Error

${escapeHtml(message)}

`;\n}\n\nfunction authorizePage(params: {\n origin: string;\n rpId: string;\n clientId: string;\n clientName: string;\n redirectUri: string;\n codeChallenge: string;\n codeChallengeMethod: string;\n scope: string;\n state: string;\n resource: string;\n}): string {\n return `\nSign in — sync-mcp\n\n\n\n\n

\n\n \n

sync·mcp

\n\n

\n \n \n

\n\n \n\n \n\n

\n\n \n \n\n

\n\n\n`;\n}\n\nconst CSS = `\n * { box-sizing: border-box; margin: 0; padding: 0; }\n body {\n font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", system-ui, sans-serif;\n background: #0a0a0f;\n color: #e0e0e8;\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n }\n .container { width: 100%; max-width: 420px; padding: 1rem; }\n .card {\n background: #16161f;\n border: 1px solid #2a2a3a;\n border-radius: 12px;\n padding: 2rem;\n }\n h1 { font-size: 1.5rem; margin-bottom: 0.75rem; font-weight: 600; }\n h1 .dim { color: #666; }\n .sub { color: #999; font-size: 0.9rem; margin-bottom: 1.5rem; line-height: 1.5; }\n .sub strong { color: #c8c8d8; }\n #mode-toggle { display: flex; gap: 0; margin-bottom: 1.25rem; border-radius: 8px; overflow: hidden; border: 1px solid #2a2a3a; }\n .tab {\n flex: 1; padding: 0.5rem; border: none; background: transparent; color: #888;\n cursor: pointer; font-size: 0.85rem; transition: all 0.2s;\n }\n .tab.active { background: #2a2a3a; color: #e0e0e8; }\n label { display: block; font-size: 0.8rem; color: #999; margin-bottom: 0.3rem; }\n input[type=\"text\"] {\n width: 100%; padding: 0.6rem 0.75rem; border: 1px solid #2a2a3a; border-radius: 8px;\n background: #0a0a0f; color: #e0e0e8; font-size: 0.95rem; margin-bottom: 1rem;\n outline: none; transition: border-color 0.2s;\n }\n input:focus { border-color: #5a5aff; }\n .primary {\n width: 100%; padding: 0.7rem; border: none; border-radius: 8px;\n background: #4a4aff; color: white; font-size: 0.95rem; font-weight: 500;\n cursor: pointer; transition: background 0.2s;\n }\n .primary:hover { background: #5a5aff; }\n .secondary {\n padding: 0.7rem 1.5rem; border: 1px solid #2a2a3a; border-radius: 8px;\n background: transparent; color: #999; font-size: 0.95rem; cursor: pointer;\n }\n .btn-row { display: flex; gap: 0.75rem; margin-top: 1.5rem; justify-content: flex-end; }\n .scope-box {\n background: #0a0a0f; border: 1px solid #2a2a3a; border-radius: 8px; padding: 1rem;\n margin: 1rem 0; font-size: 0.85rem;\n }\n .scope-box code { color: #8a8aff; }\n .scope-box ul { margin: 0.5rem 0 0 1.25rem; color: #999; }\n .scope-box li { margin: 0.25rem 0; }\n .status { color: #888; font-size: 0.85rem; margin-top: 0.75rem; min-height: 1.2em; }\n .error { color: #ff6b6b; font-size: 0.85rem; margin-top: 0.5rem; min-height: 1.2em; }\n`;\n\nfunction managePage(origin: string): string {\n return `\nManage — sync·mcp\n\n\n\n\n

\n\n \n

sync·mcp

\n \n

\n\n \n \n\n

\n\n

\n\n\n`;\n}\n\nfunction recoverPage(origin: string): string {\n return `\nRecover — sync·mcp\n\n\n\n\n

\n\n

sync·mcp

Enter your recovery token to register a new passkey for your existing account.

