[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_264":265,"_266":267},"routes/_app.x.$handle.$name",{"_96":95,"_32":44,"_105":86,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":25,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":54,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",20,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_34":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":20,"_34":35},"deleted",false,"deletedHere","path","README.md","latestPath","fileId","f0b498b4-a098-11f0-a8cf-0224a6c84d84","name","fileType","content","# Subregistry API for the Official MCP Registry\n\nI want to create a subregistry API using the following tech stack:\n\n- [Drizzle](https://docs.val.town/std/sqlite/orms/#drizzle)\n- [Hono](https://hono.dev/)\n- [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk)\n- [Open API Spec](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml)\n- [Val.Town Blobs](https://docs.val.town/std/blob/)\n- [Val.Town SQLite](https://docs.val.town/std/sqlite/usage/)\n- [Zod]\n\n### Core Endpoints\n\n- GET /v0/servers - List all servers with pagination\n- GET /v0/servers/{serverName} - Get latest version of server by server name (URL-encoded)\n- GET /v0/servers/{serverName}/versions/{version} - Get specific version of server (both parameters should be URL-encoded)\n- GET /v0/servers/{serverName}/versions - List all versions of a server\n- POST /v0/publish - Publish new server (optional, registry-specific authentication)\n\n### Authentication\n\n- Read operations: No authentication required\n- Write operations: Registry-specific authentication (if supported)\nContent Type\n\nAll requests and responses use application/json\n\n## Pagination\n\nList endpoints use cursor-based pagination for efficient, stable results.\n\n## Usage\n\n- Initial request: Omit the cursor parameter\n- Subsequent requests: Use the nextCursor value from the previous response\n- End of results: When nextCursor is null or empty, there are no more results\n\nImportant: Always treat cursors as opaque strings. Never manually construct or modify cursor values.\n\n## Plan\n\n- [x] Validate the Open API spec is 100% up to date\n- [ ] Create database tables that meets the Open API spec using Val.Town SQLite and Val.Town Blobs (for storing images) and use the zod types in \"npm:mcp-registry-spec-sdk\"\n- [ ] Create Hono endopints ","# Subregistry API for the Official MCP Registry\n\nI want to create an MCP [Subregistry](https://github.com/modelcontextprotocol/registry/blob/main/docs/guides/consuming/use-rest-api.md#building-a-subregistry) API using the following tech stack:\n\n- [Drizzle](https://docs.val.town/std/sqlite/orms/#drizzle)\n- [Hono](https://hono.dev/)\n- [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk)\n- [Open API Spec](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml)\n- [Val.Town Blobs](https://docs.val.town/std/blob/)\n- [Val.Town SQLite](https://docs.val.town/std/sqlite/usage/)\n- [Zod]\n\n### Core Endpoints\n\n- GET /v0/servers — List all servers with pagination\n- GET /v0/servers/{serverName} — Get the latest version of a server (URL-encoded)\n- GET /v0/servers/{serverName}/versions — List all versions of a server\n- GET /v0/servers/{serverName}/versions/{version} — Get a specific version (both parameters URL-encoded)\n\n### Authentication\n\n- Read operations: No authentication required\n- Write operations: Namespace-scoped bearer token issued via official auth exchanges\nContent Typek\n\nAll requests and responses use application/json\n\n### Subregistry Extensions (faith.tools)\n\nThe canonical OpenAPI contract now mirrors the upstream 2025-09-29 MCP registry spec. The faith.tools subregistry layers optional features on top:\n\n- Extended query parameters on `GET /v0/servers`:\n - `search` — simple LIKE-based token search (subregistry only)\n - `updatedSince`, `version` — enable incremental syncs (documented outside the base spec)\n- Auth token exchange endpoints (not part of the upstream spec):\n - POST /v0/auth/github-at\n - POST /v0/auth/github-oidc\n - POST /v0/auth/dns\n - POST /v0/auth/http\n - POST /v0/auth/oidc\n- Observability/admin:\n - GET /metrics — Prometheus metrics endpoint exporting registry counters (publish/update/auth exchange) and uptime\n - GET /v0/health — Enhanced status payload with uptime, metrics summary, and timestamp\n- Marketplace metadata:\n - Publisher-provided `_meta` may include `marketplaceIcon`\n - Registry-managed `_meta.io.modelcontextprotocol.registry/official.marketplaceIcon` stores cached blob references\n\nClients should treat these additions as optional subregistry features.\n\n## Pagination\n\nList endpoints use cursor-based pagination for efficient, stable results.\n\n## Usage\n\n- Initial request: Omit the cursor parameter\n- Subsequent requests: Use the nextCursor value from the previous response\n- End of results: When nextCursor is null or empty, there are no more results\n\nImportant: Always treat cursors as opaque strings. Never manually construct or modify cursor values.\n\n### Database & Storage\n\n- **Val Town compatibility:** We proxy every statement through `sqlite.execute(...)`, matching the [Val Town SQLite migration guidance](https://docs.val.town/std/sqlite/migrations/). Schema bumps create new `_poc_vN` tables instead of running `ALTER TABLE`, and the Drizzle sqlite-proxy adapter is just a typed wrapper around the same helper shown in the [Val Town Drizzle ORM docs](https://docs.val.town/std/sqlite/orms/).\n- **Schema highlights (`server_versions_poc_v2`):** Core fields store canonical server metadata (`server_name`, `version`, timestamps, status), while `search_text` plus supporting indices power LIKE filtering. Optional columns cache blob icon references and MCP capability flags as JSON strings for future expansion. See [`backend/database/migrations.ts`](backend/database/migrations.ts) for the full definition.\n- **Query behavior:** All writes validate against the SDK Zod schemas, recompute `is_latest`, and derive search tokens before persisting. Reads enforce the same schemas, use cursor-based pagination (base64url of `updatedAt`, `serverNameLower`, `version`), and currently treat blob columns as placeholders until the blob ingestion plan lands.\n\n## Plan\n\n- [x] Validate the Open API spec is 100% up to date with upstream 2025-09-29 release\n- [x] Create database tables that meet the Open API spec using Val.Town SQLite/Blobs and the Zod types in `npm:mcp-registry-spec-sdk`\n- [x] Create Hono endpoints (additional integration tests pending)\n- [ ] Wire marketplaceIcon ingestion into publish/update flows\n- [ ] Implement official auth exchanges (GitHub/DNS/HTTP/OIDC) and namespace enforcement\n- [ ] Enforce package ownership, remote URL, registry allowlist, and `_meta` constraints during publish/update\n- [x] Add `/metrics` endpoint and enhanced health checks, then update README/testing guidance\n\n### Manual Test Checklist\n\n- Publish a new server via POST /v0/publish and confirm the response validates against the SDK schema.\n- Publish a server with a remote/data-URL `marketplaceIcon` and verify `blobIconKey/blobIconMime` plus the cached pointer in `_meta`.\n- Fetch GET /v0/servers/{serverName} to verify the latest version flag (`is_latest`) is set correctly.\n- List versions with GET /v0/servers/{serverName}/versions and ensure ordering by `published_at` + `id`.\n- Page through GET /v0/servers with and without `cursor`, confirming `nextCursor` progression.\n- Exercise search by passing tokenized `search` terms and verifying LIKE-based filtering on `search_text`.\n- Update an existing version via PUT /v0/servers/{serverName}/versions/{version} and confirm derived fields recompute, while timestamps behave as expected.\n- Update a version that already has a cached icon and ensure the blob rotates (old key deleted, new key present).\n- Invoke GET /v0/health and confirm uptimeSeconds/timestamp/metrics keys reflect recent activity.\n- Scrape GET /metrics and validate Prometheus exposition format includes publish/update/auth counters and uptime gauge.\n\n### Developer Notes\n\n- Running `deno check main.ts` locally requires allowing remote imports (`deno check --allow-import main.ts`) to satisfy Val Town SDK dependencies.\n\n ## Contact\n\nHey, I'm Cam Pak. [Let me know how I can make this better for you](https://cameronpak.com/contact). \n","createdAt",["D",1759552099051],"branchVersion","branchId","51d9b5fe-a097-11f0-b09c-0224a6c84d84","id","51d870cc-a097-11f0-b09c-0224a6c84d84","mcp-registry-subregistry-api",["D",1759523222208],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","A Subregistry API for the official MCP Registry","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/d6a72ebf-a436-4879-84af-204c8360fa00/square512?exp=1789556399&sig=270cccc74c83926aaf96eb4c8fd4e7193434e336f48ad3d2a66e8935fa146479","35ef5666-3780-42d5-ade0-86fe3fdb6bb1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","47e0b4b2-7d41-46e6-8dce-0ae3d76e1a8f","tursoName","tursoHostname","tursoMeasuredAt","pinned",4,"userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"isOwned",26,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","cameronpak","handle","displayName","Cam","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/7fcc9ac1-f8fb-41e2-0168-af29ef7c6400/square512?exp=1789556399&sig=470b2695b8fb7a457a31f8ed2ee945307d8030c97d75e5e579be6c29d8e03a46","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":260,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":54,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":261,"_80":262,"_82":263,"_84":25},"tree",[196,201,202,203,204,205,206],"files",[196,197,198,199,200,201,202,203,204,205,206],"counts",{"_186":169,"_187":61,"_188":169,"_189":190,"_191":192},"contents",[127,128,129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":179,"_32":180,"_30":181,"_137":-5,"_40":41,"_39":182,"_139":157,"_37":183,"_13":169,"_33":184,"_34":-5,"_24":25,"_142":-5,"_27":185},{"_42":172,"_32":173,"_30":174,"_137":-5,"_40":41,"_39":175,"_139":157,"_37":176,"_13":169,"_33":20,"_34":177,"_24":25,"_142":-5,"_27":178},{"_42":165,"_32":166,"_30":167,"_137":-5,"_40":41,"_39":68,"_139":157,"_37":168,"_13":169,"_33":20,"_34":170,"_24":25,"_142":-5,"_27":171},{"_42":162,"_32":28,"_30":31,"_137":-5,"_40":41,"_39":14,"_139":157,"_37":163,"_13":149,"_33":20,"_34":36,"_24":25,"_142":-5,"_27":164},{"_42":153,"_32":154,"_30":155,"_137":-5,"_40":41,"_39":156,"_139":157,"_37":158,"_13":159,"_33":20,"_34":160,"_24":25,"_142":-5,"_27":161},{"_42":144,"_32":145,"_30":146,"_137":-5,"_40":41,"_39":147,"_139":25,"_37":148,"_13":149,"_33":150,"_34":151,"_24":25,"_142":-5,"_27":152},{"_42":134,"_32":135,"_30":136,"_137":-5,"_40":41,"_39":138,"_139":25,"_37":140,"_13":61,"_33":20,"_34":141,"_24":25,"_142":-5,"_27":143},"2b39661a-a09c-11f0-8f63-0224a6c84d84","openapi.yaml","f0ba5fba-a098-11f0-826f-0224a6c84d84","parentId",8,"latest",["D",1759525304893],"openapi: 3.1.0\njsonSchemaDialect: \"https://json-schema.org/draft/2020-12/schema\"\n$id: https://modelcontextprotocol.io/schemas/draft/2025-09-29/server-registry-openapi\ninfo:\n title: faith.tools MCP Server Subregistry API\n version: \"2025-09-29\"\n summary: API for discovering and accessing MCP server metadata\n description: |\n Specification for the faith.tools MCP Server Subregistry of \n MCP servers. The best place to discover and distribute MCP\n servers (connectors/integrations) for Christians.