. If your client validates iss (RFC 9207) it will refuse to complete - that refusal is the PASS'\n );\n return;\n }\n if (toolName === 'advance_to_scoped' && token.cfg !== 'scoped') {\n record(\n 'auth-checker-rung2-challenged',\n true,\n 'Rung 2 challenge issued'\n );\n challenge401(\n res,\n 'scoped',\n 'Rung 2: this rung requires the second AS configuration — re-authorize via the resource_metadata in this challenge and note its scopes_supported'\n );\n return;\n }\n if (\n (toolName === 'advance_to_stepup' || toolName === 'auth_complete') &&\n !(token.cfg === 'scoped' && hasScope(token, SCOPE_WRITE))\n ) {\n if (token.cfg !== 'scoped') {\n challenge401(res, 'scoped', 'Complete rung 2 before rung 3');\n return;\n }\n record('auth-checker-rung3-challenged', true, 'Rung 3 step-up issued');\n res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"insufficient_scope\", scope=\"${SCOPE_READ} ${SCOPE_WRITE}\", resource_metadata=\"${prmUrl('scoped')}\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: `Rung 3: re-authorize with '${SCOPE_WRITE}' (RFC 6750 step-up)`\n });\n return;\n }\n\n // Gate passed — serve via the SDK (per-request, stateless).\n const server = new Server(SERVER_INFO, {\n capabilities: { tools: {} },\n instructions:\n 'Auth-chain checker. Call auth_status, then advance_to_scoped, ' +\n 'then advance_to_stepup, then auth_complete. Each advance forces ' +\n 'a re-authorization under a different configuration; an HTTP ' +\n '401/403 along the way is the next challenge, not a failure.'\n });\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: TOOLS\n }));\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n // iss trap, fail path: reached only with a poisoned token, i.e.\n // the client exchanged a code whose response carried a wrong iss.\n // Deliver the verdict in-band so it surfaces as a tool result, not\n // a swallowed transport error — and keep the session alive.\n if (request.params.name === 'check_iss_validation') {\n record(\n 'auth-checker-iss-trap-caught',\n false,\n 'Client exchanged an authorization code despite an iss mismatch',\n { iss: wrongIss(), expected: issuer('isstrap') }\n );\n return {\n content: [\n {\n type: 'text',\n text:\n 'FAIL [check_iss_validation]: client exchanged an ' +\n `authorization code whose response carried iss='${wrongIss()}', ` +\n `expected '${issuer('isstrap')}' (RFC 9207 / SEP-2468). The ` +\n 'trap AS advertised ' +\n 'authorization_response_iss_parameter_supported: true, so a ' +\n 'conformant client MUST compare iss against the issuer it ' +\n 'authorized at and abort BEFORE the token exchange. ' +\n 'Reaching this tool result means your client did not — ' +\n 'leaving it open to authorization-server mix-up attacks.'\n }\n ],\n isError: true\n };\n }\n const proof = RUNG_PROOF[request.params.name];\n if (!proof) {\n return {\n content: [\n {\n type: 'text',\n text: `unknown tool '${request.params.name}'`\n }\n ],\n isError: true\n };\n }\n record(`auth-checker-${request.params.name}`, true, proof, {\n cfg: token.cfg,\n scope: token.scope\n });\n const status =\n request.params.name === 'auth_status'\n ? `Token: cfg=${token.cfg}, scope='${token.scope}' — ${\n token.cfg === 'basic'\n ? 'rung 1 done; call advance_to_scoped next.'\n : hasScope(token, SCOPE_WRITE)\n ? 'all rungs done; call auth_complete.'\n : 'rung 2 done; call advance_to_stepup next.'\n }`\n : proof;\n return {\n content: [\n {\n type: 'text',\n text: `CONFORMANCE OK [${request.params.name}]: ${status}`\n }\n ]\n };\n }\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n void transport.close();\n void server.close();\n });\n });\n\n return app;\n }\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n}\n","deleted",false,"label",[47,48,49,24],"src","scenarios","client","7dcb6042-d92f-40c5-9cc8-0f661f96e58b",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":-5},"org",{"_9":10,"_99":100,"_101":-5,"_59":-5,"_102":103,"_104":44},"branch",{"_37":89,"_11":90,"_22":30,"_91":50,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":44,"_146":44,"_147":44,"_148":34,"_149":-5,"_150":-7,"_151":-7,"_152":38,"_153":44,"_154":44,"_155":-5,"_156":44,"_157":44,"_158":44,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":90,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]