[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_202":203,"_204":205},"routes/_app.x.$handle.$name",{"_95":94,"_32":46,"_103":85,"_27":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","shared/html.ts","latestPath","fileId","cfb6c184-17d8-11f1-a079-42dde27851f2","name","html.ts","fileType","script","content","/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n","/** Shared HTML templates. */\n\nconst esc = (s: string) => s.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n\n/**\n * Informational stub for an AS /authorize endpoint. XAA AS's are jwt-bearer\n * only — there is no interactive code flow — but SDK schema validation forces\n * us to advertise an authorization_endpoint. Rather than 404 or (worse) point\n * at the IdP's real /authorize, we land you here and explain.\n */\nexport function xaaAuthorizeStub(asUrl: string, query: Record): string {\n const rows = Object.entries(query)\n .map(([k, v]) => `${esc(k)}${esc(v)}`)\n .join(\"\");\n return `/authorize — not supported\n\n

This AS doesn't do `/authorize`

${esc(asUrl)} is an XAA (cross-app access) authorization server. It only supports\ngrant_type=urn:ietf:params:oauth:grant-type:jwt-bearer at\n/token — there's no interactive authorization-code flow.

The authorization_endpoint in our metadata exists only because some client schemas\nrequire the field. If your client redirected you here, it's trying to run a code flow against an\nAS that can't issue codes — check that it's using the jwt-bearer grant.

Request parameters received

\n${rows ? `${rows}

` : `

(none)

`}\n`;\n}\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n","createdAt",["D",1776093914640],"branchVersion","branchId","ceb2ecb8-17d8-11f1-afa2-42dde27851f2","id","ceb226d4-17d8-11f1-afa2-42dde27851f2","xaa-mcp-as",["D",1772635537332],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":98},"org",{"_95":94,"_96":-5,"_97":98,"_18":55,"_99":100,"_101":25},"branch",{"_13":84,"_32":85,"_44":43,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":46,"_93":94},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":198,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":199,"_79":200,"_81":201,"_83":25},"tree",[158,163],"files",[158,159,160,161,162,163],"counts",{"_147":61,"_148":149,"_150":61,"_151":152,"_153":154},"contents",[126,127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_44":140,"_32":141,"_30":142,"_131":-5,"_42":43,"_41":143,"_133":121,"_39":144,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_27":146},{"_44":128,"_32":129,"_30":130,"_131":-5,"_42":43,"_41":132,"_133":121,"_39":134,"_13":135,"_34":136,"_36":137,"_24":25,"_138":46,"_27":139},"f7c63c7a-374c-11f1-9eca-42b51c65c3df","http.ts","cee9af46-17d8-11f1-881f-42dde27851f2","parentId",12,"latest",["D",1776093913904],3,"http","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage, xaaAuthorizeStub } from \"./shared/html.ts\";\nimport { register, validateSecret, AS_PREFIX } from \"./shared/register.ts\";\n\nconst JWT_BEARER_GRANT = \"urn:ietf:params:oauth:grant-type:jwt-bearer\";\nconst ID_JAG_TYP = \"oauth-id-jag+jwt\";\n\nconst kp = await getOrCreateKeypair(\"xaa_as_signing_key_v1\");\nconst idpJwks = jose.createRemoteJWKSet(new URL(`${URLS.idp}/.well-known/jwks.json`));\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── Metadata + JWKS ────────────────────────────────────────────────────────\n// authorization_endpoint + response_types_supported are SDK-schema-required\n// even though XAA never hits /authorize on the AS. We point at our own\n// informational stub rather than the IdP — sending a client to the IdP's real\n// /authorize is actively misleading.\n\napp.get(\"/.well-known/oauth-authorization-server\", (c) =>\n c.json({\n issuer: URLS.as,\n token_endpoint: `${URLS.as}/token`,\n authorization_endpoint: `${URLS.as}/authorize`,\n registration_endpoint: `${URLS.as}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [JWT_BEARER_GRANT],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\napp.get(\"/authorize\", (c) => c.html(xaaAuthorizeStub(URLS.as, c.req.query()), 400));\n\n// ─── /register ──────────────────────────────────────────────────────────────\n// Per-resource: you get a distinct client_id for each MCP server this AS\n// fronts. The binding key (your IdP redirect URI) + the resource URL are the\n// two inputs the IdP also has at token-exchange time, so it derives the same\n// client_id we do here.\n\nconst RESOURCES = [`${URLS.rs}/mcp`, `${URLS.cal}/mcp`];\n\napp.get(\"/register\", (c) =>\n c.html(`Register — AS\n\n

