[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_182":183,"_184":185},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_106":88,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","superserve-proxy.ts","latestPath","fileId","e117c040-956e-11f1-ac88-1607ee4eb77e","name","fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst UPSTREAM = \"https://mcp.superserve.ai\";\nconst OAUTH_SCOPE = \"mcp\";\nconst AUTH_CODE_TTL_MS = 5 * 60 * 1000;\nconst HOP_BY_HOP = new Set([\n \"connection\",\n \"keep-alive\",\n \"proxy-authenticate\",\n \"proxy-authorization\",\n \"te\",\n \"trailer\",\n \"transfer-encoding\",\n \"upgrade\",\n \"content-length\",\n]);\n\nlet schemaReady = false;\n\nasync function ensureSchema() {\n if (schemaReady) return;\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS oauth_clients (\n client_id TEXT PRIMARY KEY,\n redirect_uris TEXT NOT NULL,\n client_name TEXT,\n application_type TEXT,\n created_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS oauth_codes (\n code_hash TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n code_challenge TEXT NOT NULL,\n scope TEXT NOT NULL,\n resource TEXT,\n superserve_api_key TEXT NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS oauth_codes_expires_at ON oauth_codes(expires_at)`,\n ]);\n schemaReady = true;\n}\n\nfunction json(data: unknown, init: ResponseInit = {}) {\n const headers = new Headers(init.headers);\n headers.set(\"content-type\", \"application/json; charset=utf-8\");\n headers.set(\"cache-control\", \"no-store\");\n return new Response(JSON.stringify(data), { ...init, headers });\n}\n\nfunction oauthError(error: string, description: string, status = 400) {\n return json({ error, error_description: description }, { status });\n}\n\nfunction randomToken(bytes = 32) {\n const buf = crypto.getRandomValues(new Uint8Array(bytes));\n return base64Url(buf);\n}\n\nfunction base64Url(data: Uint8Array) {\n let binary = \"\";\n for (const byte of data) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nasync function sha256(value: string) {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return base64Url(new Uint8Array(digest));\n}\n\nfunction base64UrlDecode(value: string) {\n const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction parseJwtJson(part: string) {\n try {\n return JSON.parse(new TextDecoder().decode(base64UrlDecode(part))) as Record;\n } catch {\n throw new Error(\"Malformed JWT assertion\");\n }\n}\n\nasync function fetchJsonDocument(url: URL, label: string) {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 5000);\n try {\n const response = await fetch(url, {\n headers: { accept: \"application/json\" },\n redirect: \"error\",\n signal: controller.signal,\n });\n if (!response.ok) throw new Error(`Unable to load ${label}`);\n return await response.json() as Record;\n } finally {\n clearTimeout(timeout);\n }\n}\n\nasync function fetchClientMetadata(clientId: string) {\n let metadataUrl: URL;\n try {\n metadataUrl = new URL(clientId);\n } catch {\n throw new Error(\"Unknown client_id\");\n }\n if (metadataUrl.protocol !== \"https:\" || metadataUrl.pathname === \"/\" || metadataUrl.username || metadataUrl.password || metadataUrl.hash) {\n throw new Error(\"Unknown client_id\");\n }\n\n const metadata = await fetchJsonDocument(metadataUrl, \"client metadata document\");\n if (metadata.client_id !== clientId) throw new Error(\"Client metadata document client_id does not match its URL\");\n return metadata;\n}\n\nasync function verifyPrivateKeyJwt(assertion: string, clientId: string, metadata: Record, origin: string) {\n const parts = assertion.split(\".\");\n if (parts.length !== 3) throw new Error(\"Malformed private_key_jwt assertion\");\n const header = parseJwtJson(parts[0]);\n const payload = parseJwtJson(parts[1]);\n\n const expectedAlg = typeof metadata.token_endpoint_auth_signing_alg === \"string\"\n ? metadata.token_endpoint_auth_signing_alg\n : \"RS256\";\n if (expectedAlg !== \"RS256\" || header.alg !== \"RS256\") throw new Error(\"Only RS256 private_key_jwt is supported\");\n\n const jwksUri = typeof metadata.jwks_uri === \"string\" ? metadata.jwks_uri : \"\";\n let jwksUrl: URL;\n try {\n jwksUrl = new URL(jwksUri);\n } catch {\n throw new Error(\"Client metadata is missing a valid jwks_uri\");\n }\n if (jwksUrl.protocol !== \"https:\") throw new Error(\"Client jwks_uri must use HTTPS\");\n\n const jwks = await fetchJsonDocument(jwksUrl, \"client JWKS\");\n const keys = Array.isArray(jwks.keys) ? jwks.keys.filter((v): v is Record => !!v && typeof v === \"object\") : [];\n const kid = typeof header.kid === \"string\" ? header.kid : null;\n const candidates = keys.filter((key) => key.kty === \"RSA\" && (!kid || key.kid === kid));\n if (!candidates.length) throw new Error(\"No matching RSA key found in client JWKS\");\n\n const signingInput = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);\n const signature = base64UrlDecode(parts[2]);\n let verified = false;\n for (const jwk of candidates) {\n try {\n const key = await crypto.subtle.importKey(\n \"jwk\",\n jwk as JsonWebKey,\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n if (await crypto.subtle.verify(\"RSASSA-PKCS1-v1_5\", key, signature, signingInput)) {\n verified = true;\n break;\n }\n } catch {\n // Try the next matching key.\n }\n }\n if (!verified) throw new Error(\"Invalid private_key_jwt signature\");\n\n const now = Math.floor(Date.now() / 1000);\n if (payload.iss !== clientId || payload.sub !