\n Recovery token\n \n \n

\n\n \n\n \n\n

\n\n`;\n}\n\nfunction escapeHtml(str: string): string {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}",[],[217],{"_104":227,"_97":228,"_162":229,"_164":-5,"_165":147,"_166":221,"_168":169,"_106":230,"_101":231,"_171":222,"_173":232,"_174":22,"_175":-5,"_176":233,"_100":234},"28aec25e-187a-11f1-9547-42dde27851f2","db.ts","6c76a564-1876-11f1-a7bf-42dde27851f2",["D",1772704837246],1,"/**\n * db.ts — SQLite schema + helpers for sync-mcp OAuth/WebAuthn/Vault\n *\n * Uses Val.town's per-val scoped SQLite database.\n * All tables prefixed with smcp_ to be explicit.\n */\nimport sqlite from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ─── Schema migration ────────────────────────────────────────────\n\nexport async function ensureSchema() {\n await sqlite.batch([\n // Users (identified by WebAuthn passkey)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_users (\n id TEXT PRIMARY KEY,\n username TEXT UNIQUE NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // WebAuthn credentials (passkeys)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_credentials (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL REFERENCES smcp_users(id),\n public_key BLOB NOT NULL,\n counter INTEGER NOT NULL DEFAULT 0,\n transports TEXT,\n device_type TEXT,\n backed_up INTEGER DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // WebAuthn challenges (short-lived)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_challenges (\n id TEXT PRIMARY KEY,\n challenge TEXT NOT NULL,\n user_id TEXT,\n type TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // OAuth clients (Dynamic Client Registration)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_oauth_clients (\n client_id TEXT PRIMARY KEY,\n client_secret TEXT,\n redirect_uris TEXT NOT NULL,\n client_name TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Authorization codes (short-lived, single-use)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_auth_codes (\n code TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n user_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n code_challenge TEXT NOT NULL,\n code_challenge_method TEXT NOT NULL DEFAULT 'S256',\n scope TEXT,\n resource TEXT,\n expires_at TEXT NOT NULL,\n used INTEGER DEFAULT 0\n )`,\n args: [],\n },\n // Access tokens\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_access_tokens (\n token TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n client_id TEXT NOT NULL,\n scope TEXT,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Refresh tokens\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_refresh_tokens (\n token TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n client_id TEXT NOT NULL,\n scope TEXT,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Token vault: maps authenticated users → sync tokens\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_vault (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL REFERENCES smcp_users(id),\n room_id TEXT NOT NULL,\n token TEXT NOT NULL,\n token_type TEXT NOT NULL,\n label TEXT,\n is_default INTEGER DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Sessions (WebAuthn → consent bridge)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_sessions (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Recovery tokens (passkey re-registration across RP ID changes)\n {\n sql: `CREATE TABLE IF NOT EXISTS smcp_recovery_tokens (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL REFERENCES smcp_users(id),\n token_hash TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n used INTEGER DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n ]);\n\n // ─── Schema migrations (add columns to existing tables) ────────\n const addColumn = async (table: string, col: string, typedef: string) => {\n try {\n await sqlite.execute({ sql: `ALTER TABLE ${table} ADD COLUMN ${col} ${typedef}`, args: [] });\n } catch (_) { /* already exists */ }\n };\n // Track which RP ID each credential was registered under\n await addColumn(\"smcp_credentials\", \"rp_id\", \"TEXT\");\n // Track session scope (consent vs recovery-registration-only)\n await addColumn(\"smcp_sessions\", \"scope\", \"TEXT DEFAULT 'consent'\");\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────\n\nexport function generateId(): string {\n return crypto.randomUUID();\n}\n\nexport async function generateToken(prefix = \"\"): Promise {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n const b64 = btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return prefix ? `${prefix}_${b64}` : b64;\n}\n\n// Base64url encode/decode\nexport function b64urlEncode(buf: Uint8Array): string {\n return btoa(String.fromCharCode(...buf))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\nexport function b64urlDecode(str: string): Uint8Array {\n const padded = str + \"=\".repeat((4 - (str.length % 4)) % 4);\n const binary = atob(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n}\n\n// SHA-256 for PKCE\nexport async function sha256(input: string): Promise {\n const data = new TextEncoder().encode(input);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n return b64urlEncode(new Uint8Array(hash));\n}\n\n// ─── User CRUD ───────────────────────────────────────────────────\n\nexport async function createUser(id: string, username: string) {\n await sqlite.execute({\n sql: \"INSERT INTO smcp_users (id, username) VALUES (?, ?)\",\n args: [id, username],\n });\n}\n\nexport async function getUserByUsername(username: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_users WHERE username = ?\",\n args: [username],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return { id: r[0] as string, username: r[1] as string, created_at: r[2] as string };\n}\n\nexport async function getUserById(id: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_users WHERE id = ?\",\n args: [id],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return { id: r[0] as string, username: r[1] as string, created_at: r[2] as string };\n}\n\n// ─── Credential CRUD ────────────────────────────────────────────\n\nexport async function saveCredential(cred: {\n id: string;\n userId: string;\n publicKey: Uint8Array;\n counter: number;\n transports?: string[];\n deviceType?: string;\n backedUp?: boolean;\n rpId?: string;\n}) {\n await sqlite.execute({\n sql: `INSERT INTO smcp_credentials (id, user_id, public_key, counter, transports, device_type, backed_up, rp_id)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n cred.id,\n cred.userId,\n b64urlEncode(cred.publicKey),\n cred.counter,\n cred.transports ? JSON.stringify(cred.transports) : null,\n cred.deviceType ?? null,\n cred.backedUp ? 1 : 0,\n cred.rpId ?? null,\n ],\n });\n}\n\nexport async function getCredentialsByUserId(userId: string, rpId?: string) {\n let sql = \"SELECT * FROM smcp_credentials WHERE user_id = ?\";\n const args: any[] = [userId];\n if (rpId) {\n sql += \" AND (rp_id = ? OR rp_id IS NULL)\";\n args.push(rpId);\n }\n const res = await sqlite.execute({ sql, args });\n return res.rows.map((r) => ({\n id: r[0] as string,\n userId: r[1] as string,\n publicKey: b64urlDecode(r[2] as string),\n counter: r[3] as number,\n transports: r[4] ? JSON.parse(r[4] as string) : undefined,\n deviceType: r[5] as string | null,\n backedUp: r[6] === 1,\n rpId: r[7] as string | null,\n }));\n}\n\nexport async function getCredentialById(credId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_credentials WHERE id = ?\",\n args: [credId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n userId: r[1] as string,\n publicKey: b64urlDecode(r[2] as string),\n counter: r[3] as number,\n transports: r[4] ? JSON.parse(r[4] as string) : undefined,\n deviceType: r[5] as string | null,\n backedUp: r[6] === 1,\n rpId: r[7] as string | null,\n };\n}\n\nexport async function updateCredentialCounter(credId: string, newCounter: number) {\n await sqlite.execute({\n sql: \"UPDATE smcp_credentials SET counter = ? WHERE id = ?