Register at the AS

One registration per resource. The binding key is your IdP redirect URI — same value you registered there. jwt-bearer never actually redirects; the URI is just the shared identifier the IdP uses to re-derive your client_id here.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const resource = body.resource as string;\n if (!redirectUri || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"redirect_uri and resource required\" }, 400);\n }\n return c.json(await register(AS_PREFIX, URLS.as, redirectUri, resource));\n});\n\n// ─── /token — jwt-bearer ────────────────────────────────────────────────────\n// Validation order: client auth → typ → sig via IdP JWKS → iss/aud/clock →\n// client_id binding. Then mint an access-JWT aud-bound to the ID-JAG's\n// `resource` claim (not a hardcoded RS — we front multiple resources).\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({ error: \"unsupported_grant_type\", error_description: String(body.grant_type) }, 400);\n }\n\n // Client auth — basic or post\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n if (!clientId || !clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({ error: \"invalid_request\", error_description: \"missing assertion\" }, 400);\n }\n\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== ID_JAG_TYP) {\n return c.json({ error: \"invalid_grant\", error_description: `typ must be ${ID_JAG_TYP}, got ${header.typ}` }, 400);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, idpJwks, {\n issuer: URLS.idp,\n audience: [URLS.as, `${URLS.as}/`],\n clockTolerance: 30,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `ID-JAG verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // The IdP put your AS client_id in here. If it doesn't match who you\n // authenticated as just now, something's off.\n if (claims.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG client_id (${claims.client_id}) does not match authenticating client (${clientId})`,\n }, 400);\n }\n\n const resource = claims.resource as string;\n if (!resource) {\n return c.json({ error: \"invalid_grant\", error_description: \"ID-JAG missing resource claim\" }, 400);\n }\n\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as)\n .setAudience(resource)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({ access_token: accessToken, token_type: \"Bearer\", expires_in: 3600 });\n});\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/authorize\", note: \"stub — XAA is jwt-bearer only\" },\n { method: \"GET\", path: \"/register\", note: \"same redirect_uri as at the IdP\" },\n { method: \"POST\", path: \"/token\", note: \"jwt-bearer\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3002 }, app.fetch);\n","label",[129],"cf428260-17d8-11f1-bb2f-42dde27851f2","shared","5422f8f4-5cde-4273-b6cd-78b8a6760435",2,["D",1772635538267],"directory",[141],"pulls","branches",1,"forks","envVars",{"_155":61,"_157":61},"connections",{"_155":61,"_156":61},"count","unfilledCount","emptyCount",{"_44":140,"_32":141,"_30":142,"_131":-5,"_42":43,"_41":143,"_133":121,"_39":195,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_165":196,"_27":197},{"_44":187,"_32":188,"_30":189,"_131":142,"_42":43,"_41":190,"_133":121,"_39":191,"_13":135,"_34":35,"_36":192,"_24":25,"_138":-5,"_165":193,"_27":194},{"_44":183,"_32":33,"_30":31,"_131":142,"_42":43,"_41":14,"_133":121,"_39":184,"_13":149,"_34":35,"_36":38,"_24":25,"_138":-5,"_165":185,"_27":186},{"_44":176,"_32":177,"_30":178,"_131":142,"_42":43,"_41":135,"_133":121,"_39":179,"_13":61,"_34":35,"_36":180,"_24":25,"_138":-5,"_165":181,"_27":182},{"_44":168,"_32":169,"_30":170,"_131":142,"_42":43,"_41":171,"_133":25,"_39":172,"_13":143,"_34":35,"_36":173,"_24":25,"_138":-5,"_165":174,"_27":175},{"_44":128,"_32":129,"_30":130,"_131":-5,"_42":43,"_41":132,"_133":121,"_39":164,"_13":135,"_34":136,"_36":137,"_24":25,"_138":46,"_165":166,"_27":167},["D",1776093913904],"children",[],[129],"b0b8997e-18a0-11f1-8e71-42dde27851f2","register.ts","ba432452-17e0-11f1-8843-42dde27851f2",11,["D",1772721386377],"/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\nexport