== clientId) throw new Error(\"private_key_jwt iss/sub must equal client_id\");\n const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];\n const acceptedAudiences = new Set([origin, `${origin}/`, `${origin}/token`]);\n if (!audiences.some((value) => typeof value === \"string\" && acceptedAudiences.has(value))) {\n throw new Error(\"private_key_jwt audience does not identify this authorization server\");\n }\n if (typeof payload.exp !== \"number\" || payload.exp < now - 30) throw new Error(\"private_key_jwt is expired\");\n if (typeof payload.iat === \"number\" && payload.iat > now + 60) throw new Error(\"private_key_jwt iat is in the future\");\n}\n\nasync function authenticateTokenClient(params: URLSearchParams, origin: string) {\n const clientId = params.get(\"client_id\") ?? \"\";\n if (!clientId) throw new Error(\"client_id is required\");\n\n await ensureSchema();\n const stored = await sqlite.execute({\n sql: `SELECT client_id FROM oauth_clients WHERE client_id = ?`,\n args: [clientId],\n });\n if (stored.rows.length) return;\n\n const metadata = await fetchClientMetadata(clientId);\n const method = typeof metadata.token_endpoint_auth_method === \"string\" ? metadata.token_endpoint_auth_method : \"none\";\n if (method === \"none\") return;\n if (method !== \"private_key_jwt\") throw new Error(`Unsupported token_endpoint_auth_method: ${method}`);\n\n const assertionType = params.get(\"client_assertion_type\");\n const assertion = params.get(\"client_assertion\") ?? \"\";\n if (assertionType !== \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" || !assertion) {\n throw new Error(\"private_key_jwt client_assertion is required\");\n }\n await verifyPrivateKeyJwt(assertion, clientId, metadata, origin);\n}\n\nfunction htmlEscape(value: string) {\n return value\n .replaceAll(\"&\", \"&\")\n .replaceAll(\"<\", \"<\")\n .replaceAll(\">\", \">\")\n .replaceAll('\"', \""\")\n .replaceAll(\"'\", \"'\");\n}\n\nfunction originOf(req: Request) {\n return new URL(req.url).origin;\n}\n\nfunction protectedResource(origin: string) {\n return `${origin}/`;\n}\n\nfunction isAllowedResource(resource: string | null, origin: string) {\n if (!resource) return true;\n try {\n return new URL(resource).origin === origin;\n } catch {\n return false;\n }\n}\n\nfunction unauthorized(origin: string, body = { error: \"authorization_required\" }) {\n return json(body, {\n status: 401,\n headers: {\n \"www-authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\", scope=\"${OAUTH_SCOPE}\"`,\n },\n });\n}\n\nasync function readForm(req: Request) {\n const contentType = req.headers.get(\"content-type\") ?? \"\";\n if (contentType.includes(\"application/json\")) {\n const body = await req.json() as Record;\n const params = new URLSearchParams();\n for (const [key, value] of Object.entries(body)) {\n if (typeof value === \"string\") params.set(key, value);\n }\n return params;\n }\n return new URLSearchParams(await req.text());\n}\n\nasync function validateClient(clientId: string, redirectUri: string) {\n await ensureSchema();\n\n const stored = await sqlite.execute({\n sql: `SELECT redirect_uris, client_name, application_type FROM oauth_clients WHERE client_id = ?`,\n args: [clientId],\n });\n if (stored.rows.length) {\n const row = stored.rows[0] as Record;\n const redirectUris = JSON.parse(String(row.redirect_uris)) as string[];\n if (!redirectUris.includes(redirectUri)) throw new Error(\"redirect_uri is not registered for this client\");\n return { clientName: String(row.client_name || clientId) };\n }\n\n // MCP 2026-07-28 prefers Client ID Metadata Documents (CIMD).\n const metadata = await fetchClientMetadata(clientId);\n const redirectUris = Array.isArray(metadata.redirect_uris)\n ? metadata.redirect_uris.filter((v): v is string => typeof v === \"string\")\n : [];\n if (!redirectUris.includes(redirectUri)) throw new Error(\"redirect_uri is not listed by the client metadata document\");\n\n const authMethod = typeof metadata.token_endpoint_auth_method === \"string\" ? metadata.token_endpoint_auth_method : \"none\";\n if (authMethod !== \"none\" && authMethod !== \"private_key_jwt\") {\n throw new Error(`Unsupported token_endpoint_auth_method: ${authMethod}`);\n }\n return { clientName: typeof metadata.client_name === \"string\" ? metadata.client_name : clientId };\n}\n\nasync function validateAuthorizeParams(params: URLSearchParams, origin: string) {\n const responseType = params.get(\"response_type\");\n const clientId = params.get(\"client_id\") ?? \"\";\n const redirectUri = params.get(\"redirect_uri\") ?? \"\";\n const codeChallenge = params.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = params.get(\"code_challenge_method\") ?? \"\";\n const resource = params.get(\"resource\");\n\n if (responseType !== \"code\") throw new Error(\"response_type must be code\");\n if (!clientId) throw new Error(\"client_id is required\");\n if (!redirectUri) throw new Error(\"redirect_uri is required\");\n if (!codeChallenge) throw new Error(\"PKCE code_challenge is required\");\n if (codeChallengeMethod !== \"S256\") throw new Error(\"Only PKCE S256 is supported\");\n if (!isAllowedResource(resource, origin)) throw new Error(\"resource must point to this MCP server\");\n\n const client = await validateClient(clientId, redirectUri);\n return { clientId, redirectUri, codeChallenge, resource, clientName: client.clientName };\n}\n\nfunction authorizationPage(params: URLSearchParams, clientName: string) {\n const hidden = [\n \"response_type\",\n \"client_id\",\n \"redirect_uri\",\n \"code_challenge\",\n \"code_challenge_method\",\n \"state\",\n \"scope\",\n \"resource\",\n ]\n .map((name) => {\n const value = params.get(name);\n return value === null ? \"\" : ``;\n })\n .join(\"\\n\");\n\n const html = `\n\n\n\n\nConnect Superserve\n\n\n\n

Connect Superserve

${htmlEscape(clientName)} is requesting access to this Superserve MCP proxy.