\",\n args: [newCounter, credId],\n });\n}\n\n// ─── Challenge CRUD ─────────────────────────────────────────────\n\nexport async function saveChallenge(id: string, challenge: string, type: string, userId?: string) {\n const expires = new Date(Date.now() + 5 * 60 * 1000).toISOString(); // 5 min\n await sqlite.execute({\n sql: \"INSERT INTO smcp_challenges (id, challenge, user_id, type, expires_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, challenge, userId ?? null, type, expires],\n });\n}\n\nexport async function getChallenge(id: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_challenges WHERE id = ? AND expires_at > datetime('now')\",\n args: [id],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n challenge: r[1] as string,\n userId: r[2] as string | null,\n type: r[3] as string,\n };\n}\n\nexport async function deleteChallenge(id: string) {\n await sqlite.execute({ sql: \"DELETE FROM smcp_challenges WHERE id = ?\", args: [id] });\n}\n\n// ─── OAuth Client CRUD ──────────────────────────────────────────\n\nexport async function saveOAuthClient(client: {\n clientId: string;\n clientSecret?: string;\n redirectUris: string[];\n clientName?: string;\n}) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO smcp_oauth_clients (client_id, client_secret, redirect_uris, client_name)\n VALUES (?, ?, ?, ?)`,\n args: [client.clientId, client.clientSecret ?? null, JSON.stringify(client.redirectUris), client.clientName ?? null],\n });\n}\n\nexport async function getOAuthClient(clientId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_oauth_clients WHERE client_id = ?\",\n args: [clientId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n clientId: r[0] as string,\n clientSecret: r[1] as string | null,\n redirectUris: JSON.parse(r[2] as string) as string[],\n clientName: r[3] as string | null,\n };\n}\n\n// ─── Auth Code CRUD ─────────────────────────────────────────────\n\nexport async function saveAuthCode(code: {\n code: string;\n clientId: string;\n userId: string;\n redirectUri: string;\n codeChallenge: string;\n codeChallengeMethod: string;\n scope?: string;\n resource?: string;\n}) {\n const expires = new Date(Date.now() + 10 * 60 * 1000).toISOString(); // 10 min\n await sqlite.execute({\n sql: `INSERT INTO smcp_auth_codes (code, client_id, user_id, redirect_uri, code_challenge, code_challenge_method, scope, resource, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [code.code, code.clientId, code.userId, code.redirectUri, code.codeChallenge, code.codeChallengeMethod, code.scope ?? null, code.resource ?? null, expires],\n });\n}\n\nexport async function consumeAuthCode(code: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_auth_codes WHERE code = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [code],\n });\n if (res.rows.length === 0) return null;\n await sqlite.execute({ sql: \"UPDATE smcp_auth_codes SET used = 1 WHERE code = ?\", args: [code] });\n const r = res.rows[0];\n return {\n code: r[0] as string,\n clientId: r[1] as string,\n userId: r[2] as string,\n redirectUri: r[3] as string,\n codeChallenge: r[4] as string,\n codeChallengeMethod: r[5] as string,\n scope: r[6] as string | null,\n resource: r[7] as string | null,\n };\n}\n\n// ─── Token CRUD ─────────────────────────────────────────────────\n\nexport async function saveAccessToken(t: {\n token: string;\n userId: string;\n clientId: string;\n scope?: string;\n expiresInSec?: number;\n}) {\n const expires = new Date(Date.now() + (t.expiresInSec ?? 3600) * 1000).toISOString();\n await sqlite.execute({\n sql: `INSERT INTO smcp_access_tokens (token, user_id, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [t.token, t.userId, t.clientId, t.scope ?? null, expires],\n });\n}\n\nexport async function validateAccessToken(token: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_access_tokens WHERE token = ? AND expires_at > datetime('now')\",\n args: [token],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n token: r[0] as string,\n userId: r[1] as string,\n clientId: r[2] as string,\n scope: r[3] as string | null,\n expiresAt: r[4] as string,\n };\n}\n\nexport async function saveRefreshToken(t: {\n token: string;\n userId: string;\n clientId: string;\n scope?: string;\n}) {\n const expires = new Date(Date.now() + 30 * 24 * 3600 * 1000).toISOString(); // 30 days\n await sqlite.execute({\n sql: `INSERT INTO smcp_refresh_tokens (token, user_id, client_id, scope, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [t.token, t.userId, t.clientId, t.scope ?? null, expires],\n });\n}\n\nexport async function consumeRefreshToken(token: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_refresh_tokens WHERE token = ? AND expires_at > datetime('now')\",\n args: [token],\n });\n if (res.rows.length === 0) return null;\n await sqlite.execute({ sql: \"DELETE FROM smcp_refresh_tokens WHERE token = ?\", args: [token] });\n const r = res.rows[0];\n return {\n token: r[0] as string,\n userId: r[1] as string,\n clientId: r[2] as string,\n scope: r[3] as string | null,\n };\n}\n\n// ─── Session CRUD ───────────────────────────────────────────────\n\nexport async function createSession(userId: string, scope: string = \"consent\"): Promise {\n const id = await generateToken(\"sess\");\n const expires = new Date(Date.now() + 15 * 60 * 1000).toISOString(); // 15 min\n await sqlite.execute({\n sql: \"INSERT INTO smcp_sessions (id, user_id, expires_at, scope) VALUES (?, ?, ?, ?)\",\n args: [id, userId, expires, scope],\n });\n return id;\n}\n\nexport async function validateSession(sessionId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT id, user_id, scope FROM smcp_sessions WHERE id = ? AND expires_at > datetime('now')\",\n args: [sessionId],\n });\n if (res.rows.length === 0) return null;\n return { userId: res.rows[0][1] as string, scope: (res.rows[0][2] as string) ?? \"consent\" };\n}\n\nexport async function deleteSession(sessionId: string) {\n await sqlite.execute({ sql: \"DELETE FROM smcp_sessions WHERE id = ?\", args: [sessionId] });\n}\n\n// ─── Vault CRUD ─────────────────────────────────────────────────\n\nexport async function vaultStore(entry: {\n userId: string;\n roomId: string;\n token: string;\n tokenType: string;\n label?: string;\n isDefault?: boolean;\n}) {\n const id = generateId();\n // Clear default flag if setting new default\n if (entry.isDefault) {\n await sqlite.execute({\n sql: \"UPDATE smcp_vault SET is_default = 0 WHERE user_id = ?\",\n args: [entry.userId],\n });\n }\n await sqlite.execute({\n sql: `INSERT INTO smcp_vault (id, user_id, room_id, token, token_type, label, is_default)\n VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [id, entry.userId, entry.roomId, entry.token, entry.tokenType, entry.label ?? null, entry.isDefault ? 1 : 0],\n });\n return id;\n}\n\nexport async function vaultGetForRoom(userId: string, roomId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_vault WHERE user_id = ? AND room_id = ? ORDER BY token_type ASC\",\n args: [userId, roomId],\n });\n return res.rows.map((r) => ({\n id: r[0] as string,\n userId: r[1] as string,\n roomId: r[2] as string,\n token: r[3] as string,\n tokenType: r[4] as string,\n label: r[5] as string | null,\n isDefault: r[6] === 1,\n }));\n}\n\nexport async function vaultGetDefault(userId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_vault WHERE user_id = ? AND is_default = 1 LIMIT 1\",\n args: [userId],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0];\n return {\n id: r[0] as string,\n userId: r[1] as string,\n roomId: r[2] as string,\n token: r[3] as string,\n tokenType: r[4] as string,\n label: r[5] as string | null,\n isDefault: true,\n };\n}\n\nexport async function vaultList(userId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM smcp_vault WHERE user_id = ? ORDER BY is_default DESC, created_at DESC\",\n args: [userId],\n });\n return res.rows.map((r) => ({\n id: r[0] as string,\n userId: r[1] as string,\n roomId: r[2] as string,\n token: r[3] as string,\n tokenType: r[4] as string,\n label: r[5] as string | null,\n isDefault: r[6] === 1,\n }));\n}\n\nexport async function vaultDelete(userId: string, vaultId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_vault WHERE id = ? AND user_id = ?