\n license:\n name: MIT\n identifier: MIT\n\npaths:\n /v0/servers:\n get:\n summary: List MCP servers\n description: Returns a list of registered MCP servers with optional filters and pagination.\n parameters:\n - name: cursor\n in: query\n description: Pagination cursor for retrieving next set of results. Cursors are opaque strings returned in metadata.nextCursor.\n required: false\n schema:\n type: string\n - name: limit\n in: query\n description: Maximum number of items to return\n required: false\n schema:\n type: integer\n - name: search\n in: query\n description: Text search filter\n required: false\n schema:\n type: string\n - name: updatedSince\n in: query\n description: ISO 8601 timestamp; return servers updated since this time\n required: false\n schema:\n type: string\n - name: version\n in: query\n description: Exact version filter\n required: false\n schema:\n type: string\n responses:\n '200':\n description: A list of MCP servers\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerListResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/servers/{serverName}:\n get:\n summary: Get MCP server (latest)\n description: Returns the latest version of a specific MCP server.\n parameters:\n - name: serverName\n in: path\n required: true\n description: URL-encoded server name (e.g., \"com.example%2Fmy-server\")\n schema:\n type: string\n responses:\n '200':\n description: Detailed server information (latest)\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/servers/{serverName}/versions:\n get:\n summary: List all versions of an MCP server\n description: Returns all available versions for a specific MCP server, ordered by publication date (newest first).\n parameters:\n - name: serverName\n in: path\n required: true\n description: URL-encoded server name (e.g., \"com.example%2Fmy-server\")\n schema:\n type: string\n responses:\n '200':\n description: All versions for the server\n content:\n application/json:\n schema:\n type: array\n items:\n $ref: '#/components/schemas/ServerResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/servers/{serverName}/versions/{version}:\n get:\n summary: Get specific MCP server version\n description: Returns detailed information about a specific version of an MCP server.\n parameters:\n - name: serverName\n in: path\n required: true\n description: URL-encoded server name (e.g., \"com.example%2Fmy-server\")\n schema:\n type: string\n - name: version\n in: path\n required: true\n description: URL-encoded version to retrieve (e.g., \"1.0.0\" or \"1.0.0%2Bbuild\")\n schema:\n type: string\n responses:\n '200':\n description: Detailed server information for the requested version\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/publish:\n post:\n summary: Publish MCP server\n description: Publish a new MCP server to the registry or update an existing one.\n security:\n - bearerAuth: []\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerJSON'\n responses:\n '200':\n description: Successfully published server\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerResponse'\n '401':\n $ref: '#/components/responses/ProblemDetail'\n '403':\n $ref: '#/components/responses/ProblemDetail'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/servers/{serverName}/versions/{version}:\n put:\n summary: Edit server version (admin)\n description: Edit an existing server version (admin only).\n security:\n - bearerAuth: []\n parameters:\n - name: serverName\n in: path\n required: true\n schema:\n type: string\n - name: version\n in: path\n required: true\n schema:\n type: string\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerJSON'\n responses:\n '200':\n description: Updated server version\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ServerResponse'\n '401':\n $ref: '#/components/responses/ProblemDetail'\n '403':\n $ref: '#/components/responses/ProblemDetail'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n # Authentication\n /v0/auth/github-at:\n post:\n summary: Exchange GitHub OAuth access token for Registry JWT\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/GitHubTokenExchangeInputBody'\n responses:\n '200':\n description: Registry token\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/TokenResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/auth/github-oidc:\n post:\n summary: Exchange GitHub OIDC token for Registry JWT\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/GitHubOIDCTokenExchangeInputBody'\n responses:\n '200':\n description: Registry token\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/TokenResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/auth/http:\n post:\n summary: Exchange HTTP signature for Registry JWT\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/HTTPTokenExchangeInputBody'\n responses:\n '200':\n description: Registry token\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/TokenResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/auth/oidc:\n post:\n summary: Exchange OIDC ID token for Registry JWT\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/OIDCTokenExchangeInputBody'\n responses:\n '200':\n description: Registry token\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/TokenResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/auth/dns:\n post:\n summary: Exchange DNS signature for Registry JWT\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DNSTokenExchangeInputBody'\n responses:\n '200':\n description: Registry token\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/TokenResponse'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n # Health\n /v0/health:\n get:\n summary: Get health status\n responses:\n '200':\n description: Health status\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/HealthBody'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\n /v0/ping:\n get:\n summary: Ping the registry\n responses:\n '200':\n description: Ping info\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/PingBody'\n default:\n $ref: '#/components/responses/ProblemDetail'\n\ncomponents:\n securitySchemes:\n bearerAuth:\n type: http\n scheme: bearer\n bearerFormat: JWT\n description: Bearer token for authenticated operations.\n\n responses:\n ProblemDetail:\n description: RFC 7807 Problem Details\n content:\n application/problem+json:\n schema:\n $ref: '#/components/schemas/ErrorModel'\n\n schemas:\n # -------- Registry-managed metadata (API responses) --------\n RegistryExtensions:\n type: object\n properties:\n serverId:\n type: string\n versionId:\n type: string\n publishedAt:\n type: string\n updatedAt:\n type: string\n isLatest:\n type: boolean\n status:\n type: string\n additionalProperties: false\n\n # -------- Publisher-provided meta wrapper --------\n ServerJSONMeta:\n type: object\n properties:\n \"io.modelcontextprotocol.registry/publisher-provided\":\n type: object\n additionalProperties: true\n\n # -------- API response meta wrapper (includes official) --------\n ServerResponseMeta:\n type: object\n properties:\n \"io.modelcontextprotocol.registry/official\":\n $ref: '#/components/schemas/RegistryExtensions'\n \"io.modelcontextprotocol.registry/publisher-provided\":\n type: object\n additionalProperties: true\n\n # -------- Unified Argument schema --------\n Argument:\n type: object\n properties:\n name:\n type: string\n description:\n type: string\n format:\n type: string\n default:\n type: string\n value:\n type: string\n choices:\n type: array\n items:\n type: string\n nullable: true\n\n isRequired:\n type: boolean\n isSecret:\n type: boolean\n isRepeated:\n type: boolean\n valueHint:\n type: string\n\n type:\n type: string\n\n variables:\n type: object\n additionalProperties:\n type: object\n properties:\n description:\n type: string\n format:\n type: string\n default:\n type: string\n isRequired:\n type: boolean\n valueHint:\n type: string\n choices:\n type: array\n items:\n type: string\n nullable: true\n additionalProperties: false\n additionalProperties: false\n\n # Back-compat aliases (deprecated)\n Input:\n allOf:\n - $ref: '#/components/schemas/Argument'\n deprecated: true\n description: Deprecated alias of Argument.\n KeyValueInput:\n allOf:\n - $ref: '#/components/schemas/Argument'\n deprecated: true\n description: Deprecated alias of Argument.\n\n # -------- Transports / Remotes --------\n Transport:\n type: object\n properties:\n type:\n type: string\n url:\n type: string\n headers:\n type: array\n items:\n $ref: '#/components/schemas/Argument'\n required: [type, url]\n additionalProperties: false\n\n Remote:\n type: object\n properties:\n transportType:\n type: string\n url:\n type: string\n headers:\n type: array\n items:\n $ref: '#/components/schemas/Argument'\n required: [transportType, url]\n additionalProperties: false\n\n # -------- Repository --------\n Repository:\n type: object\n required:\n - url\n - source\n properties:\n id:\n type: string\n source:\n type: string\n subfolder:\n type: string\n url:\n type: string\n additionalProperties: false\n\n # -------- Package (camelCase) --------\n Package:\n type: object\n required:\n - registryType\n - version\n properties:\n registryType:\n type: string\n description: Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')\n registryBaseUrl:\n type: string\n identifier:\n type: string\n fileSha256:\n type: string\n\n name:\n type: string\n version:\n type: string\n\n runtimeHint:\n type: string\n runtimeArguments:\n type: array\n items:\n $ref: '#/components/schemas/Argument'\n nullable: true\n packageArguments:\n type: array\n items:\n $ref: '#/components/schemas/Argument'\n nullable: true\n environmentVariables:\n type: array\n items:\n $ref: '#/components/schemas/Argument'\n nullable: true\n\n transport:\n $ref: '#/components/schemas/Transport'\n additionalProperties: false\n\n # -------- Server JSON (publisher input) --------\n ServerJSON:\n type: object\n properties:\n $schema:\n type: string\n name:\n type: string\n description:\n type: string\n version:\n type: string\n repository:\n $ref: '#/components/schemas/Repository'\n websiteUrl:\n type: string\n\n packages:\n type: array\n items:\n $ref: '#/components/schemas/Package'\n nullable: true\n remotes:\n type: array\n items:\n $ref: '#/components/schemas/Remote'\n nullable: true\n\n _meta:\n $ref: '#/components/schemas/ServerJSONMeta'\n required:\n - name\n - description\n - version\n additionalProperties: false\n\n # -------- Server Response (API output) --------\n ServerResponse:\n type: object\n properties:\n $schema:\n type: string\n name:\n type: string\n description:\n type: string\n version:\n type: string\n repository:\n $ref: '#/components/schemas/Repository'\n websiteUrl:\n type: string\n\n packages:\n type: array\n items:\n $ref: '#/components/schemas/Package'\n nullable: true\n remotes:\n type: array\n items:\n $ref: '#/components/schemas/Remote'\n nullable: true\n\n _meta:\n $ref: '#/components/schemas/ServerResponseMeta'\n required:\n - name\n - description\n - version\n\n # -------- List / pagination --------\n