\n \n The API key is submitted in the POST body, never in the URL. It is kept only long enough to redeem this one-time authorization code, then the OAuth client uses it as its Bearer token.\n

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n \"content-security-policy\": \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'\",\n \"x-frame-options\": \"DENY\",\n \"referrer-policy\": \"no-referrer\",\n },\n });\n}\n\nasync function handleAuthorize(req: Request, origin: string) {\n const params = req.method === \"GET\" ? new URL(req.url).searchParams : await readForm(req);\n\n let valid;\n try {\n valid = await validateAuthorizeParams(params, origin);\n } catch (error) {\n return oauthError(\"invalid_request\", error instanceof Error ? error.message : \"Invalid authorization request\");\n }\n\n if (req.method === \"GET\") return authorizationPage(params, valid.clientName);\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n\n const superserveApiKey = params.get(\"superserve_api_key\")?.trim() ?? \"\";\n if (!superserveApiKey) return oauthError(\"invalid_request\", \"Superserve API key is required\");\n\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE expires_at <= ?`, args: [now] });\n\n const code = randomToken(32);\n const codeHash = await sha256(code);\n await sqlite.execute({\n sql: `INSERT INTO oauth_codes\n (code_hash, client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n codeHash,\n valid.clientId,\n valid.redirectUri,\n valid.codeChallenge,\n params.get(\"scope\") || OAUTH_SCOPE,\n valid.resource || protectedResource(origin),\n superserveApiKey,\n now + AUTH_CODE_TTL_MS,\n ],\n });\n\n const redirect = new URL(valid.redirectUri);\n redirect.searchParams.set(\"code\", code);\n const state = params.get(\"state\");\n if (state !== null) redirect.searchParams.set(\"state\", state);\n // RFC 9207 issuer identification, required by the current MCP auth profile.\n redirect.searchParams.set(\"iss\", origin);\n return new Response(null, { status: 303, headers: { location: redirect.toString(), \"cache-control\": \"no-store\" } });\n}\n\nasync function handleToken(req: Request, origin: string) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n const params = await readForm(req);\n if (params.get(\"grant_type\") !== \"authorization_code\") {\n return oauthError(\"unsupported_grant_type\", \"Only authorization_code is supported\");\n }\n\n const code = params.get(\"code\") ?? \"\";\n const clientId = params.get(\"client_id\") ?? \"\";\n const redirectUri = params.get(\"redirect_uri\") ?? \"\";\n const codeVerifier = params.get(\"code_verifier\") ?? \"\";\n if (!code || !clientId || !redirectUri || !codeVerifier) {\n return oauthError(\"invalid_request\", \"code, client_id, redirect_uri, and code_verifier are required\");\n }\n\n try {\n await authenticateTokenClient(params, origin);\n } catch (error) {\n return oauthError(\"invalid_client\", error instanceof Error ? error.message : \"Client authentication failed\", 401);\n }\n\n await ensureSchema();\n const codeHash = await sha256(code);\n const result = await sqlite.execute({\n sql: `SELECT client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at\n FROM oauth_codes WHERE code_hash = ?`,\n args: [codeHash],\n });\n if (!result.rows.length) return oauthError(\"invalid_grant\", \"Unknown or already-used authorization code\");\n\n const row = result.rows[0] as Record;\n if (Number(row.expires_at) <= Date.now()) {\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n return oauthError(\"invalid_grant\", \"Authorization code expired\");\n }\n if (String(row.client_id) !== clientId || String(row.redirect_uri) !== redirectUri) {\n return oauthError(\"invalid_grant\", \"Authorization code does not match this client or redirect_uri\");\n }\n const expectedChallenge = await sha256(codeVerifier);\n if (expectedChallenge !== String(row.code_challenge)) {\n return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n }\n\n const deleted = await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n if (!deleted.rowsAffected) return oauthError(\"invalid_grant\", \"Authorization code was already redeemed\");\n\n return json({\n access_token: String(row.superserve_api_key),\n token_type: \"Bearer\",\n scope: String(row.scope || OAUTH_SCOPE),\n resource: String(row.resource || protectedResource(origin)),\n });\n}\n\nasync function handleRegister(req: Request) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n let body: Record;\n try {\n body = await req.json() as Record;\n } catch {\n return oauthError(\"invalid_client_metadata\", \"Expected JSON client metadata\");\n }\n\n const redirectUris = Array.isArray(body.redirect_uris)\n ? body.redirect_uris.filter((v): v is string => typeof v === \"string\")\n : [];\n if (!redirectUris.length) return oauthError(\"invalid_redirect_uri\", \"At least one redirect_uri is required\");\n for (const value of redirectUris) {\n try {\n new URL(value);\n } catch {\n return oauthError(\"invalid_redirect_uri\", `Invalid redirect_uri: ${value}`);\n }\n }\n if (body.token_endpoint_auth_method && body.token_endpoint_auth_method !