\",\n args: [vaultId, userId],\n });\n}\n\n// ─── Recovery Token CRUD ─────────────────────────────────────────\n\nconst RECOVERY_EXPIRY_DAYS = 90;\nconst MAX_ACTIVE_RECOVERY_TOKENS = 3;\n\nexport async function createRecoveryToken(userId: string): Promise<{ token: string; expiresAt: string } | { error: string }> {\n // Check limit\n const countRes = await sqlite.execute({\n sql: \"SELECT COUNT(*) FROM smcp_recovery_tokens WHERE user_id = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [userId],\n });\n const activeCount = Number(countRes.rows[0][0]);\n if (activeCount >= MAX_ACTIVE_RECOVERY_TOKENS) {\n return { error: `Maximum ${MAX_ACTIVE_RECOVERY_TOKENS} active recovery tokens. Revoke one first.` };\n }\n\n const token = await generateToken(\"recover\");\n const tokenHash = await sha256(token);\n const id = generateId();\n const expiresAt = new Date(Date.now() + RECOVERY_EXPIRY_DAYS * 24 * 3600 * 1000).toISOString();\n\n await sqlite.execute({\n sql: \"INSERT INTO smcp_recovery_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)\",\n args: [id, userId, tokenHash, expiresAt],\n });\n\n return { token, expiresAt };\n}\n\nexport async function validateRecoveryToken(token: string): Promise<{ userId: string; tokenId: string } | null> {\n const tokenHash = await sha256(token);\n const res = await sqlite.execute({\n sql: \"SELECT id, user_id FROM smcp_recovery_tokens WHERE token_hash = ? AND used = 0 AND expires_at > datetime('now')\",\n args: [tokenHash],\n });\n if (res.rows.length === 0) return null;\n return { tokenId: res.rows[0][0] as string, userId: res.rows[0][1] as string };\n}\n\nexport async function consumeRecoveryToken(tokenId: string) {\n await sqlite.execute({\n sql: \"UPDATE smcp_recovery_tokens SET used = 1 WHERE id = ?\",\n args: [tokenId],\n });\n}\n\nexport async function listRecoveryTokens(userId: string) {\n const res = await sqlite.execute({\n sql: \"SELECT id, expires_at, used, created_at FROM smcp_recovery_tokens WHERE user_id = ? ORDER BY created_at DESC\",\n args: [userId],\n });\n return res.rows.map((r) => ({\n id: r[0] as string,\n expiresAt: r[1] as string,\n used: r[2] === 1,\n createdAt: r[3] as string,\n }));\n}\n\nexport async function revokeRecoveryToken(userId: string, tokenId: string) {\n await sqlite.execute({\n sql: \"DELETE FROM smcp_recovery_tokens WHERE id = ? AND user_id = ?\",\n args: [tokenId, userId],\n });\n}\n\n// ─── Cleanup ────────────────────────────────────────────────────\n\nexport async function cleanupExpired() {\n await sqlite.batch([\n { sql: \"DELETE FROM smcp_challenges WHERE expires_at < datetime('now')\", args: [] },\n { sql: \"DELETE FROM smcp_auth_codes WHERE expires_at < datetime('now')\", args: [] },\n { sql: \"DELETE FROM smcp_sessions WHERE expires_at < datetime('now')\", args: [] },\n { sql: \"DELETE FROM smcp_recovery_tokens WHERE expires_at < datetime('now') OR used = 1\", args: [] },\n // Keep access/refresh tokens for audit; could prune old ones\n ]);\n}\n",[],[228],{"_104":236,"_97":237,"_162":238,"_164":-5,"_165":147,"_166":146,"_168":169,"_106":239,"_101":221,"_171":240,"_173":241,"_174":22,"_175":-5,"_176":242,"_100":243},"63077fca-189f-11f1-9298-42dde27851f2","main.ts","d662f5c0-17ce-11f1-a9e3-42dde27851f2",["D",1772720826341],"http","/**\n * main.ts — sync-mcp HTTP router + MCP protocol handler\n *\n * Routes:\n * POST /mcp — MCP JSON-RPC (requires OAuth)\n * GET /mcp — Server info\n * DELETE /mcp — Session termination (no-op)\n * GET /.well-known/oauth-protected-resource — PRM (RFC 9728)\n * GET /.well-known/oauth-authorization-server — AS metadata (RFC 8414)\n * POST /oauth/register — Dynamic Client Registration\n * GET /oauth/authorize — Authorization + WebAuthn page\n * POST /oauth/consent — Consent → auth code\n * POST /oauth/token — Token exchange\n * POST /webauthn/register/options — WebAuthn registration options\n * POST /webauthn/register/verify — WebAuthn registration verify\n * POST /webauthn/authenticate/options — WebAuthn auth options\n * POST /webauthn/authenticate/verify — WebAuthn auth verify\n * GET/POST/DELETE /vault — Token vault API\n * GET /manage — Management UI\n * GET/POST/DELETE /manage/api/* — Management API (session-auth)\n * GET /recover — Recovery page (passkey re-registration)\n * POST /recover/validate — Validate recovery token\n * POST /recover/register/options — WebAuthn reg options (recovery-scoped)\n * POST /recover/register/verify — WebAuthn reg verify + consume token\n */\n\nimport { cleanupExpired, ensureSchema, validateAccessToken } from \"./db.ts\";\nimport {\n handleASMetadata,\n handleAuthOptions,\n handleAuthorize,\n handleAuthVerify,\n handleConsent,\n handleDCR,\n handleManageApi,\n handleManagePage,\n handlePRM,\n handleRecoverPage,\n handleRecoverRegisterOptions,\n handleRecoverRegisterVerify,\n handleRecoverValidate,\n handleRegisterOptions,\n handleRegisterVerify,\n handleToken,\n handleVault,\n resolveAdminToken,\n resolveToken,\n} from \"./auth.ts\";\nimport { type ToolContext, TOOLS } from \"./tools.ts\";\n\n// ─── Configuration ───────────────────────────────────────────────\n\nconst SERVER_NAME = \"sync-mcp-server\";\nconst SERVER_VERSION = \"2.0.0\";\nconst PROTOCOL_VERSION = \"2025-03-26\";\n\n// ─── Schema init (runs once per cold start) ──────────────────────\n\nlet schemaReady = false;\nasync function initSchema() {\n if (!schemaReady) {\n await ensureSchema();\n schemaReady = true;\n // Background cleanup\n cleanupExpired().catch(() => {});\n }\n}\n\n// ─── MCP Protocol (JSON-RPC 2.0) ────────────────────────────────\n\ninterface JsonRpcRequest {\n jsonrpc: \"2.0\";\n id?: string | number;\n method: string;\n params?: Record;\n}\n\ninterface JsonRpcResponse {\n jsonrpc: \"2.0\";\n id?: string | number | null;\n result?: unknown;\n error?: { code: number; message: string; data?: unknown };\n}\n\nfunction rpcResult(\n id: string | number | null | undefined,\n result: unknown,\n): JsonRpcResponse {\n return { jsonrpc: \"2.0\", id: id ?? null, result };\n}\n\nfunction rpcError(\n id: string | number | null | undefined,\n code: number,\n message: string,\n data?: unknown,\n): JsonRpcResponse {\n return {\n jsonrpc: \"2.0\",\n id: id ?? null,\n error: { code, message, ...(data !== undefined ? { data } : {}) },\n };\n}\n\nfunction toolsToSchema() {\n return TOOLS.map((t) => ({\n name: t.name,\n title: t.title,\n description: t.description,\n inputSchema: t.inputSchema,\n annotations: t.annotations,\n }));\n}\n\nasync function handleRpc(\n req: JsonRpcRequest,\n ctx: ToolContext,\n): Promise {\n const { method, id, params } = req;\n\n // ── Lifecycle ──\n if (method === \"initialize\") {\n return rpcResult(id, {\n protocolVersion: PROTOCOL_VERSION,\n capabilities: { tools: {} },\n serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },\n });\n }\n\n if (method === \"notifications/initialized\" || method === \"ping\") {\n return rpcResult(id, {});\n }\n\n // ── Tools ──\n if (method === \"tools/list\") {\n return rpcResult(id, { tools: toolsToSchema() });\n }\n\n if (method === \"tools/call\") {\n const toolName = (params as any)?.name;\n const toolArgs = (params as any)?.arguments ?? {};\n\n const tool = TOOLS.find((t) => t.name === toolName);\n if (!tool) {\n return rpcError(id, -32602, `Unknown tool: ${toolName}`);\n }\n\n try {\n const result = await tool.handler(toolArgs, ctx);\n return rpcResult(id, {\n content: [\n {\n type: \"text\",\n text: typeof result === \"string\"\n ? result\n : JSON.stringify(result, null, 2),\n },\n ],\n });\n } catch (err: unknown) {\n const message = err instanceof Error ? err.message : String(err);\n return rpcResult(id, {\n content: [{ type: \"text\", text: `Error: ${message}` }],\n isError: true,\n });\n }\n }\n\n return rpcError(id, -32601, `Method not found: ${method}`);\n}\n\n// ─── Auth extraction ─────────────────────────────────────────────\n\nasync function extractUserId(req: Request): Promise {\n const authHeader = req.headers.get(\"authorization\");\n if (!authHeader?.startsWith(\"Bearer \")) return null;\n\n const token = authHeader.substring(7);\n // Skip sync tokens (room_xxx, as_xxx, view_xxx) — those are per-call\n if (\n token.startsWith(\"room_\") || token.startsWith(\"as_\") ||\n token.startsWith(\"view_\")\n ) return null;\n\n const valid = await validateAccessToken(token);\n return valid?.userId ?? null;\n}\n\n// ─── 401 Challenge ───────────────────────────────────────────────\n\nfunction unauthorizedResponse(req: Request): Response {\n const origin = new URL(req.url);\n const prmUrl =\n `${origin.protocol}//${origin.host}/.well-known/oauth-protected-resource`;\n return new Response(\n JSON.stringify({\n error: \"unauthorized\",\n error_description:\n \"OAuth Bearer token required. Complete the OAuth flow to authenticate.