const AS2_PREFIX = \"as2\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\", enc.encode(KEY), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(prefix: string, issuer: string, redirectUri: string, resource = \"\"): Promise {\n return `${prefix}_id_${(await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)}`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(prefix: string, issuer: string, redirectUri: string, resource = \"\") {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return { client_id, client_secret, redirect_uri: redirectUri, ...(resource && { resource }) };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(clientId: string, clientSecret: string): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(prefix: string, issuer: string, clientId: string, redirectUri: string): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"app<>app\" derivation. At token-exchange the demo IdP knows:\n * reg_uri (from id_token), audience (= AS issuer), resource (MCP URL).\n *\n * Different ASes key differently:\n * - as1: binding key is the client's redirect_uri (matches as.ts /register)\n * - as2: binding key is the IdP's own issuer URL (matches as2.ts /register) —\n * the demo IdP stamps its own identity as the binding, which is exactly\n * what as2 re-derives from JAG.iss at /token.\n */\nconst AS_REGISTRY: Record = {\n [URLS.as]: { prefix: AS_PREFIX, binding: \"redirect_uri\" },\n [URLS.as2]: { prefix: AS2_PREFIX, binding: \"idp_issuer\" },\n};\n\nexport async function deriveAsClientIdFor(asIssuer: string, redirectUri: string, resource: string): Promise {\n const spec = AS_REGISTRY[asIssuer] ?? AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n const bindingKey = spec.binding === \"idp_issuer\" ? URLS.idp : redirectUri;\n return deriveClientId(spec.prefix, asIssuer, bindingKey, resource);\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS_PREFIX, URLS.as, DEBUG_REDIRECT_URI, `${URLS.rs}/mcp`);\n return { idp, as };\n}\n\n/** Creds for conformance against as2 via the demo IdP. Binding key = IdP issuer. */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS2_PREFIX, URLS.as2, URLS.idp, `${URLS.rs2}/mcp`);\n return { idp, as };\n}\n",[],[141,169],"cf832f5e-17d8-11f1-b9d8-42dde27851f2","keys.ts","cf83303a-17d8-11f1-b9d8-42dde27851f2",["D",1772635538694],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[141,177],"f835b500-374c-11f1-b880-42b51c65c3df",["D",1776093914640],[],[141,33],"f7e811ba-374c-11f1-a430-42b51c65c3df","config.ts","cf4259f2-17d8-11f1-bb2f-42dde27851f2",13,["D",1776093914123],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[141,188],["D",1772635538267],[159,160,161,162],[141],["D",1772635537332],{"_95":94,"_102":98},{"_95":94,"_96":-5,"_97":98,"_18":55,"_99":100,"_101":25},{"_13":84,"_32":85,"_44":43,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":46,"_93":94},"ctx",{"_77":-5,"_123":235,"_236":237,"_238":239,"_240":25,"_241":25,"_242":25,"_243":121,"_244":-5,"_245":-7,"_246":-7,"_247":61,"_248":25,"_249":25,"_250":-5,"_251":25,"_252":25,"_253":25,"_254":-5},"ENV",{"_206":207,"_208":209,"_210":85,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

${opts.name}

This AS doesn't do /authorize

Request parameters received

${opts.name}

Register at the AS

This AS doesn't do `/authorize`

Diff · v14