== \"none\") {\n return oauthError(\"invalid_client_metadata\", \"Only public clients with token_endpoint_auth_method=none are supported\");\n }\n\n await ensureSchema();\n const clientId = `mcp_${randomToken(24)}`;\n const createdAt = Math.floor(Date.now() / 1000);\n const clientName = typeof body.client_name === \"string\" ? body.client_name : \"MCP client\";\n const applicationType = typeof body.application_type === \"string\" ? body.application_type : \"native\";\n await sqlite.execute({\n sql: `INSERT INTO oauth_clients (client_id, redirect_uris, client_name, application_type, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [clientId, JSON.stringify(redirectUris), clientName, applicationType, createdAt],\n });\n\n return json({\n client_id: clientId,\n client_id_issued_at: createdAt,\n redirect_uris: redirectUris,\n client_name: clientName,\n application_type: applicationType,\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n }, { status: 201 });\n}\n\nfunction protectedResourceMetadata(origin: string) {\n return json({\n resource: protectedResource(origin),\n authorization_servers: [origin],\n bearer_methods_supported: [\"header\"],\n scopes_supported: [OAUTH_SCOPE],\n });\n}\n\nfunction authorizationServerMetadata(origin: string) {\n return json({\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\", \"private_key_jwt\"],\n token_endpoint_auth_signing_alg_values_supported: [\"RS256\"],\n code_challenge_methods_supported: [\"S256\"],\n scopes_supported: [OAUTH_SCOPE],\n client_id_metadata_document_supported: true,\n authorization_response_iss_parameter_supported: true,\n });\n}\n\nfunction bearerToken(req: Request) {\n const authorization = req.headers.get(\"authorization\") ?? \"\";\n const match = authorization.match(/^Bearer\\s+(.+)$/i);\n return match?.[1]?.trim() || null;\n}\n\nasync function proxyToSuperserve(req: Request, origin: string) {\n const apiKey = bearerToken(req);\n if (!apiKey) return unauthorized(origin);\n\n const incoming = new URL(req.url);\n const target = new URL(incoming.pathname + incoming.search, UPSTREAM);\n const headers = new Headers(req.headers);\n for (const name of HOP_BY_HOP) headers.delete(name);\n headers.delete(\"host\");\n headers.set(\"authorization\", `Bearer ${apiKey}`);\n headers.set(\"cache-control\", \"no-store\");\n\n const upstream = await fetch(target, {\n method: req.method,\n headers,\n body: req.method === \"GET\" || req.method === \"HEAD\" ? undefined : req.body,\n redirect: \"manual\",\n });\n\n const responseHeaders = new Headers(upstream.headers);\n for (const name of HOP_BY_HOP) responseHeaders.delete(name);\n responseHeaders.set(\"cache-control\", \"no-store\");\n if (upstream.status === 401) {\n responseHeaders.set(\n \"www-authenticate\",\n `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\", scope=\"${OAUTH_SCOPE}\"`,\n );\n }\n return new Response(upstream.body, {\n status: upstream.status,\n statusText: upstream.statusText,\n headers: responseHeaders,\n });\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/.well-known/oauth-protected-resource\") return protectedResourceMetadata(origin);\n if (url.pathname === \"/.well-known/oauth-authorization-server\") return authorizationServerMetadata(origin);\n if (url.pathname === \"/authorize\") return handleAuthorize(req, origin);\n if (url.pathname === \"/token\") return handleToken(req, origin);\n if (url.pathname === \"/register\") return handleRegister(req);\n\n return proxyToSuperserve(req, origin);\n}\n","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst UPSTREAM = \"https://mcp.superserve.ai\";\nconst OAUTH_SCOPE = \"mcp\";\nconst AUTH_CODE_TTL_MS = 5 * 60 * 1000;\nconst HOP_BY_HOP = new Set([\n \"connection\",\n \"keep-alive\",\n \"proxy-authenticate\",\n \"proxy-authorization\",\n \"te\",\n \"trailer\",\n \"transfer-encoding\",\n \"upgrade\",\n \"content-length\",\n]);\n\nlet schemaReady = false;\n\nasync function ensureSchema() {\n if (schemaReady) return;\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS oauth_clients (\n client_id TEXT PRIMARY KEY,\n redirect_uris TEXT NOT NULL,\n client_name TEXT,\n application_type TEXT,\n created_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS oauth_codes (\n code_hash TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n code_challenge TEXT NOT NULL,\n scope TEXT NOT NULL,\n resource TEXT,\n superserve_api_key TEXT NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS oauth_codes_expires_at ON oauth_codes(expires_at)`,\n ]);\n schemaReady = true;\n}\n\nfunction json(data: unknown, init: ResponseInit = {}) {\n const headers = new Headers(init.headers);\n headers.set(\"content-type\", \"application/json; charset=utf-8\");\n headers.set(\"cache-control\", \"no-store\");\n return new Response(JSON.stringify(data), { ...init, headers });\n}\n\nfunction oauthError(error: string, description: string, status = 400) {\n return json({ error, error_description: description }, { status });\n}\n\nfunction randomToken(bytes = 32) {\n const buf = crypto.getRandomValues(new Uint8Array(bytes));\n return base64Url(buf);\n}\n\nfunction base64Url(data: Uint8Array) {\n let binary = \"\";\n for (const byte of data) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nasync function sha256(value: string) {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return base64Url(new Uint8Array(digest));\n}\n\nfunction base64UrlDecode(value: string) {\n const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction parseJwtJson(part: string) {\n try {\n return JSON.parse(new TextDecoder().decode(base64UrlDecode(part))) as Record;\n } catch {\n throw new Error(\"Malformed JWT assertion\");\n }\n}\n\nasync function fetchJsonDocument(url: URL, label: string) {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 5000);\n try {\n const response = await fetch(url, {\n headers: { accept: \"application/json\" },\n redirect: \"error\",\n signal: controller.signal,\n });\n if (!response.ok) throw new Error(`Unable to load ${label}`);\n return await response.json() as Record;\n } finally {\n clearTimeout(timeout);\n }\n}\n\nasync function fetchClientMetadata(clientId: string) {\n let metadataUrl: URL;\n try {\n metadataUrl = new URL(clientId);\n } catch {\n throw new Error(\"Unknown client_id\");\n }\n if (metadataUrl.protocol !