\",\n }),\n {\n status: 401,\n headers: {\n ...CORS_HEADERS,\n \"Content-Type\": \"application/json\",\n \"WWW-Authenticate\": `Bearer resource_metadata=\"${prmUrl}\"`,\n },\n },\n );\n}\n\n// ─── CORS ────────────────────────────────────────────────────────\n\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, Mcp-Session-Id, X-Session-Id\",\n};\n\nfunction corsJson(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data, null, 2), {\n status,\n headers: { ...CORS_HEADERS, \"Content-Type\": \"application/json\" },\n });\n}\n\n// ─── HTTP Router ─────────────────────────────────────────────────\n\nexport default async function (req: Request): Promise {\n await initSchema();\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n // ── Well-Known endpoints (unauthenticated — required for discovery) ──\n if (\n req.method === \"GET\" && path === \"/.well-known/oauth-protected-resource\"\n ) {\n return handlePRM(req);\n }\n if (\n req.method === \"GET\" && path === \"/.well-known/oauth-authorization-server\"\n ) {\n return handleASMetadata(req);\n }\n\n // ── OAuth endpoints (unauthenticated — part of the auth flow itself) ──\n if (req.method === \"POST\" && path === \"/oauth/register\") {\n return handleDCR(req);\n }\n if (req.method === \"GET\" && path === \"/oauth/authorize\") {\n return handleAuthorize(req);\n }\n if (req.method === \"POST\" && path === \"/oauth/consent\") {\n return handleConsent(req);\n }\n if (req.method === \"POST\" && path === \"/oauth/token\") {\n return handleToken(req);\n }\n\n // ── WebAuthn endpoints (unauthenticated — part of the auth flow) ──\n if (req.method === \"POST\" && path === \"/webauthn/register/options\") {\n return handleRegisterOptions(req);\n }\n if (req.method === \"POST\" && path === \"/webauthn/register/verify\") {\n return handleRegisterVerify(req);\n }\n if (req.method === \"POST\" && path === \"/webauthn/authenticate/options\") {\n return handleAuthOptions(req);\n }\n if (req.method === \"POST\" && path === \"/webauthn/authenticate/verify\") {\n return handleAuthVerify(req);\n }\n\n // ── Management UI (WebAuthn session-authenticated) ──\n if (req.method === \"GET\" && path === \"/manage\") {\n return handleManagePage(req);\n }\n if (path.startsWith(\"/manage/api\")) {\n return handleManageApi(req);\n }\n\n // ── Recovery (unauthenticated — uses recovery token) ──\n if (req.method === \"GET\" && path === \"/recover\") {\n return handleRecoverPage(req);\n }\n if (req.method === \"POST\" && path === \"/recover/validate\") {\n return handleRecoverValidate(req);\n }\n if (req.method === \"POST\" && path === \"/recover/register/options\") {\n return handleRecoverRegisterOptions(req);\n }\n if (req.method === \"POST\" && path === \"/recover/register/verify\") {\n return handleRecoverRegisterVerify(req);\n }\n\n // ── Vault API (requires OAuth) ──\n if (path.startsWith(\"/vault\")) {\n const userId = await extractUserId(req);\n if (!userId) {\n return unauthorizedResponse(req);\n }\n return handleVault(req, userId);\n }\n\n // ── MCP: DELETE (session termination, no-op for stateless) ──\n if (req.method === \"DELETE\" && (path === \"/mcp\" || path === \"/\")) {\n return new Response(null, { status: 200, headers: CORS_HEADERS });\n }\n\n // ── MCP: GET (server info — unauthenticated for discoverability) ──\n if (req.method === \"GET\" && (path === \"/\" || path === \"/mcp\")) {\n return corsJson({\n name: SERVER_NAME,\n version: SERVER_VERSION,\n protocol: \"MCP\",\n protocolVersion: PROTOCOL_VERSION,\n transport: \"streamable-http\",\n auth: \"OAuth 2.1 + WebAuthn passkeys\",\n tools: TOOLS.map((t) => t.name),\n description:\n \"MCP server for sync — multi-agent coordination platform (https://sync.parc.land)\",\n endpoints: {\n mcp: \"POST /mcp (JSON-RPC 2.0, requires OAuth)\",\n oauth_prm: \"GET /.well-known/oauth-protected-resource\",\n oauth_metadata: \"GET /.well-known/oauth-authorization-server\",\n oauth_register: \"POST /oauth/register\",\n oauth_authorize: \"GET /oauth/authorize\",\n oauth_token: \"POST /oauth/token\",\n vault: \"GET/POST/DELETE /vault\",\n },\n });\n }\n\n // ── MCP: POST (JSON-RPC — requires OAuth) ──\n if (req.method === \"POST\" && (path === \"/mcp\" || path === \"/\")) {\n // Require OAuth Bearer token\n const userId = await extractUserId(req);\n if (!userId) {\n // Return 401 with WWW-Authenticate to trigger MCP OAuth discovery\n return unauthorizedResponse(req);\n }\n\n // Build tool context with authenticated user\n const ctx: ToolContext = {\n userId,\n resolveToken: (room?: string, token?: string) =>\n resolveToken(userId, room, token),\n resolveAdminToken: (room: string) => resolveAdminToken(userId, room),\n };\n console.log(`MPC post ctx : ToolContext`, ctx, userId);\n\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n return new Response(\n JSON.stringify(rpcError(null, -32700, \"Parse error\")),\n {\n status: 400,\n headers: { ...CORS_HEADERS, \"Content-Type\": \"application/json\" },\n },\n );\n }\n\n // Handle batch\n if (Array.isArray(body)) {\n const responses = await Promise.all(\n (body as JsonRpcRequest[]).map((r) => handleRpc(r, ctx)),\n );\n return new Response(JSON.stringify(responses), {\n headers: { ...CORS_HEADERS, \"Content-Type\": \"application/json\" },\n });\n }\n\n // Single request\n const response = await handleRpc(body as JsonRpcRequest, ctx);\n return new Response(JSON.stringify(response), {\n headers: { ...CORS_HEADERS, \"Content-Type\": \"application/json\" },\n });\n }\n\n return corsJson({ error: \"Not found. POST JSON-RPC to /mcp\" }, 404);\n}",[],[237],{"_104":245,"_97":246,"_162":247,"_164":-5,"_165":147,"_166":248,"_168":169,"_106":249,"_101":250,"_171":222,"_173":251,"_174":22,"_175":-5,"_176":252,"_100":253},"22e49e6e-189f-11f1-8077-42dde27851f2","tools.ts","6c779f82-1876-11f1-a7bf-42dde27851f2",15,["D",1772720718926],2,"/**\n * tools.ts — MCP tool definitions for sync-mcp\n *\n * Updated from v1: room and token are now optional when OAuth-authenticated.\n * If omitted, the tool resolves credentials from the user's token vault.\n */\n\n// ─── Configuration ───────────────────────────────────────────────\nconst SYNC_URL = Deno.env.get(\"SYNC_URL\") ?? \"https://sync.parc.land\";\n\n// ─── HTTP helpers ────────────────────────────────────────────────\n\nfunction headers(token?: string): Record {\n const h: Record = { \"Content-Type\": \"application/json\" };\n if (token) h[\"Authorization\"] = `Bearer ${token}`;\n return h;\n}\n\nasync function syncFetch(\n path: string,\n opts: { method?: string; body?: unknown; token?: string } = {},\n): Promise<{ status: number; data: unknown }> {\n const url = `${SYNC_URL}${path}`;\n const init: RequestInit = {\n method: opts.method ?? \"GET\",\n headers: headers(opts.token),\n };\n if (opts.body !== undefined) {\n init.body = JSON.stringify(opts.body);\n }\n const res = await fetch(url, init);\n const text = await res.text();\n let data: unknown;\n try {\n data = JSON.parse(text);\n } catch {\n data = text;\n }\n return { status: res.status, data };\n}\n\n// ─── Tool context (injected by MCP handler) ─────────────────────\n\nexport interface ToolContext {\n userId: string | null; // null if unauthenticated\n resolveToken: (\n room?: string,\n token?: string,\n ) => Promise<{ room: string; token: string } | null>;\n resolveAdminToken: (room: string) => Promise;\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────\n\nasync function requireAuth(\n ctx: ToolContext,\n params: Record,\n opts?: { needsRoom?: boolean },\n): Promise<{ room: string; token: string }> {\n const room = params.room as string | undefined;\n const token = params.token as string | undefined;\n\n const resolved = await ctx.resolveToken(room, token);\n console.log(`requireAuth, post ctx.resolveToken`, {\n room,\n token,\n userId: ctx.userId,\n resolved,\n });\n if (!resolved) {\n if (!ctx.userId) {\n throw new Error(\n \"Authentication required. Connect with OAuth or provide room + token parameters.