Metadata:\n type: object\n properties:\n nextCursor:\n type: string\n count:\n type: number\n required: [count]\n additionalProperties: false\n\n ServerListResponse:\n type: object\n properties:\n servers:\n type: array\n items:\n $ref: '#/components/schemas/ServerResponse'\n metadata:\n $ref: '#/components/schemas/Metadata'\n required: [servers, metadata]\n additionalProperties: false\n\n # -------- Auth exchange bodies / tokens --------\n GitHubTokenExchangeInputBody:\n type: object\n properties:\n github_token:\n type: string\n required: [github_token]\n\n TokenResponse:\n type: object\n properties:\n expires_at:\n type: number\n registry_token:\n type: string\n required: [expires_at, registry_token]\n\n GitHubOIDCTokenExchangeInputBody:\n type: object\n properties:\n oidc_token:\n type: string\n required: [oidc_token]\n\n HTTPTokenExchangeInputBody:\n type: object\n properties:\n domain:\n type: string\n signed_timestamp:\n type: string\n timestamp:\n type: string\n required: [domain, signed_timestamp, timestamp]\n\n OIDCTokenExchangeInputBody:\n type: object\n properties:\n oidc_token:\n type: string\n required: [oidc_token]\n\n DNSTokenExchangeInputBody:\n type: object\n properties:\n domain:\n type: string\n signed_timestamp:\n type: string\n timestamp:\n type: string\n required: [domain, signed_timestamp, timestamp]\n\n # -------- Health / Ping --------\n HealthBody:\n type: object\n properties:\n status:\n type: string\n required: [status]\n\n PingBody:\n type: object\n properties:\n environment:\n type: string\n version:\n type: string\n required: [environment, version]\n\n # -------- Errors --------\n ErrorDetail:\n type: object\n properties:\n location:\n type: string\n message:\n type: string\n value:\n nullable: true\n required:\n - message\n\n ErrorModel:\n type: object\n properties:\n detail:\n type: string\n errors:\n type: array\n items:\n $ref: '#/components/schemas/ErrorDetail'\n nullable: true\n instance:\n type: string\n status:\n type: number\n title:\n type: string\n type:\n type: string\n additionalProperties: false","label",[135],"8dca8ece-a0da-11f0-bb5b-0224a6c84d84","main.ts","51e4ada6-a097-11f0-b09c-0224a6c84d84",19,["D",1759552099020],3,"script","import { Hono } from 'npm:hono@4.9.9';\nimport type { Context } from 'npm:hono@4.9.9';\nimport type {\n ErrorModel,\n HealthBody,\n PingBody,\n ServerJSON,\n ServerListResponse,\n ServerResponse,\n} from 'npm:mcp-registry-spec-sdk@0.1.2';\nimport {\n ServerJSONSchema,\n} from 'npm:mcp-registry-spec-sdk@0.1.2';\nimport {\n getLatestServerByName,\n getServerByNameVersion,\n listServerVersions,\n listServers as listServersQuery,\n publishServerVersion,\n updateServerVersion,\n} from './backend/database/queries.ts';\n\nconst API_VERSION = '2025-09-29';\nconst START_TIME = Date.now();\nconst metricsState = {\n publishTotal: 0,\n updateTotal: 0,\n authExchanges: new Map(),\n};\n\ntype RegistryBindings = {\n REGISTRY_AUTH_SECRET?: string;\n GITHUB_AT_SHARED_SECRET?: string;\n GITHUB_OIDC_SHARED_SECRET?: string;\n DNS_SHARED_SECRET?: string;\n HTTP_SHARED_SECRET?: string;\n OIDC_SHARED_SECRET?: string;\n};\n\ntype NormalizedIssue = {\n path: (string | number)[];\n message: string;\n received?: unknown;\n};\n\ntype RegistryTokenClaims = {\n version: 1;\n namespaces: string[];\n methods: string[];\n iat: number;\n exp: number;\n};\n\nconst TEXT_ENCODER = new TextEncoder();\nconst TEXT_DECODER = new TextDecoder();\nconst HMAC_KEY_CACHE = new Map>();\n\nclass ProblemError extends Error {\n problem: ErrorModel;\n\n constructor(problem: ErrorModel) {\n super(problem.detail ?? problem.title ?? 'Registry error');\n this.problem = problem;\n }\n}\n\nconst app = new Hono<{ Bindings: RegistryBindings }>();\n\napp.onError((err, c) => {\n if (err instanceof ProblemError) {\n return problemResponse(c, (err as ProblemError).problem);\n }\n console.error(err);\n return problemResponse(\n c,\n createProblem(500, 'Internal Server Error', 'An unexpected error occurred.', c),\n );\n});\n\napp.get('/', (c) =>\n c.json({\n message: 'faith.tools MCP Subregistry API',\n documentation: 'https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/generic-registry-api.md',\n }),\n);\n\napp.get('/v0/servers', async (c) => {\n const q = c.req.query();\n const cursor = q.cursor ?? undefined;\n const search = q.search ?? undefined;\n const limitRaw = q.limit ?? undefined;\n const limit = limitRaw != null ? Number(limitRaw) : undefined;\n\n if (limitRaw != null && (Number.isNaN(limit) || limit! <= 0)) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid limit parameter',\n 'limit must be a positive integer.',\n c,\n [\n {\n location: 'query.limit',\n message: 'Expected positive integer',\n value: limitRaw,\n },\n ],\n ),\n );\n }\n\n const result: ServerListResponse = await listServersQuery({\n cursor,\n limit,\n search,\n });\n\n return c.json(result);\n});\n\napp.get('/v0/servers/:serverName', async (c) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const result = await getLatestServerByName(serverName);\n if (!result) {\n throw new ProblemError(\n createProblem(404, 'Server not found', `No server registered for ${serverName}.`, c),\n );\n }\n return c.json(result);\n});\n\napp.get('/v0/servers/:serverName/versions', async (c) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const versions: ServerResponse[] = await listServerVersions(serverName);\n return c.json(versions);\n});\n\napp.get('/v0/servers/:serverName/versions/:version', async (c) => {\n const serverName = decodePathParam(c.req.param('serverName'));\n const version = decodePathParam(c.req.param('version'));\n const result = await getServerByNameVersion(serverName, version);\n if (!result) {\n throw new ProblemError(\n createProblem(\n 404,\n 'Server version not found',\n `No version ${version} found for ${serverName}.`,\n c,\n ),\n );\n }\n return c.json(result);\n});\n\napp.post('/v0/publish', async (c) => {\n const auth = await ensurePublishAuth(c);\n const payload = await readJson(c);\n\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n const issues = toValidationIssues(parsed.error.issues);\n throw new ProblemError(\n createValidationProblem(\n 422,\n 'Invalid server payload',\n 'Request body failed validation.',\n c,\n issues,\n ),\n );\n }\n\n assertNamespaceAuthorized(auth, parsed.data.name, c);\n validateOfficialPolicies(parsed.data, c);\n\n const result = await publishServerVersion(parsed.data);\n metricsState.publishTotal += 1;\n return c.json(result);\n});\n\napp.put('/v0/servers/:serverName/versions/:version', async (c) => {\n const auth = await ensurePublishAuth(c);\n const serverName = decodePathParam(c.req.param('serverName'));\n const version = decodePathParam(c.req.param('version'));\n const payload = await readJson(c);\n\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n const issues = toValidationIssues(parsed.error.issues);\n throw new ProblemError(\n createValidationProblem(\n 422,\n 'Invalid server payload',\n 'Request body failed validation.',\n c,\n issues,\n ),\n );\n }\n\n if (parsed.data.name.toLowerCase() !== serverName.toLowerCase()) {\n throw new ProblemError(\n createProblem(\n 409,\n 'Server name mismatch',\n 'Path serverName does not match payload.name.',\n c,\n [\n {\n location: 'body.name',\n message: `Expected ${serverName}`,\n value: parsed.data.name,\n },\n ],\n ),\n );\n }\n\n if (parsed.data.version !== version) {\n throw new ProblemError(\n createProblem(\n 409,\n 'Version mismatch',\n 'Path version does not match payload.version.',\n c,\n [\n {\n location: 'body.version',\n message: `Expected ${version}`,\n value: parsed.data.version,\n },\n ],\n ),\n );\n }\n\n assertNamespaceAuthorized(auth, parsed.data.name, c);\n validateOfficialPolicies(parsed.data, c);\n\n const result = await updateServerVersion(serverName, version, parsed.data);\n metricsState.updateTotal += 1;\n return c.json(result);\n});\n\napp.get('/v0/health', (c) => {\n const uptimeSeconds = Math.floor((Date.now() - START_TIME) / 1000);\n const payload: HealthBody & {\n uptimeSeconds: number;\n timestamp: string;\n metrics: { publishTotal: number; updateTotal: number; authExchangeTotal: number };\n } = {\n status: 'ok',\n uptimeSeconds,\n timestamp: new Date().toISOString(),\n metrics: {\n publishTotal: metricsState.publishTotal,\n updateTotal: metricsState.updateTotal,\n authExchangeTotal: Array.from(metricsState.authExchanges.values()).reduce(\n (sum, value) => sum + value,\n 0,\n ),\n },\n };\n return c.json(payload);\n});\n\napp.get('/v0/ping', (c) => {\n const payload: PingBody = {\n environment: 'subregistry',\n version: API_VERSION,\n };\n return c.json(payload);\n});\n\napp.post('/v0/auth/github-at', (c) =>\n handleAuthExchange(c, {\n method: 'github-at',\n secretEnvKey: 'GITHUB_AT_SHARED_SECRET',\n namespaceMode: 'github',\n }),\n);\n\napp.post('/v0/auth/github-oidc', (c) =>\n handleAuthExchange(c, {\n method: 'github-oidc',\n secretEnvKey: 'GITHUB_OIDC_SHARED_SECRET',\n namespaceMode: 'github',\n }),\n);\n\napp.post('/v0/auth/dns', (c) =>\n handleAuthExchange(c, {\n method: 'dns',\n secretEnvKey: 'DNS_SHARED_SECRET',\n namespaceMode: 'domain',\n }),\n);\n\napp.post('/v0/auth/http', (c) =>\n handleAuthExchange(c, {\n method: 'http',\n secretEnvKey: 'HTTP_SHARED_SECRET',\n namespaceMode: 'domain',\n }),\n);\n\napp.post('/v0/auth/oidc', (c) =>\n handleAuthExchange(c, {\n method: 'oidc',\n secretEnvKey: 'OIDC_SHARED_SECRET',\n namespaceMode: 'generic',\n }),\n);\n\napp.get('/metrics', (c) => {\n const uptimeSeconds = Math.floor((Date.now() - START_TIME) / 1000);\n const lines: string[] = [];\n lines.push('# HELP faith_tools_registry_publish_total Total successful server publish operations.');\n lines.push('# TYPE faith_tools_registry_publish_total counter');\n lines.push(`faith_tools_registry_publish_total ${metricsState.publishTotal}`);\n\n lines.push('# HELP faith_tools_registry_update_total Total successful server update operations.');\n lines.push('# TYPE faith_tools_registry_update_total counter');\n lines.push(`faith_tools_registry_update_total ${metricsState.updateTotal}`);\n\n lines.push('# HELP faith_tools_registry_auth_exchange_total Total auth exchanges by method.');\n lines.push('# TYPE faith_tools_registry_auth_exchange_total counter');\n for (const [method, count] of metricsState.authExchanges.entries()) {\n lines.push(`faith_tools_registry_auth_exchange_total{method=\"${method}\"} ${count}`);\n }\n\n lines.push('# HELP faith_tools_registry_uptime_seconds Process uptime in seconds.');\n lines.push('# TYPE faith_tools_registry_uptime_seconds gauge');\n lines.push(`faith_tools_registry_uptime_seconds ${uptimeSeconds}`);\n\n return new Response(lines.join('\\n') + '\\n', {\n status: 200,\n headers: {\n 'content-type': 'text/plain; version=0.0.4',\n },\n });\n});\n\nexport default app.fetch;\n\nasync function ensurePublishAuth(\n c: Context<{ Bindings: RegistryBindings }>,\n): Promise {\n const secret = c.env?.REGISTRY_AUTH_SECRET;\n if (!secret) {\n throw new ProblemError(\n createProblem(\n 500,\n 'Server configuration error',\n 'REGISTRY_AUTH_SECRET is not configured for this subregistry.',\n c,\n ),\n );\n }\n const header = c.req.header('authorization');\n if (!header?.startsWith('Bearer ')) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Bearer token is required for this operation.', c),\n );\n }\n const token = header.slice('Bearer '.length).trim();\n const claims = await verifyRegistryToken(token, secret, c);\n if (claims.exp * 1000 <= Date.now()) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token has expired.', c),\n );\n }\n return claims;\n}\n\nasync function readJson(c: Context<{ Bindings: RegistryBindings }>): Promise {\n try {\n return await c.req.json();\n } catch {\n throw new ProblemError(\n createProblem(400, 'Invalid JSON body', 'Failed to parse request body as JSON.', c),\n );\n }\n}\n\nexport type IssueTokenParams = {\n namespaces: string[];\n method: string;\n secret: string | undefined;\n expiresInSeconds?: number;\n context: Context<{ Bindings: RegistryBindings }>;\n};\n\nexport type AuthMethodConfig = {\n method: string;\n secretEnvKey: keyof RegistryBindings;\n namespaceMode: 'github' | 'domain' | 'generic';\n};\n\nasync function handleAuthExchange(\n c: Context<{ Bindings: RegistryBindings }>,\n config: AuthMethodConfig,\n): Promise {\n const sharedSecret = c.env?.