== \"https:\" || metadataUrl.pathname === \"/\" || metadataUrl.username || metadataUrl.password || metadataUrl.hash) {\n throw new Error(\"Unknown client_id\");\n }\n\n const metadata = await fetchJsonDocument(metadataUrl, \"client metadata document\");\n if (metadata.client_id !== clientId) throw new Error(\"Client metadata document client_id does not match its URL\");\n return metadata;\n}\n\nasync function verifyPrivateKeyJwt(assertion: string, clientId: string, metadata: Record, origin: string) {\n const parts = assertion.split(\".\");\n if (parts.length !== 3) throw new Error(\"Malformed private_key_jwt assertion\");\n const header = parseJwtJson(parts[0]);\n const payload = parseJwtJson(parts[1]);\n\n const expectedAlg = typeof metadata.token_endpoint_auth_signing_alg === \"string\"\n ? metadata.token_endpoint_auth_signing_alg\n : \"RS256\";\n if (expectedAlg !== \"RS256\" || header.alg !== \"RS256\") throw new Error(\"Only RS256 private_key_jwt is supported\");\n\n const jwksUri = typeof metadata.jwks_uri === \"string\" ? metadata.jwks_uri : \"\";\n let jwksUrl: URL;\n try {\n jwksUrl = new URL(jwksUri);\n } catch {\n throw new Error(\"Client metadata is missing a valid jwks_uri\");\n }\n if (jwksUrl.protocol !== \"https:\") throw new Error(\"Client jwks_uri must use HTTPS\");\n\n const jwks = await fetchJsonDocument(jwksUrl, \"client JWKS\");\n const keys = Array.isArray(jwks.keys) ? jwks.keys.filter((v): v is Record => !!v && typeof v === \"object\") : [];\n const kid = typeof header.kid === \"string\" ? header.kid : null;\n const candidates = keys.filter((key) => key.kty === \"RSA\" && (!kid || key.kid === kid));\n if (!candidates.length) throw new Error(\"No matching RSA key found in client JWKS\");\n\n const signingInput = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);\n const signature = base64UrlDecode(parts[2]);\n let verified = false;\n for (const jwk of candidates) {\n try {\n const key = await crypto.subtle.importKey(\n \"jwk\",\n jwk as JsonWebKey,\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n if (await crypto.subtle.verify(\"RSASSA-PKCS1-v1_5\", key, signature, signingInput)) {\n verified = true;\n break;\n }\n } catch {\n // Try the next matching key.\n }\n }\n if (!verified) throw new Error(\"Invalid private_key_jwt signature\");\n\n const now = Math.floor(Date.now() / 1000);\n if (payload.iss !== clientId || payload.sub !== clientId) throw new Error(\"private_key_jwt iss/sub must equal client_id\");\n const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];\n const acceptedAudiences = new Set([origin, `${origin}/`, `${origin}/token`]);\n if (!audiences.some((value) => typeof value === \"string\" && acceptedAudiences.has(value))) {\n throw new Error(\"private_key_jwt audience does not identify this authorization server\");\n }\n if (typeof payload.exp !== \"number\" || payload.exp < now - 30) throw new Error(\"private_key_jwt is expired\");\n if (typeof payload.iat === \"number\" && payload.iat > now + 60) throw new Error(\"private_key_jwt iat is in the future\");\n}\n\nasync function authenticateTokenClient(params: URLSearchParams, origin: string) {\n const clientId = params.get(\"client_id\") ?? \"\";\n if (!clientId) throw new Error(\"client_id is required\");\n\n await ensureSchema();\n const stored = await sqlite.execute({\n sql: `SELECT client_id FROM oauth_clients WHERE client_id = ?`,\n args: [clientId],\n });\n if (stored.rows.length) return;\n\n const metadata = await fetchClientMetadata(clientId);\n const method = typeof metadata.token_endpoint_auth_method === \"string\" ? metadata.token_endpoint_auth_method : \"none\";\n if (method === \"none\") return;\n if (method !== \"private_key_jwt\") throw new Error(`Unsupported token_endpoint_auth_method: ${method}`);\n\n const assertionType = params.get(\"client_assertion_type\");\n const assertion = params.get(\"client_assertion\") ?? \"\";\n if (assertionType !== \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" || !assertion) {\n throw new Error(\"private_key_jwt client_assertion is required\");\n }\n await verifyPrivateKeyJwt(assertion, clientId, metadata, origin);\n}\n\nfunction htmlEscape(value: string) {\n return value\n .replaceAll(\"&\", \"&\")\n .replaceAll(\"<\", \"<\")\n .replaceAll(\">\", \">\")\n .replaceAll('\"', \""\")\n .replaceAll(\"'\", \"'\");\n}\n\nfunction originOf(req: Request) {\n return new URL(req.url).origin;\n}\n\nfunction protectedResource(origin: string) {\n return `${origin}/`;\n}\n\nfunction isAllowedResource(resource: string | null, origin: string) {\n if (!resource) return true;\n try {\n return new URL(resource).origin === origin;\n } catch {\n return false;\n }\n}\n\nfunction unauthorized(origin: string, body = { error: \"authorization_required\" }) {\n return json(body, {\n status: 401,\n headers: {\n \"www-authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\", scope=\"${OAUTH_SCOPE}\"`,\n },\n });\n}\n\nasync function readForm(req: Request) {\n const contentType = req.headers.get(\"content-type\") ?? \"\";\n if (contentType.includes(\"application/json\")) {\n const body = await req.json() as Record;\n const params = new URLSearchParams();\n for (const [key, value] of Object.entries(body)) {\n if (typeof value === \"string\") params.set(key, value);\n }\n return params;\n }\n return new URLSearchParams(await req.text());\n}\n\nasync function validateClient(clientId: string, redirectUri: string) {\n await ensureSchema();\n\n const stored = await sqlite.execute({\n sql: `SELECT redirect_uris, client_name, application_type FROM oauth_clients WHERE client_id = ?