\",\n );\n }\n if (opts?.needsRoom !== false) {\n throw new Error(\n \"No room specified and no default room in vault. Provide 'room' parameter or set a default room via sync_vault_store.\",\n );\n }\n throw new Error(\n \"No token found for this room. Provide 'token' parameter or add one via sync_vault_store.\",\n );\n }\n return resolved;\n}\n\n/** Retry a sync API call with admin token if the agent token gets scope_denied.\n * Used for shared-scope operations (register action/view) where agent tokens\n * lack authority but the user holds an admin token in the vault. */\nasync function withAdminEscalation(\n ctx: ToolContext,\n room: string,\n agentToken: string,\n fn: (token: string) => Promise<{ status: number; data: unknown }>,\n): Promise {\n const result = await fn(agentToken);\n\n // If agent token worked, return directly\n if (result.status < 400) return result.data;\n\n // Check if this is a scope/authority error worth escalating\n const data = result.data as Record | undefined;\n const error = data?.error as string | undefined;\n const isScopeDenied = error === \"scope_denied\" ||\n error === \"room_token_required\" ||\n error === \"authentication_required\";\n\n if (!isScopeDenied) return result.data; // Not an auth error — return as-is\n\n // Try escalation with room admin token\n const adminToken = await ctx.resolveAdminToken(room);\n if (!adminToken) return result.data; // No admin token available — return original error\n\n const escalated = await fn(adminToken);\n return escalated.data;\n}\n\n// ─── Tool Definitions ────────────────────────────────────────────\n\nexport interface ToolDef {\n name: string;\n title: string;\n description: string;\n inputSchema: Record;\n annotations: {\n readOnlyHint: boolean;\n destructiveHint: boolean;\n idempotentHint: boolean;\n openWorldHint: boolean;\n };\n handler: (\n params: Record,\n ctx: ToolContext,\n ) => Promise;\n}\n\nexport const TOOLS: ToolDef[] = [\n // ── Room lifecycle ──────────────────────────────────────────\n {\n name: \"sync_create_room\",\n title: \"Create Room\",\n description:\n `Create a new sync collaboration room. Returns the room ID, admin token, and view token.\n\nIf authenticated via OAuth, the room token is automatically saved to your vault.\n\nArgs:\n - id (string, optional): Custom room ID. Auto-generated if omitted.\n - meta (object, optional): Arbitrary metadata for the room.\n - label (string, optional): Vault label for this room.\n - set_default (boolean, optional): Make this the default room.\n\nReturns: { id, token, view_token, created_at }`,\n inputSchema: {\n type: \"object\",\n properties: {\n id: {\n type: \"string\",\n description: \"Custom room ID (auto-generated if omitted)\",\n },\n meta: { type: \"object\", description: \"Room metadata (any JSON)\" },\n label: { type: \"string\", description: \"Vault label for this room\" },\n set_default: {\n type: \"boolean\",\n description: \"Make this the default room\",\n },\n },\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const body: Record = {};\n if (params.id) body.id = params.id;\n if (params.meta) body.meta = params.meta;\n const result = (await syncFetch(\"/rooms\", { method: \"POST\", body }))\n .data as Record;\n\n // Auto-vault if authenticated\n if (ctx.userId && result.token && result.id) {\n const { vaultStore } = await import(\"./db.ts\");\n // Store room token\n await vaultStore({\n userId: ctx.userId,\n roomId: result.id as string,\n token: result.token as string,\n tokenType: \"room\",\n label: (params.label as string) ?? `Room ${result.id}`,\n isDefault: params.set_default as boolean ?? false,\n });\n // Also store view token\n if (result.view_token) {\n await vaultStore({\n userId: ctx.userId,\n roomId: result.id as string,\n token: result.view_token as string,\n tokenType: \"view\",\n label: `View: ${result.id}`,\n });\n }\n (result as Record)._vaulted = true;\n }\n\n return result;\n },\n },\n\n {\n name: \"sync_list_rooms\",\n title: \"List Rooms\",\n description:\n `List rooms accessible with the given token. If authenticated, uses vault token.\n\nArgs:\n - room (string, optional): Room ID (uses default if omitted).\n - token (string, optional): Auth token (resolved from vault if omitted).\n\nReturns: Array of room objects.`,\n inputSchema: {\n type: \"object\",\n properties: {\n token: {\n type: \"string\",\n description:\n \"Auth token (room_xxx, view_xxx, or as_xxx). Optional if authenticated.\",\n },\n },\n },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const token = params.token as string | undefined;\n if (token) {\n return (await syncFetch(\"/rooms\", { token })).data;\n }\n // If authenticated, try to list rooms from vault\n if (ctx.userId) {\n const { vaultList } = await import(\"./db.ts\");\n const entries = await vaultList(ctx.userId);\n if (entries.length > 0) {\n // Use first available token to list rooms\n return (await syncFetch(\"/rooms\", { token: entries[0].token })).data;\n }\n }\n throw new Error(\n \"No token available. Provide 'token' parameter or authenticate via OAuth.\",\n );\n },\n },\n\n {\n name: \"sync_join_room\",\n title: \"Join Room\",\n description: `Join a sync room as an agent. Returns an agent token (as_xxx).\n\nIf authenticated, the agent token is automatically saved to your vault.\n\nArgs:\n - room (string, optional): Room ID (uses default if omitted).\n - token (string, optional): Room admin token (resolved from vault if omitted).\n - id (string, optional): Agent ID (auto-generated if omitted).\n - name (string, optional): Display name.\n - role (string, optional): Agent role.\n - state (object, optional): Initial private state.\n - public_keys (string[], optional): State keys to auto-expose as views.\n - views (array, optional): Pre-register views.\n\nReturns: Agent object with { id, token, room_id, ... }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\", description: \"Room ID\" },\n token: {\n type: \"string\",\n description:\n \"Room admin token (room_xxx). Optional if authenticated.\",\n },\n id: { type: \"string\", description: \"Agent ID\" },\n name: { type: \"string\", description: \"Display name\" },\n role: { type: \"string\", description: \"Agent role\" },\n state: { type: \"object\", description: \"Initial private state\" },\n public_keys: {\n type: \"array\",\n items: { type: \"string\" },\n description: \"State keys to auto-expose\",\n },\n views: {\n type: \"array\",\n items: { type: \"object\" },\n description: \"Views to pre-register\",\n },\n },\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const body: Record = {};\n for (\n const key of [\"id\", \"name\", \"role\", \"state\", \"public_keys\", \"views\"]\n ) {\n if (params[key] !== undefined) body[key] = params[key];\n }\n const result = await withAdminEscalation(\n ctx,\n resolved.room,\n resolved.token,\n (token) =>\n syncFetch(`/rooms/${resolved.room}/agents`, {\n method: \"POST\",\n body,\n token,\n }),\n ) as Record;\n\n // Auto-vault agent token\n if (ctx.userId && result.token) {\n const { vaultStore } = await import(\"./db.ts\");\n await vaultStore({\n userId: ctx.userId,\n roomId: resolved.room,\n token: result.token as string,\n tokenType: \"agent\",\n label: `Agent: ${result.id ?? \"unknown\"}`,\n });\n (result as Record)._vaulted = true;\n }\n\n return result;\n },\n },\n\n // ── Core rhythm: read → act ─────────────────────────────────\n\n {\n name: \"sync_read_context\",\n title: \"Read Context\",\n description: `THE primary read operation. Returns the full room context.