[config.secretEnvKey];\n if (!sharedSecret) {\n throw new ProblemError(\n createProblem(\n 501,\n 'Not Implemented',\n `${config.method} auth exchange is not configured on this subregistry.`,\n c,\n ),\n );\n }\n\n const body = await readJson>(c);\n const proofRaw = body['proof'];\n if (typeof proofRaw !== 'string' || !proofRaw.trim()) {\n throw new ProblemError(\n createProblem(400, 'Invalid request', 'proof is required and must be a string.', c),\n );\n }\n\n const namespacesRaw = body['namespaces'];\n if (!Array.isArray(namespacesRaw) || namespacesRaw.length === 0) {\n throw new ProblemError(\n createProblem(400, 'Invalid request', 'namespaces must be a non-empty array of strings.', c),\n );\n }\n const namespacesInput: string[] = [];\n for (const ns of namespacesRaw) {\n if (typeof ns !== 'string') {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid request',\n 'namespaces must only contain string values.',\n c,\n ),\n );\n }\n namespacesInput.push(ns);\n }\n\n let expiresInSeconds: number | undefined;\n const expiresRaw = body['expiresInSeconds'];\n if (typeof expiresRaw === 'number' && Number.isFinite(expiresRaw)) {\n expiresInSeconds = expiresRaw;\n } else if (typeof expiresRaw === 'string' && expiresRaw.trim()) {\n const parsed = Number(expiresRaw);\n if (!Number.isNaN(parsed) && Number.isFinite(parsed)) {\n expiresInSeconds = parsed;\n }\n }\n\n const proof = proofRaw.trim();\n if (proof !== sharedSecret) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Proof verification failed for auth exchange.', c),\n );\n }\n\n const normalizedNamespaces = normalizeNamespaceList(namespacesInput);\n validateNamespaceList(normalizedNamespaces, config.namespaceMode, c);\n\n const { token, claims } = await issueRegistryToken({\n namespaces: normalizedNamespaces,\n method: config.method,\n secret: c.env?.REGISTRY_AUTH_SECRET,\n expiresInSeconds,\n context: c,\n });\n recordAuthExchange(config.method);\n\n return c.json({\n registry_token: token,\n expires_at: new Date(claims.exp * 1000).toISOString(),\n namespaces: claims.namespaces,\n methods: claims.methods,\n });\n}\n\nfunction normalizeNamespaceList(values: string[]): string[] {\n const unique = new Set();\n for (const raw of values) {\n const normalized = raw.trim().toLowerCase();\n if (normalized) {\n unique.add(normalized);\n }\n }\n return Array.from(unique);\n}\n\nfunction validateNamespaceList(\n namespaces: string[],\n mode: 'github' | 'domain' | 'generic',\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n if (namespaces.length === 0) {\n throw new ProblemError(\n createProblem(400, 'Invalid request', 'At least one namespace must be provided.', c),\n );\n }\n\n const invalid: string[] = [];\n for (const ns of namespaces) {\n if (!isNamespaceFormatValid(ns) || !namespaceModeMatches(ns, mode)) {\n invalid.push(ns);\n }\n }\n\n if (invalid.length > 0) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid namespaces',\n `The following namespaces are invalid for ${mode} auth: ${invalid.join(', ')}`,\n c,\n ),\n );\n }\n}\n\nfunction isNamespaceFormatValid(ns: string): boolean {\n if (!ns) return false;\n const segments = ns.split('.');\n if (segments.length === 0) return false;\n return segments.every((segment) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(segment));\n}\n\nfunction namespaceModeMatches(ns: string, mode: 'github' | 'domain' | 'generic'): boolean {\n if (mode === 'github') {\n return ns.startsWith('io.github.') && ns.split('.').length >= 3;\n }\n if (mode === 'domain') {\n const segments = ns.split('.');\n return segments.length >= 2 && segments.every(Boolean);\n }\n return true;\n}\n\nfunction namespaceIsAllowed(allowed: string, actual: string): boolean {\n if (actual === allowed) return true;\n return actual.startsWith(`${allowed}.`);\n}\n\nfunction extractNamespacePrefix(serverName: string): string {\n const trimmed = serverName.trim().toLowerCase();\n if (!trimmed) return '';\n const slashIndex = trimmed.indexOf('/');\n return slashIndex === -1 ? trimmed : trimmed.slice(0, slashIndex);\n}\n\nfunction assertNamespaceAuthorized(\n claims: RegistryTokenClaims,\n serverName: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const namespace = extractNamespacePrefix(serverName);\n if (!namespace) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid server name',\n 'Server name must include a namespace prefix (e.g., io.github.user/server).',\n c,\n ),\n );\n }\n\n const authorized = claims.namespaces.some((allowed) => namespaceIsAllowed(allowed, namespace));\n if (!authorized) {\n throw new ProblemError(\n createProblem(\n 403,\n 'Forbidden',\n `Token is not authorized for namespace ${namespace}.`,\n c,\n ),\n );\n }\n}\n\nasync function issueRegistryToken(params: IssueTokenParams): Promise<{\n token: string;\n claims: RegistryTokenClaims;\n}> {\n const { namespaces, method, secret, expiresInSeconds, context } = params;\n if (!secret) {\n throw new ProblemError(\n createProblem(\n 500,\n 'Server configuration error',\n 'REGISTRY_AUTH_SECRET is not configured for this subregistry.',\n context,\n ),\n );\n }\n\n const uniqueNamespaces = Array.from(new Set(namespaces)).sort();\n const issuedAt = Math.floor(Date.now() / 1000);\n const ttl = expiresInSeconds != null && Number.isFinite(expiresInSeconds)\n ? Math.min(Math.max(Math.floor(expiresInSeconds), 60), 86_400)\n : 3_600;\n const claims: RegistryTokenClaims = {\n version: 1,\n namespaces: uniqueNamespaces,\n methods: [method],\n iat: issuedAt,\n exp: issuedAt + ttl,\n };\n\n const token = await signRegistryToken(claims, secret);\n return { token, claims };\n}\n\nasync function signRegistryToken(claims: RegistryTokenClaims, secret: string): Promise {\n const header = { alg: 'HS256', typ: 'JWT' };\n const headerSegment = base64UrlEncodeString(JSON.stringify(header));\n const payloadSegment = base64UrlEncodeString(JSON.stringify(claims));\n const data = `${headerSegment}.${payloadSegment}`;\n const key = await getHmacKey(secret);\n const signatureBuffer = await crypto.subtle.sign('HMAC', key, TEXT_ENCODER.encode(data));\n const signatureSegment = base64UrlEncode(new Uint8Array(signatureBuffer));\n return `${data}.${signatureSegment}`;\n}\n\nasync function verifyRegistryToken(\n token: string,\n secret: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): Promise {\n const parts = token.split('.');\n if (parts.length !== 3) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Invalid registry token format.', c),\n );\n }\n\n const [headerSegment, payloadSegment, signatureSegment] = parts;\n const data = `${headerSegment}.${payloadSegment}`;\n const key = await getHmacKey(secret);\n const signatureBytes = base64UrlDecode(signatureSegment);\n const signatureCopy = new Uint8Array(signatureBytes);\n const verified = await crypto.subtle.verify(\n 'HMAC',\n key,\n signatureCopy,\n TEXT_ENCODER.encode(data),\n );\n if (!verified) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token signature is invalid.', c),\n );\n }\n\n try {\n const claimsJson = base64UrlDecodeToString(payloadSegment);\n return normalizeClaims(JSON.parse(claimsJson), c);\n } catch {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token payload could not be parsed.', c),\n );\n }\n}\n\nfunction normalizeClaims(\n raw: unknown,\n c: Context<{ Bindings: RegistryBindings }>,\n): RegistryTokenClaims {\n if (!raw || typeof raw !== 'object') {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token payload is malformed.', c),\n );\n }\n\n const obj = raw as Record;\n if (obj['version'] !== 1) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token version is unsupported.', c),\n );\n }\n\n const namespacesRaw = obj['namespaces'];\n if (!Array.isArray(namespacesRaw) || namespacesRaw.length === 0) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token namespaces are missing.', c),\n );\n }\n const namespaceStrings: string[] = [];\n for (const ns of namespacesRaw) {\n if (typeof ns !== 'string') {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token namespaces are invalid.', c),\n );\n }\n namespaceStrings.push(ns);\n }\n const namespaces = normalizeNamespaceList(namespaceStrings);\n validateNamespaceList(namespaces, 'generic', c);\n\n const methodsRaw = Array.isArray(obj['methods']) ? obj['methods'] : [];\n const methods: string[] = [];\n for (const method of methodsRaw) {\n if (typeof method === 'string' && method.trim()) {\n methods.push(method.trim());\n }\n }\n if (methods.length === 0) {\n methods.push('unknown');\n }\n\n const iat = Number(obj['iat']);\n const exp = Number(obj['exp']);\n if (!Number.isFinite(iat) || !Number.isFinite(exp) || exp <= iat) {\n throw new ProblemError(\n createProblem(401, 'Unauthorized', 'Registry token timestamps are invalid.', c),\n );\n }\n\n return {\n version: 1,\n namespaces,\n methods,\n iat: Math.floor(iat),\n exp: Math.floor(exp),\n };\n}\n\nfunction base64UrlEncode(data: Uint8Array): string {\n let binary = '';\n for (const byte of data) {\n binary += String.fromCharCode(byte);\n }\n return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/g, '');\n}\n\nfunction base64UrlEncodeString(value: string): string {\n return base64UrlEncode(TEXT_ENCODER.encode(value));\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n const padLength = (4 - (value.length % 4)) % 4;\n const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(padLength);\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\nfunction base64UrlDecodeToString(value: string): string {\n return TEXT_DECODER.decode(base64UrlDecode(value));\n}\n\nasync function getHmacKey(secret: string): Promise {\n let cached = HMAC_KEY_CACHE.get(secret);\n if (!cached) {\n cached = crypto.subtle.importKey(\n 'raw',\n TEXT_ENCODER.encode(secret),\n { name: 'HMAC', hash: 'SHA-256' },\n false,\n ['sign', 'verify'],\n );\n HMAC_KEY_CACHE.set(secret, cached);\n }\n return cached;\n}\n\nfunction validateOfficialPolicies(\n payload: ServerJSON,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const namespace = extractNamespacePrefix(payload.name ?? '');\n if (!namespace) {\n throw new ProblemError(\n createProblem(\n 400,\n 'Invalid server name',\n 'Server name must include a namespace prefix before the first slash.',\n c,\n ),\n );\n }\n\n validateMetaNamespace(payload as Record, c);\n validatePackagesNamespace(payload as Record, namespace, c);\n validateRemoteNamespace(payload as Record, namespace, c);\n}\n\nfunction validateMetaNamespace(\n payload: Record,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const meta = payload._meta;\n if (meta == null) return;\n if (typeof meta !