`,\n args: [clientId],\n });\n if (stored.rows.length) {\n const row = stored.rows[0] as Record;\n const redirectUris = JSON.parse(String(row.redirect_uris)) as string[];\n if (!redirectUris.includes(redirectUri)) throw new Error(\"redirect_uri is not registered for this client\");\n return { clientName: String(row.client_name || clientId) };\n }\n\n // MCP 2026-07-28 prefers Client ID Metadata Documents (CIMD).\n const metadata = await fetchClientMetadata(clientId);\n const redirectUris = Array.isArray(metadata.redirect_uris)\n ? metadata.redirect_uris.filter((v): v is string => typeof v === \"string\")\n : [];\n if (!redirectUris.includes(redirectUri)) throw new Error(\"redirect_uri is not listed by the client metadata document\");\n\n const authMethod = typeof metadata.token_endpoint_auth_method === \"string\" ? metadata.token_endpoint_auth_method : \"none\";\n if (authMethod !== \"none\" && authMethod !== \"private_key_jwt\") {\n throw new Error(`Unsupported token_endpoint_auth_method: ${authMethod}`);\n }\n return { clientName: typeof metadata.client_name === \"string\" ? metadata.client_name : clientId };\n}\n\nasync function validateAuthorizeParams(params: URLSearchParams, origin: string) {\n const responseType = params.get(\"response_type\");\n const clientId = params.get(\"client_id\") ?? \"\";\n const redirectUri = params.get(\"redirect_uri\") ?? \"\";\n const codeChallenge = params.get(\"code_challenge\") ?? \"\";\n const codeChallengeMethod = params.get(\"code_challenge_method\") ?? \"\";\n const resource = params.get(\"resource\");\n\n if (responseType !== \"code\") throw new Error(\"response_type must be code\");\n if (!clientId) throw new Error(\"client_id is required\");\n if (!redirectUri) throw new Error(\"redirect_uri is required\");\n if (!codeChallenge) throw new Error(\"PKCE code_challenge is required\");\n if (codeChallengeMethod !== \"S256\") throw new Error(\"Only PKCE S256 is supported\");\n if (!isAllowedResource(resource, origin)) throw new Error(\"resource must point to this MCP server\");\n\n const client = await validateClient(clientId, redirectUri);\n return { clientId, redirectUri, codeChallenge, resource, clientName: client.clientName };\n}\n\nfunction authorizationPage(params: URLSearchParams, clientName: string) {\n const hidden = [\n \"response_type\",\n \"client_id\",\n \"redirect_uri\",\n \"code_challenge\",\n \"code_challenge_method\",\n \"state\",\n \"scope\",\n \"resource\",\n ]\n .map((name) => {\n const value = params.get(name);\n return value === null ? \"\" : ``;\n })\n .join(\"\\n\");\n\n const html = `\n\n\n\n\nConnect Superserve\n\n\n\n

Connect Superserve

${htmlEscape(clientName)} is requesting access to this Superserve MCP proxy.

\n \n The API key is submitted in the POST body, never in the URL. It is kept only long enough to redeem this one-time authorization code, then the OAuth client uses it as its Bearer token.\n

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n \"content-security-policy\": \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'\",\n \"referrer-policy\": \"no-referrer\",\n },\n });\n}\n\nasync function handleAuthorize(req: Request, origin: string) {\n const params = req.method === \"GET\" ? new URL(req.url).searchParams : await readForm(req);\n\n let valid;\n try {\n valid = await validateAuthorizeParams(params, origin);\n } catch (error) {\n return oauthError(\"invalid_request\", error instanceof Error ? error.message : \"Invalid authorization request\");\n }\n\n if (req.method === \"GET\") return authorizationPage(params, valid.clientName);\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n\n const superserveApiKey = params.get(\"superserve_api_key\")?.trim() ?? \"\";\n if (!superserveApiKey) return oauthError(\"invalid_request\", \"Superserve API key is required\");\n\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE expires_at <= ?`, args: [now] });\n\n const code = randomToken(32);\n const codeHash = await sha256(code);\n await sqlite.execute({\n sql: `INSERT INTO oauth_codes\n (code_hash, client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n codeHash,\n valid.clientId,\n valid.redirectUri,\n valid.codeChallenge,\n params.get(\"scope\") || OAUTH_SCOPE,\n valid.resource || protectedResource(origin),\n superserveApiKey,\n now + AUTH_CODE_TTL_MS,\n ],\n });\n\n const redirect = new URL(valid.redirectUri);\n redirect.searchParams.set(\"code\", code);\n const state = params.get(\"state\");\n if (state !== null) redirect.searchParams.set(\"state\", state);\n // RFC 9207 issuer identification, required by the current MCP auth profile.\n redirect.searchParams.set(\"iss\", origin);\n return new Response(null, { status: 303, headers: { location: redirect.toString(), \"cache-control\": \"no-store\" } });\n}\n\nasync function handleToken(req: Request, origin: string) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n const params = await readForm(req);\n if (params.get(\"grant_type\") !