\n\nThis is the \"read\" in the read → evaluate → act rhythm.\n\nArgs:\n - room (string, optional): Room ID (uses default if omitted).\n - token (string, optional): Auth token (resolved from vault if omitted).\n - depth (string, optional): \"lean\" | \"full\" | \"usage\"\n - only (string, optional): Section filter, e.g. \"state,actions\"\n - actions (boolean, optional): Include actions (default true)\n - messages (boolean, optional): Include messages (default true)\n - messages_after (number, optional): Seq cursor\n - messages_limit (number, optional): Max messages\n - include (string, optional): Extra scopes, e.g. \"_audit\"\n - compact (boolean, optional): Strip nulls\n\nReturns: { state, views, agents, actions, messages, self, _context }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\", description: \"Room ID\" },\n token: { type: \"string\", description: \"Auth token\" },\n depth: { type: \"string\", enum: [\"lean\", \"full\", \"usage\"] },\n only: { type: \"string\" },\n actions: { type: \"boolean\" },\n messages: { type: \"boolean\" },\n messages_after: { type: \"number\" },\n messages_limit: { type: \"number\" },\n include: { type: \"string\" },\n compact: { type: \"boolean\" },\n },\n },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const qp = new URLSearchParams();\n if (params.depth) qp.set(\"depth\", params.depth as string);\n if (params.only) qp.set(\"only\", params.only as string);\n if (params.actions === false) qp.set(\"actions\", \"false\");\n if (params.messages === false) qp.set(\"messages\", \"false\");\n if (params.messages_after !== undefined) {\n qp.set(\"messages_after\", String(params.messages_after));\n }\n if (params.messages_limit !== undefined) {\n qp.set(\"messages_limit\", String(params.messages_limit));\n }\n if (params.include) qp.set(\"include\", params.include as string);\n if (params.compact) qp.set(\"compact\", \"true\");\n const qs = qp.toString();\n return (await syncFetch(\n `/rooms/${resolved.room}/context${qs ? \"?\" + qs : \"\"}`,\n {\n token: resolved.token,\n },\n )).data;\n },\n },\n\n {\n name: \"sync_invoke_action\",\n title: \"Invoke Action\",\n description:\n `THE primary write operation. Invoke any action (built-in or custom) in a room.\n\nThis is the \"act\" in the read → evaluate → act rhythm.\n\nArgs:\n - room (string, optional): Room ID (uses default if omitted).\n - token (string, optional): Auth token (resolved from vault if omitted).\n - action (string, required): Action ID to invoke.\n - params (object, optional): Parameters for the action.\n - agent (string, optional): Agent identity override.\n\nReturns: { invoked, action, agent, params, writes, result? }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n action: { type: \"string\", description: \"Action ID to invoke\" },\n params: { type: \"object\", description: \"Action parameters\" },\n agent: { type: \"string\", description: \"Agent identity override\" },\n },\n required: [\"action\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: true,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const body: Record = {};\n if (params.params) body.params = params.params;\n if (params.agent) body.agent = params.agent;\n return (await syncFetch(\n `/rooms/${resolved.room}/actions/${params.action}/invoke`,\n {\n method: \"POST\",\n body,\n token: resolved.token,\n },\n )).data;\n },\n },\n\n {\n name: \"sync_wait\",\n title: \"Wait for Condition\",\n description:\n `Block until a CEL condition becomes true, then return room context.\n\nArgs:\n - room (string, optional): Room ID.\n - token (string, optional): Auth token.\n - condition (string, required): CEL expression.\n - timeout (number, optional): Max wait ms (default: 25000).\n\nReturns: { triggered: true/false, condition, context }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n condition: {\n type: \"string\",\n description: \"CEL expression to wait for\",\n },\n timeout: { type: \"number\" },\n depth: { type: \"string\", enum: [\"lean\", \"full\", \"usage\"] },\n only: { type: \"string\" },\n },\n required: [\"condition\"],\n },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: true,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const qp = new URLSearchParams();\n qp.set(\"condition\", params.condition as string);\n if (params.timeout) qp.set(\"timeout\", String(params.timeout));\n if (params.depth) qp.set(\"depth\", params.depth as string);\n if (params.only) qp.set(\"only\", params.only as string);\n return (await syncFetch(`/rooms/${resolved.room}/wait?${qp.toString()}`, {\n token: resolved.token,\n })).data;\n },\n },\n\n // ── Sugar for common built-in actions ───────────────────────\n\n {\n name: \"sync_register_action\",\n title: \"Register Action\",\n description: `Register a new action in a room.\n\nArgs: room, token (optional if authed), id (required), description, writes, params, scope, if, enabled, result, on_invoke.\n\nReturns: Saved action definition.`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n id: { type: \"string\", description: \"Action ID\" },\n description: { type: \"string\" },\n writes: {\n type: \"array\",\n items: { type: \"object\" },\n description: \"Write templates\",\n },\n params: { type: \"object\", description: \"Parameter schema\" },\n scope: { type: \"string\" },\n \"if\": { type: \"string\", description: \"CEL precondition\" },\n enabled: { type: \"string\", description: \"CEL visibility gate\" },\n result: { type: \"string\", description: \"CEL result expression\" },\n on_invoke: { type: \"object\", description: \"Cooldown timer\" },\n },\n required: [\"id\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const actionParams: Record = {};\n for (\n const key of [\n \"id\",\n \"description\",\n \"writes\",\n \"params\",\n \"scope\",\n \"if\",\n \"enabled\",\n \"result\",\n \"on_invoke\",\n ]\n ) {\n if (params[key] !== undefined) actionParams[key] = params[key];\n }\n return withAdminEscalation(\n ctx,\n resolved.room,\n resolved.token,\n (token) =>\n syncFetch(`/rooms/${resolved.room}/actions/_register_action/invoke`, {\n method: \"POST\",\n body: { params: actionParams },\n token,\n }),\n );\n },\n },\n\n {\n name: \"sync_register_view\",\n title: \"Register View\",\n description: `Register a computed view — a named CEL expression.\n\nArgs: room, token (optional if authed), id (required), expr (required), description, scope, enabled, render.\n\nReturns: View with current resolved value.`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n id: { type: \"string\" },\n expr: { type: \"string\" },\n description: { type: \"string\" },\n scope: { type: \"string\" },\n enabled: { type: \"string\" },\n render: { type: \"object\" },\n },\n required: [\"id\", \"expr\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const viewParams: Record = {};\n for (\n const key of [\"id\", \"expr\", \"description\", \"scope\", \"enabled\", \"render\"]\n ) {\n if (params[key] !== undefined) viewParams[key] = params[key];\n }\n return withAdminEscalation(\n ctx,\n resolved.room,\n resolved.token,\n (token) =>\n syncFetch(`/rooms/${resolved.room}/actions/_register_view/invoke`, {\n method: \"POST\",\n body: { params: viewParams },\n token,\n }),\n );\n },\n },\n\n {\n name: \"sync_send_message\",\n title: \"Send Message\",\n description: `Send a message to a sync room.\n\nArgs: room, token (optional if authed), body (required), kind, to.\n\nReturns: { ok, seq, from, kind }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n body: { type: \"string\", description: \"Message content\" },\n kind: { type: \"string\" },\n to: { type: \"string\", description: \"Direct to agent(s)\" },\n },\n required: [\"body\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const msgParams: Record = { body: params.body };\n if (params.kind) msgParams.kind = params.kind;\n if (params.to) msgParams.to = params.to;\n return (await syncFetch(\n `/rooms/${resolved.room}/actions/_send_message/invoke`,\n {\n method: \"POST\",\n body: { params: msgParams },\n token: resolved.token,\n },\n )).data;\n },\n },\n\n {\n name: \"sync_help\",\n title: \"Get Help\",\n description: `Access the sync help system.