== 'object' || Array.isArray(meta)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n '_meta must be an object containing only the `publisher` key.',\n c,\n ),\n );\n }\n\n const metaRecord = meta as Record;\n const invalidKeys = Object.keys(metaRecord).filter((key) => key !== 'publisher');\n if (invalidKeys.length > 0) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n `_meta may only contain the \\`publisher\\` key when publishing to the official registry.`,\n c,\n invalidKeys.map((key) => ({\n location: `_meta.${key}`,\n message: 'Unexpected key present in `_meta`.',\n })),\n ),\n );\n }\n\n try {\n const serialized = JSON.stringify(metaRecord);\n if (serialized.length > 4096) {\n throw new ProblemError(\n createProblem(\n 413,\n '_meta too large',\n '_meta.publisher must be at most 4KB when serialized.',\n c,\n ),\n );\n }\n } catch {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid `_meta` field',\n 'Failed to serialize `_meta.publisher` while checking size limits.',\n c,\n ),\n );\n }\n}\n\nconst PACKAGE_REGISTRY_BASE_URLS: Record = {\n npm: 'https://registry.npmjs.org',\n pypi: 'https://pypi.org',\n nuget: 'https://api.nuget.org',\n oci: 'https://docker.io',\n mcpb: null,\n};\n\nfunction validatePackagesNamespace(\n payload: Record,\n namespace: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const packages = Array.isArray(payload.packages) ? payload.packages : [];\n for (const [index, pkg] of packages.entries()) {\n if (!pkg || typeof pkg !== 'object') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid package entry',\n `packages[${index}] must be an object describing a package option.`,\n c,\n ),\n );\n }\n const pkgRecord = pkg as Record;\n const registryType = (pkgRecord.registryType ??\n pkgRecord.registry_type) as string | undefined;\n if (!registryType || !(registryType in PACKAGE_REGISTRY_BASE_URLS)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported package registry',\n `packages[${index}].registryType must be one of npm, pypi, nuget, oci, or mcpb.`,\n c,\n ),\n );\n }\n\n const identifier = (pkgRecord.identifier ?? pkgRecord.name) as string | undefined;\n if (!identifier || typeof identifier !== 'string') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Missing package identifier',\n `packages[${index}] must include an identifier string.`,\n c,\n ),\n );\n }\n\n const baseUrl = (pkgRecord.registryBaseUrl ??\n pkgRecord.registry_base_url) as string | undefined;\n const allowedBase = PACKAGE_REGISTRY_BASE_URLS[registryType];\n if (allowedBase) {\n if (!baseUrl || baseUrl !== allowedBase) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Disallowed registry base URL',\n `packages[${index}] must use registry_base_url \"${allowedBase}\".`,\n c,\n ),\n );\n }\n }\n\n if (registryType === 'mcpb') {\n const identifierHasMcp = identifier.toLowerCase().includes('mcp');\n if (!identifierHasMcp) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid MCPB identifier',\n `packages[${index}].identifier must contain \"mcp\" when publishing MCPB bundles.`,\n c,\n ),\n );\n }\n\n const sha =\n (pkgRecord.fileSha256 as string | undefined) ??\n (pkgRecord.file_sha256 as string | undefined);\n if (!sha || !/^[a-f0-9]{64}$/i.test(sha)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Missing MCPB SHA-256',\n `packages[${index}] must include file_sha256 with a 64-character hex digest.`,\n c,\n ),\n );\n }\n\n if (!identifier.startsWith('https://github.com/') && !identifier.startsWith('https://gitlab.com/')) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported MCPB host',\n `packages[${index}].identifier must point to a GitHub or GitLab release asset.`,\n c,\n ),\n );\n }\n }\n }\n}\n\nfunction validateRemoteNamespace(\n payload: Record,\n namespace: string,\n c: Context<{ Bindings: RegistryBindings }>,\n): void {\n const remotes = Array.isArray(payload.remotes) ? payload.remotes : [];\n if (remotes.length === 0) return;\n\n const domain = namespaceToDomain(namespace);\n for (const [index, remote] of remotes.entries()) {\n if (!remote || typeof remote !== 'object') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid remote entry',\n `remotes[${index}] must be an object describing a remote transport.`,\n c,\n ),\n );\n }\n const remoteRecord = remote as Record;\n const urlRaw = remoteRecord.url as string | undefined;\n if (!urlRaw) {\n throw new ProblemError(\n createProblem(422, 'Missing remote URL', `remotes[${index}] is missing a url.`, c),\n );\n }\n\n let parsed: URL;\n try {\n parsed = new URL(urlRaw);\n } catch {\n throw new ProblemError(\n createProblem(\n 422,\n 'Invalid remote URL',\n `remotes[${index}].url must be a valid absolute URL.`,\n c,\n ),\n );\n }\n\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n throw new ProblemError(\n createProblem(\n 422,\n 'Unsupported remote protocol',\n `remotes[${index}].url must use http or https.`,\n c,\n ),\n );\n }\n\n if (domain) {\n const host = parsed.hostname.toLowerCase();\n if (host !== domain && !host.endsWith(`.${domain}`)) {\n throw new ProblemError(\n createProblem(\n 422,\n 'Remote URL mismatch',\n `remotes[${index}].url must be hosted on ${domain} or its subdomains for namespace ${namespace}.`,\n c,\n ),\n );\n }\n }\n }\n}\n\nfunction namespaceToDomain(namespace: string): string | null {\n const lower = namespace.toLowerCase();\n if (lower.startsWith('io.github.')) {\n return null;\n }\n const segments = lower.split('.');\n if (segments.length < 2) {\n return null;\n }\n const reversed = [...segments].reverse();\n return reversed.join('.');\n}\n\nfunction decodePathParam(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\nfunction createProblem(\n status: number,\n title: string,\n detail: string,\n c: Context<{ Bindings: RegistryBindings }>,\n errors?: ErrorModel['errors'],\n): ErrorModel {\n return {\n type: 'about:blank',\n title,\n status,\n detail,\n instance: c.req.path,\n errors: errors?.length ? errors : undefined,\n };\n}\n\nfunction createValidationProblem(\n status: number,\n title: string,\n detail: string,\n c: Context<{ Bindings: RegistryBindings }>,\n issues: NormalizedIssue[],\n): ErrorModel {\n const errors = issues.map((issue) => ({\n location: issue.path.length ? issue.path.join('.') : 'body',\n message: issue.message,\n value: issue.received,\n }));\n return createProblem(status, title, detail, c, errors);\n}\n\nfunction problemResponse(\n c: Context<{ Bindings: RegistryBindings }>,\n problem: ErrorModel,\n): Response {\n const status = problem.status ?? 500;\n return new Response(JSON.stringify(problem), {\n status,\n headers: {\n 'content-type': 'application/problem+json',\n },\n });\n}\n\nfunction toValidationIssues(\n issues: ReadonlyArray<{ path: (string | number)[]; message: string }>,\n): NormalizedIssue[] {\n return issues.map((issue) => ({\n path: Array.isArray(issue.path) ? issue.path : [],\n message: issue.message ?? 'Invalid value',\n received: (issue as Record).received,\n }));\n}\n\nfunction recordAuthExchange(method: string): void {\n const current = metricsState.authExchanges.get(method) ?? 0;\n metricsState.authExchanges.set(method, current + 1);\n}\n",[145],"8db9eb8c-a0da-11f0-b260-0224a6c84d84","deno.json","f0a97e2a-a098-11f0-a6a0-0224a6c84d84",16,true,["D",1759552098946],2,"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"indentWidth\": 2,\n \"include\": [\n \"deno:/https/esm.town/**/*\"\n ]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\",\n \"no-import-prefix\",\n \"no-unused-vars\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[154],"8dcef2de-a0da-11f0-82df-0224a6c84d84",["D",1759552099051],[28],"f0b76116-a098-11f0-a51e-0224a6c84d84","AGENTS.md","f0b761a2-a098-11f0-a51e-0224a6c84d84",["D",1759523918233],0,"You are an advanced assistant specialized in generating Val Town code.\n\n## Core Guidelines\n\n- Ask clarifying questions when requirements are ambiguous\n- Provide complete, functional solutions rather than skeleton implementations\n- Test your logic against edge cases before presenting the final solution\n- Ensure all code follows Val Town's specific platform requirements\n- If a section of code that you're working on is getting too complex, consider refactoring it into subcomponents\n\n## Code Standards\n\n- Generate code in TypeScript or TSX\n- Add appropriate TypeScript types and interfaces for all data structures\n- Prefer official SDKs or libraries than writing API calls directly\n- Ask the user to supply API or library documentation if you are at all unsure about it\n- **Never bake in secrets into the code** - always use environment variables\n- Include comments explaining complex logic (avoid commenting obvious operations)\n- Follow modern ES6+ conventions and functional programming practices if possible\n\n## Types of triggers\n\n### 1. HTTP Trigger\n\n- Create web APIs and endpoints\n- Handle HTTP requests and responses\n- Example structure:\n\n```ts\nexport default async function (req: Request) {\n return new Response(\"Hello World\");\n}\n```\n\nFiles that are HTTP triggers have http in their name like `foobar.http.tsx`\n\n### 2. Cron Triggers\n\n- Run on a schedule\n- Use cron expressions for timing\n- Example structure:\n\n```ts\nexport default async function () {\n // Scheduled task code\n}\n```\n\nFiles that are Cron triggers have cron in their name like `foobar.cron.tsx`\n\n### 3. Email Triggers\n\n- Process incoming emails\n- Handle email-based workflows\n- Example structure:\n\n```ts\nexport default async function (email: Email) {\n // Process email\n}\n```\n\nFiles that are Email triggers have email in their name like `foobar.email.tsx`\n\n\n## Val Town Standard Libraries\n\nVal Town provides several hosted services and utility functions.\n\n### Blob Storage\n\n```ts\nimport { blob } from \"https://esm.town/v/std/blob\";\nawait blob.setJSON(\"myKey\", { hello: \"world\" });\nlet blobDemo = await blob.getJSON(\"myKey\");\nlet appKeys = await blob.list(\"app_\");\nawait blob.delete(\"myKey\");\n```\n\n### SQLite\n\n```ts\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nconst TABLE_NAME = 'todo_app_users_2';\n// Create table - do this before usage and change table name when modifying schema\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL\n)`);\n// Query data\nconst result = await sqlite.execute(`SELECT * FROM ${TABLE_NAME} WHERE id = ?`, [1]);\n```\n\nNote: When changing a SQLite table's schema, change the table's name (e.g., add _2 or _3) to create a fresh table.\n\n### OpenAI\n\n```ts\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\nconst openai = new OpenAI();\nconst completion = await openai.chat.completions.create({\n messages: [\n { role: \"user\", content: \"Say hello in a creative way\" },\n ],\n model: \"gpt-4o-mini\",\n max_tokens: 30,\n});\n```\n\n### Email\n\n```ts\nimport { email } from \"https://esm.town/v/std/email\";\n// By default emails the owner of the val\nawait email({ \n subject: \"Hi\", \n text: \"Hi\", \n html: \"

Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n",[166],"f0c1e424-a098-11f0-935c-0224a6c84d84",".vtignore","f0c1e4ce-a098-11f0-935c-0224a6c84d84",6,["D",1759523918235],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[173],"8d8ba88a-a0da-11f0-bb5b-0224a6c84d84","backend","8d8ba95c-a0da-11f0-bb5b-0224a6c84d84",13,["D",1759552098645],"directory",[180],"pulls","branches","forks","envVars",{"_193":169,"_195":169},"connections",{"_193":169,"_194":169},"count","unfilledCount","emptyCount",{"_42":179,"_32":180,"_30":181,"_137":-5,"_40":41,"_39":182,"_139":157,"_37":257,"_13":169,"_33":184,"_34":-5,"_24":25,"_142":-5,"_208":258,"_27":259},{"_42":252,"_32":243,"_30":237,"_137":181,"_40":41,"_39":253,"_139":157,"_37":254,"_13":169,"_33":184,"_34":-5,"_24":25,"_142":-5,"_208":255,"_27":256},{"_42":244,"_32":245,"_30":246,"_137":237,"_40":41,"_39":247,"_139":157,"_37":248,"_13":169,"_33":150,"_34":249,"_24":25,"_142":-5,"_208":250,"_27":251},{"_42":234,"_32":235,"_30":236,"_137":237,"_40":41,"_39":238,"_139":25,"_37":239,"_13":169,"_33":150,"_34":240,"_24":25,"_142":-5,"_208":241,"_27":242},{"_42":226,"_32":227,"_30":228,"_137":181,"_40":41,"_39":229,"_139":157,"_37":230,"_13":169,"_33":150,"_34":231,"_24":25,"_142":-5,"_208":232,"_27":233},{"_42":172,"_32":173,"_30":174,"_137":-5,"_40":41,"_39":175,"_139":157,"_37":223,"_13":169,"_33":20,"_34":177,"_24":25,"_142":-5,"_208":224,"_27":225},{"_42":165,"_32":166,"_30":167,"_137":-5,"_40":41,"_39":68,"_139":157,"_37":220,"_13":169,"_33":20,"_34":170,"_24":25,"_142":-5,"_208":221,"_27":222},{"_42":162,"_32":28,"_30":31,"_137":-5,"_40":41,"_39":14,"_139":157,"_37":217,"_13":149,"_33":20,"_34":36,"_24":25,"_142":-5,"_208":218,"_27":219},{"_42":153,"_32":154,"_30":155,"_137":-5,"_40":41,"_39":156,"_139":157,"_37":214,"_13":159,"_33":20,"_34":160,"_24":25,"_142":-5,"_208":215,"_27":216},{"_42":144,"_32":145,"_30":146,"_137":-5,"_40":41,"_39":147,"_139":25,"_37":211,"_13":149,"_33":150,"_34":151,"_24":25,"_142":-5,"_208":212,"_27":213},{"_42":134,"_32":135,"_30":136,"_137":-5,"_40":41,"_39":138,"_139":25,"_37":207,"_13":61,"_33":20,"_34":141,"_24":25,"_142":-5,"_208":209,"_27":210},["D",1759525304893],"children",[],[135],["D",1759552099020],[],[145],["D",1759552098946],[],[154],["D",1759552099051],[],[28],["D",1759523918233],[],[166],["D",1759523918235],[],[173],"8db2cf28-a0da-11f0-8fb0-0224a6c84d84","blob.ts","8db2cfdc-a0da-11f0-8fb0-0224a6c84d84",15,["D",1759552098901],"import { blob } from \"https://esm.town/v/std/blob\";\n\n// POC limits and policies (aligns with DESIGN_DECISIONS.md)\nconst MAX_ICON_BYTES = 150 * 1024; // 150 KiB\nconst ALLOWED_MIME = new Set([\"image/png\", \"image/jpeg\", \"image/webp\", \"image/svg+xml\"]);\n\n/**\n * Ingest a marketplace icon into Val Town Blobs.\n * - Accepts http/https URL or data URL (data:mime;base64,...)\n * - Enforces size and mime restrictions\n * - Stores JSON payload: { mime, dataBase64, srcUrl?, ingestedAt }\n * - Returns { blobKey, mime }\n *\n * serverName and version should be canonicalized (e.g., lowercased serverName) before calling.\n */\nexport async function ingestMarketplaceIcon(params: {\n serverName: string;\n version: string;\n source: string; // http(s) URL or data URL\n}): Promise<{ blobKey: string; mime: string }> {\n const { serverName, version, source } = params;\n\n const safeServer = encodeURIComponent(serverName);\n const safeVersion = encodeURIComponent(version);\n const key = `icons/${safeServer}/${safeVersion}.json`;\n\n // Resolve content bytes + mime\n let mime: string;\n let dataBase64: string;\n let srcUrl: string | undefined;\n\n if (isDataUrl(source)) {\n const parsed = parseDataUrl(source);\n mime = parsed.mime;\n dataBase64 = parsed.base64;\n enforceMime(mime);\n enforceSize(base64LengthBytes(dataBase64));\n } else {\n const fetched = await fetchRemote(source);\n mime = fetched.mime;\n dataBase64 = fetched.base64;\n srcUrl = source;\n enforceMime(mime);\n enforceSize(base64LengthBytes(dataBase64));\n }\n\n const payload = {\n mime,\n dataBase64,\n ...(srcUrl ? { srcUrl } : {}),\n ingestedAt: new Date().toISOString(),\n };\n\n await blob.setJSON(key, payload);\n return { blobKey: key, mime };\n}\n\nexport async function deleteMarketplaceIconBlob(key: string | null | undefined): Promise {\n if (!key) return;\n try {\n await blob.delete(key);\n } catch (err) {\n const error = err as Error;\n if (error?.name === \"ValTownBlobNotFoundError\") {\n return;\n }\n throw err;\n }\n}\n\n/**\n * Detect if a string is a data URL\n */\nfunction isDataUrl(s: string): boolean {\n return /^data:[^;]+;base64,/.test(s);\n}\n\n/**\n * Parse a data URL \"data:;base64,\"\n */\nfunction parseDataUrl(s: string): { mime: string; base64: string } {\n const match = /^data:([^;]+);base64,(.*)$/s.exec(s);\n if (!match) {\n throw problem(\"InvalidDataURL\", \"Invalid data URL format for marketplaceIcon.\");\n }\n const mime = match[1].trim();\n const base64 = match[2].trim();\n return { mime, base64 };\n}\n\n/**\n * Fetch a remote URL and return mime + base64 content\n */\nasync function fetchRemote(url: string): Promise<{ mime: string; base64: string }> {\n const res = await fetch(url, { redirect: \"follow\" });\n if (!res.ok) {\n throw problem(\"IconFetchFailed\", `Failed to fetch icon: HTTP ${res.status}`);\n }\n\n const ctype = res.headers.get(\"content-type\") || \"application/octet-stream\";\n const mime = ctype.split(\";\")[0].trim().toLowerCase();\n\n // Optional preliminary size check via content-length\n const clen = res.headers.get(\"content-length\");\n if (clen) {\n const n = Number(clen);\n if (!Number.isNaN(n) && n > MAX_ICON_BYTES) {\n throw problem(\"IconTooLarge\", `Icon too large (content-length=${n} bytes), max ${MAX_ICON_BYTES} bytes`);\n }\n }\n\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.byteLength > MAX_ICON_BYTES) {\n throw problem(\"IconTooLarge\", `Icon too large (${buf.byteLength} bytes), max ${MAX_ICON_BYTES} bytes`);\n }\n\n const base64 = bytesToBase64(buf);\n return { mime, base64 };\n}\n\n/**\n * Validate allowed mime\n */\nfunction enforceMime(mime: string): void {\n const m = mime.toLowerCase();\n if (!ALLOWED_MIME.has(m)) {\n throw problem(\"IconMimeNotAllowed\", `Icon mime not allowed: ${mime}`);\n }\n}\n\n/**\n * Validate max size in bytes\n */\nfunction enforceSize(n: number): void {\n if (n > MAX_ICON_BYTES) {\n throw problem(\"IconTooLarge\", `Icon too large (${n} bytes), max ${MAX_ICON_BYTES} bytes`);\n }\n}\n\n/**\n * Base64 length to bytes approximation (each 4 chars ~ 3 bytes)\n */\nfunction base64LengthBytes(b64: string): number {\n // Remove padding for calculation\n const clean = b64.replace(/=+$/g, \"\");\n return Math.floor((clean.length * 3) / 4);\n}\n\n/**\n * Convert bytes to base64 safely\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n // Small utility safe for <= 150KiB\n let binary = \"\";\n const chunkSize = 0x8000;\n for (let i = 0; i < bytes.length; i += chunkSize) {\n const chunk = bytes.subarray(i, i + chunkSize);\n binary += String.fromCharCode.apply(null, Array.from(chunk));\n }\n // btoa expects binary string\n // deno-lint-ignore no-deprecated-deno-api\n return btoa(binary);\n}\n\n/**\n * Create a ProblemDetail-like error for consistency\n */\nfunction problem(code: string, message: string): Error {\n const err = new Error(message);\n (err as any).problem = { code, detail: message };\n return err;\n}",[],[180,227],"8dc0dd8e-a0da-11f0-a25f-0224a6c84d84","queries.ts","8dc0de38-a0da-11f0-a25f-0224a6c84d84","8d9dcfc4-a0da-11f0-bb5b-0224a6c84d84",17,["D",1759552098984],"import { eq, and, sql, desc, asc } from \"https://esm.sh/drizzle-orm@0.44.6?target=deno&dts\";\nimport type {\n ServerJSON,\n ServerResponse,\n ServerListResponse,\n} from \"npm:mcp-registry-spec-sdk@0.1.2\";\nimport {\n ServerJSONSchema,\n ServerResponseSchema,\n ServerListResponseSchema,\n} from \"npm:mcp-registry-spec-sdk@0.1.2\";\nimport { runMigrations, TABLE_NAME, getDb, serverVersions } from \"./migrations.ts\";\nimport { ingestMarketplaceIcon, deleteMarketplaceIconBlob } from \"../blob.ts\";\n\n// Query layer for MCP Subregistry POC v2\n// - Uses Val Town SQLite\n// - Works with server_versions_poc_v2 created in migrations.ts\n// - Keeps OpenAPI surface unchanged; this only backs the contract\n//\n// Notes:\n// - JSON fields are stored as TEXT (stringified).\n// - Cursor is base64url(JSON {u: updatedAt, s: server_name_lower, v: version}).\n// - Search is simple LIKE against a precomputed lowercased search_text.\n// - MCP capability flags can be provided via publisher meta or derived heuristically.\n\n// ------------- Cursor helpers -------------\ntype CursorObj = { u: string; s: string; v: string };\n\nfunction base64urlEncode(input: string): string {\n return btoa(input).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n\nfunction base64urlDecode(input: string): string {\n const pad = input.length % 4 === 2 ? \"==\" : input.length % 4 === 3 ? \"=\" : \"\";\n const b64 = input.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n return atob(b64);\n}\n\nexport function encodeCursor(c: CursorObj): string {\n return base64urlEncode(JSON.stringify(c));\n}\n\nexport function decodeCursor(cursor: string): CursorObj | null {\n try {\n return JSON.parse(base64urlDecode(cursor));\n } catch {\n return null;\n }\n}\n\n// ------------- MCP flag derivation -------------\n\ntype MCPFlags = {\n protocol_version?: string | null;\n has_tools?: boolean | null;\n has_resources?: boolean | null;\n has_prompts?: boolean | null;\n has_roots?: boolean | null;\n has_completions?: boolean | null;\n has_sampling?: boolean | null;\n transports?: unknown | null; // JSON (array or object)\n discovery_links?: unknown | null; // JSON\n client_snippets?: unknown | null; // JSON\n auth_methods?: unknown | null; // JSON (array)\n};\n\nfunction coerceBool(v: unknown): boolean | null {\n if (typeof v === \"boolean\") return v;\n return null;\n}\n\nfunction deriveFromPublisherMeta(payload: ServerJSON): MCPFlags {\n const meta = (payload as any)?._meta?.[\"io.modelcontextprotocol.registry/publisher-provided\"];\n const mcp = meta?.mcp ?? {};\n const caps = mcp?.capabilities; // could be array of strings OR object of booleans\n\n const flags: MCPFlags = {\n protocol_version: mcp?.protocolVersion ?? null,\n has_tools: null,\n has_resources: null,\n has_prompts: null,\n has_roots: null,\n has_completions: null,\n has_sampling: null,\n transports: mcp?.transports ?? null,\n discovery_links: mcp?.discoveryLinks ?? null,\n client_snippets: mcp?.clientSnippets ?? null,\n auth_methods: mcp?.authMethods ?? null,\n };\n\n if (Array.isArray(caps)) {\n const set = new Set(caps.map(String));\n flags.has_tools = set.has(\"tools\") ? true : null;\n flags.has_resources = set.has(\"resources\") ? true : null;\n flags.has_prompts = set.has(\"prompts\") ? true : null;\n flags.has_roots = set.has(\"roots\") ? true : null;\n flags.has_completions = set.has(\"completions\") ? true : null;\n flags.has_sampling = set.has(\"sampling\") ? true : null;\n } else if (caps && typeof caps === \"object\") {\n flags.has_tools = coerceBool(caps.tools);\n flags.has_resources = coerceBool(caps.resources);\n flags.has_prompts = coerceBool(caps.prompts);\n flags.has_roots = coerceBool(caps.roots);\n flags.has_completions = coerceBool(caps.completions);\n flags.has_sampling = coerceBool(caps.sampling);\n }\n\n return flags;\n}\n\nfunction applyHeuristics(flags: MCPFlags, payload: ServerJSON): MCPFlags {\n const out = { ...flags };\n // If missing, infer a tiny bit from structural hints\n const hasRemotes = Array.isArray((payload as any).remotes) && ((payload as any).remotes?.length ?? 