== \"authorization_code\") {\n return oauthError(\"unsupported_grant_type\", \"Only authorization_code is supported\");\n }\n\n const code = params.get(\"code\") ?? \"\";\n const clientId = params.get(\"client_id\") ?? \"\";\n const redirectUri = params.get(\"redirect_uri\") ?? \"\";\n const codeVerifier = params.get(\"code_verifier\") ?? \"\";\n if (!code || !clientId || !redirectUri || !codeVerifier) {\n return oauthError(\"invalid_request\", \"code, client_id, redirect_uri, and code_verifier are required\");\n }\n\n try {\n await authenticateTokenClient(params, origin);\n } catch (error) {\n return oauthError(\"invalid_client\", error instanceof Error ? error.message : \"Client authentication failed\", 401);\n }\n\n await ensureSchema();\n const codeHash = await sha256(code);\n const result = await sqlite.execute({\n sql: `SELECT client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at\n FROM oauth_codes WHERE code_hash = ?`,\n args: [codeHash],\n });\n if (!result.rows.length) return oauthError(\"invalid_grant\", \"Unknown or already-used authorization code\");\n\n const row = result.rows[0] as Record;\n if (Number(row.expires_at) <= Date.now()) {\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n return oauthError(\"invalid_grant\", \"Authorization code expired\");\n }\n if (String(row.client_id) !== clientId || String(row.redirect_uri) !== redirectUri) {\n return oauthError(\"invalid_grant\", \"Authorization code does not match this client or redirect_uri\");\n }\n const expectedChallenge = await sha256(codeVerifier);\n if (expectedChallenge !== String(row.code_challenge)) {\n return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n }\n\n const deleted = await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n if (!deleted.rowsAffected) return oauthError(\"invalid_grant\", \"Authorization code was already redeemed\");\n\n return json({\n access_token: String(row.superserve_api_key),\n token_type: \"Bearer\",\n scope: String(row.scope || OAUTH_SCOPE),\n resource: String(row.resource || protectedResource(origin)),\n });\n}\n\nasync function handleRegister(req: Request) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n let body: Record;\n try {\n body = await req.json() as Record;\n } catch {\n return oauthError(\"invalid_client_metadata\", \"Expected JSON client metadata\");\n }\n\n const redirectUris = Array.isArray(body.redirect_uris)\n ? body.redirect_uris.filter((v): v is string => typeof v === \"string\")\n : [];\n if (!redirectUris.length) return oauthError(\"invalid_redirect_uri\", \"At least one redirect_uri is required\");\n for (const value of redirectUris) {\n try {\n new URL(value);\n } catch {\n return oauthError(\"invalid_redirect_uri\", `Invalid redirect_uri: ${value}`);\n }\n }\n if (body.token_endpoint_auth_method && body.token_endpoint_auth_method !== \"none\") {\n return oauthError(\"invalid_client_metadata\", \"Only public clients with token_endpoint_auth_method=none are supported\");\n }\n\n await ensureSchema();\n const clientId = `mcp_${randomToken(24)}`;\n const createdAt = Math.floor(Date.now() / 1000);\n const clientName = typeof body.client_name === \"string\" ? body.client_name : \"MCP client\";\n const applicationType = typeof body.application_type === \"string\" ? body.application_type : \"native\";\n await sqlite.execute({\n sql: `INSERT INTO oauth_clients (client_id, redirect_uris, client_name, application_type, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [clientId, JSON.stringify(redirectUris), clientName, applicationType, createdAt],\n });\n\n return json({\n client_id: clientId,\n client_id_issued_at: createdAt,\n redirect_uris: redirectUris,\n client_name: clientName,\n application_type: applicationType,\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n }, { status: 201 });\n}\n\nfunction protectedResourceMetadata(origin: string) {\n return json({\n resource: protectedResource(origin),\n authorization_servers: [origin],\n bearer_methods_supported: [\"header\"],\n scopes_supported: [OAUTH_SCOPE],\n });\n}\n\nfunction authorizationServerMetadata(origin: string) {\n return json({\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\", \"private_key_jwt\"],\n token_endpoint_auth_signing_alg_values_supported: [\"RS256\"],\n code_challenge_methods_supported: [\"S256\"],\n scopes_supported: [OAUTH_SCOPE],\n client_id_metadata_document_supported: true,\n authorization_response_iss_parameter_supported: true,\n });\n}\n\nfunction bearerToken(req: Request) {\n const authorization = req.headers.get(\"authorization\") ?? \"\";\n const match = authorization.match(/^Bearer\\s+(.+)$/i);\n return match?.[1]?.trim() || null;\n}\n\nasync function proxyToSuperserve(req: Request, origin: string) {\n const apiKey = bearerToken(req);\n if (!apiKey) return unauthorized(origin);\n\n const incoming = new URL(req.url);\n const target = new URL(incoming.pathname + incoming.search, UPSTREAM);\n const headers = new Headers(req.headers);\n for (const name of HOP_BY_HOP) headers.delete(name);\n headers.delete(\"host\");\n headers.set(\"authorization\", `Bearer ${apiKey}`);\n headers.set(\"cache-control\", \"no-store\");\n\n const upstream = await fetch(target, {\n method: req.method,\n headers,\n body: req.method === \"GET\" || req.method === \"HEAD\" ? undefined : req.body,\n redirect: \"manual\",\n });\n\n const responseHeaders = new Headers(upstream.headers);\n for (const name of HOP_BY_HOP) responseHeaders.delete(name);\n responseHeaders.set(\"cache-control\", \"no-store\");\n if (upstream.status === 401) {\n responseHeaders.set(\n \"www-authenticate\",\n `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\", scope=\"${OAUTH_SCOPE}\"`,\n );\n }\n return new Response(upstream.body, {\n status: upstream.status,\n statusText: upstream.statusText,\n headers: responseHeaders,\n });\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/.well-known/oauth-protected-resource\") return protectedResourceMetadata(origin);\n if (url.pathname === \"/.well-known/oauth-authorization-server\") return