\n\nArgs: room, token (optional if authed), key (optional).\n\nReturns: { content, version, source }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n key: { type: \"string\", description: \"Help key\" },\n },\n },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n const helpParams: Record = {};\n if (params.key) helpParams.key = params.key;\n return (await syncFetch(`/rooms/${resolved.room}/actions/help/invoke`, {\n method: \"POST\",\n body: { params: helpParams },\n token: resolved.token,\n })).data;\n },\n },\n\n {\n name: \"sync_eval_cel\",\n title: \"Evaluate CEL\",\n description: `Evaluate a CEL expression against the current room state.\n\nArgs: room, token (optional if authed), expr (required).\n\nReturns: { expression, value }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n expr: { type: \"string\", description: \"CEL expression\" },\n },\n required: [\"expr\"],\n },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n return (await syncFetch(`/rooms/${resolved.room}/eval`, {\n method: \"POST\",\n body: { expr: params.expr },\n token: resolved.token,\n })).data;\n },\n },\n\n {\n name: \"sync_delete_action\",\n title: \"Delete Action\",\n description: `Remove an action from a room.\n\nArgs: room, token (optional if authed), id (required).`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n id: { type: \"string\", description: \"Action ID to delete\" },\n },\n required: [\"id\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: true,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n return (await syncFetch(\n `/rooms/${resolved.room}/actions/_delete_action/invoke`,\n {\n method: \"POST\",\n body: { params: { id: params.id } },\n token: resolved.token,\n },\n )).data;\n },\n },\n\n {\n name: \"sync_delete_view\",\n title: \"Delete View\",\n description: `Remove a view from a room.\n\nArgs: room, token (optional if authed), id (required).`,\n inputSchema: {\n type: \"object\",\n properties: {\n room: { type: \"string\" },\n token: { type: \"string\" },\n id: { type: \"string\", description: \"View ID to delete\" },\n },\n required: [\"id\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: true,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n const resolved = await requireAuth(ctx, params);\n return (await syncFetch(\n `/rooms/${resolved.room}/actions/_delete_view/invoke`,\n {\n method: \"POST\",\n body: { params: { id: params.id } },\n token: resolved.token,\n },\n )).data;\n },\n },\n\n // ── Vault management (auth-only) ───────────────────────────\n\n {\n name: \"sync_vault_list\",\n title: \"List Vault\",\n description:\n `List all sync tokens stored in your vault. Requires OAuth authentication.\n\nReturns: Array of vault entries with room_id, token_type, label, is_default.`,\n inputSchema: { type: \"object\", properties: {} },\n annotations: {\n readOnlyHint: true,\n destructiveHint: false,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(_params, ctx) {\n if (!ctx.userId) {\n throw new Error(\"OAuth authentication required for vault access.\");\n }\n const { vaultList } = await import(\"./db.ts\");\n const entries = await vaultList(ctx.userId);\n return entries.map((e) => ({\n id: e.id,\n room_id: e.roomId,\n token_type: e.tokenType,\n label: e.label,\n is_default: e.isDefault,\n token_preview: e.token.substring(0, 12) + \"...\",\n }));\n },\n },\n\n {\n name: \"sync_vault_store\",\n title: \"Store Token in Vault\",\n description: `Add a sync token to your vault. Requires OAuth authentication.\n\nArgs:\n - room_id (string, required): Room ID this token belongs to.\n - token (string, required): The sync token (room_xxx, as_xxx, or view_xxx).\n - token_type (string, required): \"room\", \"agent\", or \"view\".\n - label (string, optional): Human-readable label.\n - set_default (boolean, optional): Make this the default room.\n\nReturns: { id, room_id, token_type }`,\n inputSchema: {\n type: \"object\",\n properties: {\n room_id: { type: \"string\" },\n token: { type: \"string\" },\n token_type: { type: \"string\", enum: [\"room\", \"agent\", \"view\"] },\n label: { type: \"string\" },\n set_default: { type: \"boolean\" },\n },\n required: [\"room_id\", \"token\", \"token_type\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: false,\n idempotentHint: false,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n if (!ctx.userId) {\n throw new Error(\"OAuth authentication required for vault access.\");\n }\n const { vaultStore } = await import(\"./db.ts\");\n const id = await vaultStore({\n userId: ctx.userId,\n roomId: params.room_id as string,\n token: params.token as string,\n tokenType: params.token_type as string,\n label: params.label as string | undefined,\n isDefault: params.set_default as boolean | undefined,\n });\n return { id, room_id: params.room_id, token_type: params.token_type };\n },\n },\n\n {\n name: \"sync_vault_remove\",\n title: \"Remove from Vault\",\n description: `Remove a token from your vault. Requires OAuth authentication.\n\nArgs:\n - id (string, required): Vault entry ID (from sync_vault_list).\n\nReturns: { deleted: true }`,\n inputSchema: {\n type: \"object\",\n properties: {\n id: { type: \"string\", description: \"Vault entry ID\" },\n },\n required: [\"id\"],\n },\n annotations: {\n readOnlyHint: false,\n destructiveHint: true,\n idempotentHint: true,\n openWorldHint: false,\n },\n async handler(params, ctx) {\n if (!ctx.userId) {\n throw new Error(\"OAuth authentication required for vault access.\");\n }\n const { vaultDelete } = await import(\"./db.ts\");\n await vaultDelete(ctx.userId, params.id as string);\n return { deleted: true, id: params.id };\n },\n },\n];",[],[246],"files",[159,178,187,195,205,215,226,235,244],"counts",{"_258":33,"_259":167,"_260":33,"_261":262,"_265":266},"pulls","branches","forks","envVars",{"_263":250,"_264":33},"count","emptyCount","connections",{"_263":33,"_267":33},"unfilledCount","contents",[270,273,276,279,282,285],{"_104":160,"_97":161,"_162":163,"_164":-5,"_165":147,"_166":167,"_168":169,"_106":271,"_101":33,"_171":172,"_173":-5,"_174":22,"_175":-5,"_100":272},["D",1772703232984],[161],{"_104":206,"_97":207,"_162":208,"_164":-5,"_165":147,"_166":209,"_168":169,"_106":274,"_101":211,"_171":183,"_173":212,"_174":22,"_175":-5,"_100":275},["D",1772705072369],[207],{"_104":216,"_97":217,"_162":218,"_164":-5,"_165":147,"_166":219,"_168":169,"_106":277,"_101":221,"_171":222,"_173":223,"_174":22,"_175":-5,"_100":278},["D",1772718639963],[217],{"_104":227,"_97":228,"_162":229,"_164":-5,"_165":147,"_166":221,"_168":169,"_106":280,"_101":231,"_171":222,"_173":232,"_174":22,"_175":-5,"_100":281},["D",1772704837246],[228],{"_104":236,"_97":237,"_162":238,"_164":-5,"_165":147,"_166":146,"_168":169,"_106":283,"_101":221,"_171":240,"_173":241,"_174":22,"_175":-5,"_100":284},["D",1772720826341],[237],{"_104":245,"_97":246,"_162":247,"_164":-5,"_165":147,"_166":248,"_168":169,"_106":286,"_101":250,"_171":222,"_173":251,"_174":22,"_175":-5,"_100":287},["D",1772720718926],[246],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_95":96,"_97":98,"_102":296,"_261":301,"_314":22},{"_104":105,"_97":98,"_106":297,"_108":-5,"_109":22,"_110":111,"_112":113,"_114":-5,"_14":115,"_116":-5,"_117":22,"_118":-5,"_119":-5,"_120":33,"_16":121,"_122":123,"_124":125,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":298,"_139":299,"_144":300,"_156":22},["D",1772631255241],{"_95":96,"_137":138},{"_95":96,"_141":138,"_14":115,"_142":143},{"_101":146,"_97":45,"_104":147,"_148":105,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":98,"_155":96},[302,310],{"_303":304,"_106":305,"_306":307,"_112":308,"_309":22},"key","SYNC_URL",["D",1772711393602],"updatedAt",["D",1772718358215],"Main sync service endpoint","isEmpty",{"_303":311,"_106":312,"_306":-5,"_112":313,"_309":22},"WEBAUTHN_RP_ID",["D",1772703145687],"Stable WebAuthn Relying Party ID. Passkeys registered under this rpId work on any *.parc.land origin.","isTeamOrg","actionData","errors"]

c15r

sync-mcp

Environment variables