0) > 0;\n const hasPackages = Array.isArray((payload as any).packages) && ((payload as any).packages?.length ?? 0) > 0;\n\n if (out.has_tools == null) out.has_tools = hasPackages || hasRemotes ? true : null;\n if (out.has_resources == null) out.has_resources = hasRemotes ? true : null;\n // leave prompts/roots/completions/sampling as null unless explicitly provided\n if (out.transports == null && hasRemotes) {\n try {\n // pull transportType(s) from remotes if present\n const transports = (payload as any).remotes\n ?.map((r: any) => r?.transportType)\n ?.filter((t: any) => typeof t === \"string\");\n out.transports = transports?.length ? transports : null;\n } catch {\n // ignore\n }\n }\n return out;\n}\n\n// ------------- Search text -------------\n\nfunction stringifySafe(v: unknown): string {\n try {\n if (v == null) return \"\";\n if (typeof v === \"string\") return v;\n return JSON.stringify(v);\n } catch {\n return \"\";\n }\n}\n\nfunction computeSearchText(payload: ServerJSON, flags: MCPFlags): string {\n const parts: string[] = [];\n parts.push(payload.name ?? \"\");\n parts.push(payload.description ?? \"\");\n if ((payload as any).websiteUrl) parts.push((payload as any).websiteUrl);\n const repo = (payload as any).repository;\n if (repo?.url) parts.push(repo.url);\n if (Array.isArray((payload as any).packages)) {\n for (const p of (payload as any).packages) {\n if (p?.name) parts.push(p.name);\n if (p?.identifier) parts.push(p.identifier);\n if (p?.registryType) parts.push(p.registryType);\n if (p?.version) parts.push(p.version);\n }\n }\n if (Array.isArray((payload as any).remotes)) {\n for (const r of (payload as any).remotes) {\n if (r?.url) parts.push(r.url);\n if (r?.transportType) parts.push(r.transportType);\n }\n }\n\n // Publisher-provided meta content\n const publisherMeta = (payload as any)?._meta?.[\"io.modelcontextprotocol.registry/publisher-provided\"];\n parts.push(stringifySafe(publisherMeta));\n\n // MCP flags for discovery via search\n parts.push(\n stringifySafe({\n protocol: flags.protocol_version,\n has_tools: flags.has_tools,\n has_resources: flags.has_resources,\n has_prompts: flags.has_prompts,\n has_roots: flags.has_roots,\n has_completions: flags.has_completions,\n has_sampling: flags.has_sampling,\n transports: flags.transports,\n auth_methods: flags.auth_methods,\n })\n );\n\n return parts.join(\" | \").toLowerCase();\n}\n\n// looks for redeemable marketplace icon in the publisher record\ntype MarketplaceIconDescriptor = { present: boolean; source: string | null };\n\nfunction getMarketplaceIconDescriptor(payload: ServerJSON): MarketplaceIconDescriptor {\n const meta = (payload as any)?._meta;\n if (!meta || typeof meta !== \"object\" || Array.isArray(meta)) {\n return { present: false, source: null };\n }\n const publisher = (meta as any)?.publisher;\n if (!publisher || typeof publisher !== \"object\") {\n return { present: false, source: null };\n }\n if (!Object.prototype.hasOwnProperty.call(publisher, \"marketplaceIcon\")) {\n return { present: false, source: null };\n }\n const raw = (publisher as any).marketplaceIcon;\n if (typeof raw === \"string\") {\n const trimmed = raw.trim();\n return { present: true, source: trimmed.length ? trimmed : null };\n }\n if (raw && typeof raw === \"object\") {\n const record = raw as Record;\n const candidate =\n typeof record.source === \"string\"\n ? record.source\n : typeof record.url === \"string\"\n ? record.url\n : typeof record.dataUrl === \"string\"\n ? record.dataUrl\n : typeof record.data_url === \"string\"\n ? record.data_url\n : undefined;\n if (typeof candidate === \"string\") {\n const trimmed = candidate.trim();\n return { present: true, source: trimmed.length ? trimmed : null };\n }\n }\n return { present: true, source: null };\n}\n\nasync function ingestMarketplaceIconOrThrow(\n serverName: string,\n version: string,\n source: string,\n): Promise<{ blobKey: string; mime: string }> {\n try {\n return await ingestMarketplaceIcon({ serverName, version, source });\n } catch (err) {\n const detail =\n (err as any)?.problem?.detail ?? (err as Error)?.message ?? \"Failed to ingest marketplaceIcon.\";\n const problem = {\n type: \"about:blank\",\n title: \"Invalid marketplaceIcon\",\n status: 422,\n detail,\n errors: [\n {\n location: \"_meta.publisher.marketplaceIcon\",\n message: detail,\n },\n ],\n };\n const wrapped = new Error(detail);\n (wrapped as any).problem = problem;\n throw wrapped;\n }\n}\n\n// ------------- Response mapping -------------\n\nfunction toServerResponse(row: any): ServerResponse {\n // Support both raw SQL column names and Drizzle schema property names\n const payloadStr = row.payload_json ?? row.payloadJson;\n const p: any = JSON.parse(payloadStr);\n const serverNameLower = row.server_name_lower ?? row.serverNameLower;\n const publishedAt = row.published_at ?? row.publishedAt;\n const updatedAt = row.updated_at ?? row.updatedAt;\n const isLatest = (row.is_latest ?? row.isLatest) as boolean | number;\n const status = row.status;\n const official: Record = {\n serverId: String(serverNameLower),\n versionId: String(row.id),\n publishedAt: String(publishedAt),\n updatedAt: String(updatedAt),\n isLatest: !!isLatest,\n status: String(status),\n };\n const blobIconKey = row.blob_icon_key ?? row.blobIconKey ?? null;\n const blobIconMime = row.blob_icon_mime ?? row.blobIconMime ?? null;\n if (blobIconKey && blobIconMime) {\n official.marketplaceIcon = {\n blobKey: String(blobIconKey),\n mime: String(blobIconMime),\n };\n }\n const publisherProvided = p?._meta?.[\"io.modelcontextprotocol.registry/publisher-provided\"] ?? {};\n const resp: ServerResponse = {\n $schema: p.$schema,\n name: p.name,\n description: p.description,\n version: p.version,\n repository: p.repository,\n websiteUrl: p.websiteUrl,\n packages: p.packages,\n remotes: p.remotes,\n _meta: {\n \"io.modelcontextprotocol.registry/official\": official as any,\n \"io.modelcontextprotocol.registry/publisher-provided\": publisherProvided as any,\n },\n };\n return resp;\n}\n\n// ------------- Public API -------------\n\nexport type ListServersOptions = {\n cursor?: string | null;\n limit?: number | null;\n search?: string | null;\n};\n\nexport async function publishServerVersion(payload: ServerJSON): Promise {\n await runMigrations();\n\n // Strict input validation\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n throw new Error(\"Invalid server JSON\");\n }\n\n const now = new Date().toISOString();\n const serverName = payload.name;\n const serverNameLower = serverName.toLowerCase();\n const version = payload.version;\n\n let flags = deriveFromPublisherMeta(payload);\n flags = applyHeuristics(flags, payload);\n\n const searchText = computeSearchText(payload, flags);\n\n const iconDescriptor = getMarketplaceIconDescriptor(payload);\n let iconResult: { blobKey: string; mime: string } | null = null;\n if (iconDescriptor.present && iconDescriptor.source) {\n iconResult = await ingestMarketplaceIconOrThrow(serverName, version, iconDescriptor.source);\n }\n\n const db = getDb();\n // Insert\n await db.insert(serverVersions).values({\n serverName,\n serverNameLower,\n version,\n payloadJson: JSON.stringify(payload),\n publishedAt: now,\n updatedAt: now,\n isLatest: false,\n status: \"active\",\n searchText,\n blobIconKey: iconResult?.blobKey ?? null,\n blobIconMime: iconResult?.mime ?? null,\n protocolVersion: flags.protocol_version ?? null,\n hasTools: flags.has_tools ?? null,\n hasResources: flags.has_resources ?? null,\n hasPrompts: flags.has_prompts ?? null,\n hasRoots: flags.has_roots ?? null,\n hasCompletions: flags.has_completions ?? null,\n hasSampling: flags.has_sampling ?? null,\n transports: flags.transports ? JSON.stringify(flags.transports) : null,\n discoveryLinks: flags.discovery_links ? JSON.stringify(flags.discovery_links) : null,\n clientSnippets: flags.client_snippets ? JSON.stringify(flags.client_snippets) : null,\n authMethods: flags.auth_methods ? JSON.stringify(flags.auth_methods) : null,\n });\n\n // Recompute latest for this server:\n // 1) clear previous\n await db\n .update(serverVersions)\n .set({ isLatest: false })\n .where(eq(serverVersions.serverNameLower, serverNameLower));\n // 2) set the newest by (publishedAt desc, id desc)\n const newest = await db\n .select({ id: serverVersions.id })\n .from(serverVersions)\n .where(eq(serverVersions.serverNameLower, serverNameLower))\n .orderBy(desc(serverVersions.publishedAt), desc(serverVersions.id))\n .limit(1);\n if (newest[0]?.id != null) {\n await db\n .update(serverVersions)\n .set({ isLatest: true })\n .where(eq(serverVersions.id, newest[0].id));\n }\n\n // Return the just-published version\n const rows = await db\n .select()\n .from(serverVersions)\n .where(and(eq(serverVersions.serverNameLower, serverNameLower), eq(serverVersions.version, version)))\n .limit(1);\n const row = rows[0];\n if (!row) throw new Error(\"Failed to publish server version\");\n const out = toServerResponse(row);\n // Strict output validation\n await ServerResponseSchema.safeParse(out);\n\n return out;\n}\n\nexport async function updateServerVersion(\n serverName: string,\n version: string,\n payload: ServerJSON\n): Promise {\n await runMigrations();\n // Strict input validation\n const parsed = await ServerJSONSchema.safeParseAsync(payload);\n if (!parsed.success) {\n throw new Error(\"Invalid server JSON\");\n }\n const serverNameLower = serverName.toLowerCase();\n const now = new Date().toISOString();\n\n let flags = deriveFromPublisherMeta(payload);\n flags = applyHeuristics(flags, payload);\n const searchText = computeSearchText(payload, flags);\n\n const db = getDb();\n const existingRows = await db\n .select()\n .from(serverVersions)\n .where(and(eq(serverVersions.serverNameLower, serverNameLower), eq(serverVersions.version, version)))\n .limit(1);\n const existing = existingRows[0];\n if (!existing) {\n throw new Error(\"Server version not found\");\n }\n\n const rawExistingBlobKey =\n (existing as Record).blobIconKey ??\n (existing as Record).blob_icon_key ??\n null;\n let blobIconKey: string | null =\n typeof rawExistingBlobKey === \"string\" && rawExistingBlobKey.trim().length\n ? rawExistingBlobKey\n : null;\n\n const rawExistingBlobMime =\n (existing as Record).blobIconMime ??\n (existing as Record).blob_icon_mime ??