authorizationServerMetadata(origin);\n if (url.pathname === \"/authorize\") return handleAuthorize(req, origin);\n if (url.pathname === \"/token\") return handleToken(req, origin);\n if (url.pathname === \"/register\") return handleRegister(req);\n\n return proxyToSuperserve(req, origin);\n}\n","createdAt",["D",1789227872737],"branchVersion","branchId","7a9a9753-f79b-487d-a731-10576ac464b2","id","7f0120b6-7eb5-4b02-9132-b0b95aa9006c","superserve-mcp-proxy",["D",1786443887569],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","0198c634-ed48-734f-8aa5-f9673381d1fc","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","0198c634-ed48-734f-8aa5-fc33459c6ee0","tursoName","7f0120b67eb54b029132b0b95aa9006c","tursoHostname","7f0120b67eb54b029132b0b95aa9006c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789486866837],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":101},"org",{"_98":97,"_99":-5,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","contributory","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zMVhZaHZZRFhBaHQ3TDNqNFlpbFRUR1E2SFMifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":177,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":178,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":179,"_82":180,"_84":181,"_86":25},"tree",[164,165,166],"files",[164,165,166],"counts",{"_154":61,"_155":150,"_156":61,"_157":158,"_159":160},"contents",[128,129,130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":147,"_32":148,"_30":149,"_132":-5,"_41":42,"_40":150,"_133":123,"_38":151,"_13":61,"_33":20,"_35":152,"_24":25,"_136":-5,"_27":153},{"_43":139,"_32":140,"_30":141,"_132":-5,"_41":42,"_40":142,"_133":25,"_38":143,"_13":144,"_33":20,"_35":145,"_24":25,"_136":-5,"_27":146},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_27":138},"e2d8ed05-cb8b-43ce-880d-2f6975613836","parentId","latest",["D",1789227872737],4,"label","superserve",[28],"146bfe6e-7ce8-423d-a89e-a21fe61a778a","README.md","e10eac30-956e-11f1-b4ac-1607ee4eb77e",7,["D",1789227619521],2,"# Superserve MCP OAuth Proxy\n\nVal Town/Deno OAuth facade for `https://mcp.superserve.ai`.\n\nInstead of putting a Superserve API key in the URL, MCP clients connect to the Val normally and complete an OAuth Authorization Code + PKCE flow:\n\n1. The MCP client receives `401` with OAuth Protected Resource Metadata discovery.\n2. It discovers `/authorize`, `/token`, and `/register` from the Authorization Server Metadata endpoint.\n3. `/authorize` displays a small page where the user enters their Superserve API key.\n4. The key is stored only in a short-lived, one-time authorization-code record (5 minutes) in the Val's scoped SQLite database.\n5. `/token` verifies PKCE, deletes the code, and returns the Superserve API key as the OAuth Bearer access token.\n6. The MCP client then sends `Authorization: Bearer ` on every request. The proxy forwards that header to Superserve.\n\nThe Superserve key is therefore never placed in a URL and is not retained in a long-lived token database by this proxy.\n\n## MCP OAuth endpoints\n\n- `/.well-known/oauth-protected-resource`\n- `/.well-known/oauth-authorization-server`\n- `/authorize`\n- `/token`\n- `/register` (Dynamic Client Registration compatibility)\n\nThe authorization server also advertises Client ID Metadata Document (CIMD) support for current MCP clients. PKCE `S256` is required.\n\n## MCP URL\n\nUse the Val's normal public URL, for example:\n\n`https://superserve.val.run/`\n\nNo `api_key` query parameter is needed.\n\n## Security notes\n\n- Superserve API keys are submitted in an HTTPS POST body, not a query string.\n- Authorization codes are one-time, SHA-256 hashed in storage, and expire after 5 minutes.\n- The underlying key is removed from scoped SQLite as soon as the code is redeemed.\n- OAuth access is still bearer-token security: protect the MCP client's stored OAuth token because it is the Superserve API key.\n\n## ChatGPT CIMD compatibility\n\nChatGPT's Client ID Metadata Document uses `private_key_jwt` at the token endpoint. The proxy advertises both `none` (for legacy/DCR public clients) and `private_key_jwt`. For CIMD clients using `private_key_jwt`, it fetches the client's HTTPS metadata and JWKS, verifies the RS256 assertion signature and validates `iss`, `sub`, `aud`, and `exp` before redeeming the authorization code.\n",[140],"2cb5e45e-b4a9-4914-9964-8544ee91c575",".gitignore","e1096144-956e-11f1-9504-1607ee4eb77e",1,["D",1786443887953],".env\nnode_modules/\n.DS_Store\n",[148],"pulls","branches","forks","envVars",{"_161":61,"_163":61},"connections",{"_161":61,"_162":61},"count","unfilledCount","emptyCount",{"_43":147,"_32":148,"_30":149,"_132":-5,"_41":42,"_40":150,"_133":123,"_38":174,"_13":61,"_33":20,"_35":152,"_24":25,"_136":-5,"_168":175,"_27":176},{"_43":139,"_32":140,"_30":141,"_132":-5,"_41":42,"_40":142,"_133":25,"_38":171,"_13":144,"_33":20,"_35":145,"_24":25,"_136":-5,"_168":172,"_27":173},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":167,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_168":169,"_27":170},["D",1789227872737],"children",[],[28],["D",1789227619521],[],[140],["D",1786443887953],[],[148],["D",1786443887569],["D",1789486866837],{"_98":97,"_105":101},{"_98":97,"_99":-5,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_125":215,"_216":217,"_218":219,"_220":25,"_221":25,"_222":25,"_223":123,"_224":-5,"_225":-7,"_226":-7,"_227":61,"_228":25,"_229":25,"_230":-5,"_231":25,"_232":25,"_233":25,"_234":-5},"ENV",{"_186":187,"_188":189,"_190":88,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v9