\n null;\n let blobIconMime: string | null =\n typeof rawExistingBlobMime === \"string\" && rawExistingBlobMime.trim().length\n ? rawExistingBlobMime\n : null;\n\n const iconDescriptor = getMarketplaceIconDescriptor(payload);\n if (iconDescriptor.present) {\n if (iconDescriptor.source) {\n const result = await ingestMarketplaceIconOrThrow(serverName, version, iconDescriptor.source);\n blobIconKey = result.blobKey;\n blobIconMime = result.mime;\n } else {\n if (blobIconKey) {\n await deleteMarketplaceIconBlob(blobIconKey);\n }\n blobIconKey = null;\n blobIconMime = null;\n }\n }\n\n await db\n .update(serverVersions)\n .set({\n payloadJson: JSON.stringify(payload),\n updatedAt: now,\n searchText,\n blobIconKey,\n blobIconMime,\n protocolVersion: flags.protocol_version ?? null,\n hasTools: flags.has_tools ?? null,\n hasResources: flags.has_resources ?? null,\n hasPrompts: flags.has_prompts ?? null,\n hasRoots: flags.has_roots ?? null,\n hasCompletions: flags.has_completions ?? null,\n hasSampling: flags.has_sampling ?? null,\n transports: flags.transports ? JSON.stringify(flags.transports) : null,\n discoveryLinks: flags.discovery_links ? JSON.stringify(flags.discovery_links) : null,\n clientSnippets: flags.client_snippets ? JSON.stringify(flags.client_snippets) : null,\n authMethods: flags.auth_methods ? JSON.stringify(flags.auth_methods) : null,\n })\n .where(\n and(eq(serverVersions.serverNameLower, serverNameLower), eq(serverVersions.version, version))\n )\n .limit(1);\n\n // Return updated row\n const rows = await db\n .select()\n .from(serverVersions)\n .where(\n and(eq(serverVersions.serverNameLower, serverNameLower), eq(serverVersions.version, version))\n )\n .limit(1);\n const row = rows[0];\n if (!row) throw new Error(\"Server version not found after update\");\n const out = toServerResponse(row);\n // Strict output validation\n const { success } = await ServerResponseSchema.safeParseAsync(out);\n if (!success) {\n throw new Error(\"Invalid server response\");\n }\n return out;\n}\n\nexport async function getLatestServerByName(\n serverName: string\n): Promise {\n await runMigrations();\n const serverNameLower = serverName.toLowerCase();\n const db = getDb();\n const rows = await db\n .select()\n .from(serverVersions)\n .where(\n and(\n eq(serverVersions.serverNameLower, serverNameLower),\n eq(serverVersions.isLatest, true),\n eq(serverVersions.status, \"active\")\n )\n )\n .limit(1);\n const row = rows[0];\n if (!row) return null;\n const out = toServerResponse(row);\n const { success } = await ServerResponseSchema.safeParseAsync(out);\n if (!success) {\n throw new Error(\"Invalid server response\");\n }\n return out;\n}\n\nexport async function getServerByNameVersion(\n serverName: string,\n version: string\n): Promise {\n await runMigrations();\n const serverNameLower = serverName.toLowerCase();\n const db = getDb();\n const rows = await db\n .select()\n .from(serverVersions)\n .where(\n and(\n eq(serverVersions.serverNameLower, serverNameLower),\n eq(serverVersions.version, version),\n eq(serverVersions.status, \"active\")\n )\n )\n .limit(1);\n const row = rows[0];\n if (!row) return null;\n const out = toServerResponse(row);\n const { success } = await ServerResponseSchema.safeParseAsync(out);\n if (!success) {\n throw new Error(\"Invalid server response\");\n }\n return out;\n}\n\nexport async function listServerVersions(\n serverName: string\n): Promise {\n await runMigrations();\n const serverNameLower = serverName.toLowerCase();\n const db = getDb();\n const rows = await db\n .select()\n .from(serverVersions)\n .where(\n and(\n eq(serverVersions.serverNameLower, serverNameLower),\n eq(serverVersions.status, \"active\")\n )\n )\n .orderBy(desc(serverVersions.publishedAt), desc(serverVersions.id));\n const out: ServerResponse[] = rows.map(toServerResponse);\n // Validate each (can be disabled later for perf)\n for (const r of out) {\n const { success } = await ServerResponseSchema.safeParseAsync(r);\n if (!success) {\n throw new Error(\"Invalid server response\");\n }\n }\n return out;\n}\n\n// ------------- Listing with pagination -------------\n\nfunction tokenizeSearch(q?: string | null): string[] {\n if (!q) return [];\n return String(q).toLowerCase().split(/\\s+/).filter(Boolean);\n}\n\nexport async function listServers(\n options: ListServersOptions = {}\n): Promise {\n await runMigrations();\n const db = getDb();\n\n const limit = Math.max(1, Math.min(options.limit ?? 25, 100));\n const cur = options.cursor ? decodeCursor(options.cursor) : null;\n\n // Build WHERE condition\n let cond: any = eq(serverVersions.status, \"active\");\n if (cur) {\n const cursorCond = sql`(${serverVersions.updatedAt} < ${cur.u}\n OR (${serverVersions.updatedAt} = ${cur.u} AND ${serverVersions.serverNameLower} > ${cur.s})\n OR (${serverVersions.updatedAt} = ${cur.u} AND ${serverVersions.serverNameLower} = ${cur.s} AND ${serverVersions.version} < ${cur.v}))`;\n cond = and(cond, cursorCond as any);\n }\n const tokens = tokenizeSearch(options.search);\n for (const t of tokens) {\n const likeCond = sql`${serverVersions.searchText} LIKE ${\"%\" + t + \"%\"}`;\n cond = and(cond, likeCond as any);\n }\n\n const rows = await db\n .select()\n .from(serverVersions)\n .where(cond)\n .orderBy(\n desc(serverVersions.updatedAt),\n asc(serverVersions.serverNameLower),\n desc(serverVersions.version),\n desc(serverVersions.id),\n )\n .limit(limit);\n\n const servers = rows.map(toServerResponse);\n\n const last = rows[rows.length - 1];\n const nextCursor = last\n ? encodeCursor({\n u: String(last.updatedAt),\n s: String(last.serverNameLower),\n v: String(last.version),\n })\n : undefined;\n\n const out: ServerListResponse = {\n servers,\n metadata: {\n count: servers.length,\n ...(nextCursor ? { nextCursor } : {}),\n },\n };\n // Strict output validation\n const { success } = await ServerListResponseSchema.safeParseAsync(out);\n if (!success) {\n throw new Error(\"Invalid server list response\");\n }\n return out;\n}",[],[180,243,235],"database","8dc629f6-a0da-11f0-8fb0-0224a6c84d84","migrations.ts","8dc62ab4-a0da-11f0-8fb0-0224a6c84d84",18,["D",1759552098984],"// Val Town SQLite migration for MCP Subregistry POC v2\n// - Change table name when modifying schema versions (Val Town pattern)\n// - Keep OpenAPI surface unchanged; these columns support discovery/search\n// - Times are ISO 8601 strings (UTC)\n// - search_text is a lowercased aggregate for LIKE queries (non-FTS)\n//\n// Columns overview:\n// Core:\n// server_name, server_name_lower, version, payload_json, published_at, updated_at,\n// is_latest, status, search_text\n// Blobs:\n// blob_icon_key, blob_icon_mime\n// MCP-alignment (optional/derived):\n// protocol_version, has_tools, has_resources, has_prompts, has_roots,\n// has_completions, has_sampling, transports (JSON), discovery_links (JSON),\n// client_snippets (JSON), auth_methods (JSON)\n\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nimport { drizzle } from \"https://esm.sh/drizzle-orm@0.44.6/sqlite-proxy?target=deno&dts\";\nimport {\n sqliteTable,\n integer,\n text,\n index,\n uniqueIndex,\n} from \"https://esm.sh/drizzle-orm@0.44.6/sqlite-core?target=deno&dts\";\n\nexport const TABLE_NAME = \"server_versions_poc_v2\";\n\n// Drizzle schema for server_versions_poc_v2\nexport const serverVersions = sqliteTable(\n TABLE_NAME,\n {\n id: integer(\"id\").primaryKey({ autoIncrement: true }),\n serverName: text(\"server_name\").notNull(),\n serverNameLower: text(\"server_name_lower\").notNull(),\n version: text(\"version\").notNull(),\n payloadJson: text(\"payload_json\").notNull(),\n publishedAt: text(\"published_at\").notNull(), // ISO 8601\n updatedAt: text(\"updated_at\").notNull(), // ISO 8601\n isLatest: integer(\"is_latest\", { mode: \"boolean\" }).notNull().default(false),\n status: text(\"status\").notNull().default(\"active\"),\n searchText: text(\"search_text\").notNull(),\n\n // Blob fields\n blobIconKey: text(\"blob_icon_key\"),\n blobIconMime: text(\"blob_icon_mime\"),\n\n // MCP-alignment (optional/derived)\n protocolVersion: text(\"protocol_version\"),\n hasTools: integer(\"has_tools\", { mode: \"boolean\" }),\n hasResources: integer(\"has_resources\", { mode: \"boolean\" }),\n hasPrompts: integer(\"has_prompts\", { mode: \"boolean\" }),\n hasRoots: integer(\"has_roots\", { mode: \"boolean\" }),\n hasCompletions: integer(\"has_completions\", { mode: \"boolean\" }),\n hasSampling: integer(\"has_sampling\", { mode: \"boolean\" }),\n transports: text(\"transports\"), // JSON string\n discoveryLinks: text(\"discovery_links\"),// JSON string\n clientSnippets: text(\"client_snippets\"),// JSON string\n authMethods: text(\"auth_methods\"), // JSON string\n },\n (t) => ({\n uqNameVersion: uniqueIndex(`uq_${TABLE_NAME}_name_version`).on(t.serverNameLower, t.version),\n idxNameLower: index(`idx_${TABLE_NAME}_name_lower`).on(t.serverNameLower),\n idxLatest: index(`idx_${TABLE_NAME}_latest`).on(t.isLatest, t.serverNameLower),\n idxUpdatedAt: index(`idx_${TABLE_NAME}_updated_at`).on(t.updatedAt),\n idxStatus: index(`idx_${TABLE_NAME}_status`).on(t.status),\n })\n);\n\n// Drizzle DB bridge using Val Town sqlite.execute\nexport function getDb() {\n // sqlite-proxy expects a handler: (sql, params, method) => { rows }\n const db = drizzle(async (sqlText: string, params: any[] = [], _method: \"all\" | \"run\" | \"get\" | \"values\") => {\n const res = await sqlite.execute(sqlText, params);\n return { rows: res.rows ?? [] };\n });\n return db;\n}\n\nlet migrationsPromise: Promise | null = null;\n\nexport function runMigrations(): Promise {\n if (!migrationsPromise) {\n migrationsPromise = (async () => {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n server_name TEXT NOT NULL,\n server_name_lower TEXT NOT NULL,\n version TEXT NOT NULL,\n payload_json TEXT NOT NULL,\n published_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n is_latest INTEGER NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'active',\n search_text TEXT NOT NULL,\n blob_icon_key TEXT,\n blob_icon_mime TEXT,\n protocol_version TEXT,\n has_tools INTEGER,\n has_resources INTEGER,\n has_prompts INTEGER,\n has_roots INTEGER,\n has_completions INTEGER,\n has_sampling INTEGER,\n transports TEXT,\n discovery_links TEXT,\n client_snippets TEXT,\n auth_methods TEXT\n )`,\n );\n\n await sqlite.execute(\n `CREATE UNIQUE INDEX IF NOT EXISTS uq_${TABLE_NAME}_name_version\n ON ${TABLE_NAME} (server_name_lower, version)`,\n );\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_${TABLE_NAME}_name_lower\n ON ${TABLE_NAME} (server_name_lower)`,\n );\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_${TABLE_NAME}_latest\n ON ${TABLE_NAME} (is_latest, server_name_lower)`,\n );\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_${TABLE_NAME}_updated_at\n ON ${TABLE_NAME} (updated_at)`,\n );\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_${TABLE_NAME}_status\n ON ${TABLE_NAME} (status)`,\n );\n })();\n }\n return migrationsPromise;\n}\n\n// Schema changes should be performed via Drizzle migrations (e.g. drizzle-kit) that target Val Town SQLite.\n",[],[180,243,245],"8d9dcefc-a0da-11f0-bb5b-0224a6c84d84",14,["D",1759552098765],[198,199],[180,243],["D",1759552098645],[197,200],[180],["D",1759523222208],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"ctx",{"_78":-5,"_124":297,"_298":299,"_300":301,"_302":25,"_303":25,"_304":25,"_305":157,"_306":-5,"_307":-7,"_308":-7,"_309":169,"_310":25,"_311":25,"_312":-5,"_313":25,"_314":25,"_315":25,"_316":-5},"ENV",{"_268":269,"_270":271,"_272":86,"_273":274,"_275":276,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v20