[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_189":190,"_191":192},"routes/_app.x.$handle.$name",{"_93":92,"_31":44,"_101":83,"_26":102,"_13":14,"_103":-5,"_11":104,"_105":106,"_107":108,"_109":110,"_111":112,"_20":-5,"_113":-5,"_114":-5,"_115":24,"_116":117,"_118":119,"_120":-5,"_121":-5,"_122":123},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":-5,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":76,"_77":78,"_79":80,"_81":24},"version",4,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","shared/html.ts","latestPath","fileId","cfb6c184-17d8-11f1-a079-42dde27851f2","name","html.ts","fileType","script","content","/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n","createdAt",["D",1772635539035],"branchVersion","branchId","ceb2ecb8-17d8-11f1-afa2-42dde27851f2","id","ceb226d4-17d8-11f1-afa2-42dde27851f2","xaa-mcp-as",["D",1772635537332],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_93":92,"_100":96},"org",{"_93":92,"_94":-5,"_95":96,"_18":53,"_97":98,"_99":24},"branch",{"_13":82,"_31":83,"_42":41,"_84":43,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":44,"_91":92},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":185,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":-5,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":186,"_77":187,"_79":188,"_81":24},"tree",[154,158],"files",[154,155,156,157,158],"counts",{"_144":59,"_145":130,"_146":59,"_147":148,"_149":150},"contents",[124,125],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_42":137,"_31":138,"_29":139,"_129":-5,"_40":41,"_39":140,"_131":119,"_37":141,"_13":59,"_33":142,"_35":-5,"_23":24,"_135":-5,"_26":143},{"_42":126,"_31":127,"_29":128,"_129":-5,"_40":41,"_39":130,"_131":24,"_37":132,"_13":59,"_33":133,"_35":134,"_23":24,"_135":44,"_26":136},"cee9ae6a-17d8-11f1-881f-42dde27851f2","http.ts","cee9af46-17d8-11f1-881f-42dde27851f2","parentId",1,"latest",["D",1772635537685],"http","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, AS_CLIENT_ID, AS_CLIENT_SECRET, RS_RESOURCE } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\n\nconst JWT_BEARER_GRANT = \"urn:ietf:params:oauth:grant-type:jwt-bearer\";\nconst ID_JAG_TYP = \"oauth-id-jag+jwt\";\n\nconst kp = await getOrCreateKeypair(\"xaa_as_signing_key_v1\");\nconst idpJwks = jose.createRemoteJWKSet(new URL(`${URLS.idp}/.well-known/jwks.json`));\n\nconst app = new Hono();\n\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// RFC 8414 Authorization Server Metadata.\n// authorization_endpoint + response_types_supported are schema-required by the\n// SDK's OAuthMetadataSchema even though XAA never hits /authorize on the AS —\n// point them at the IdP so the Zod parse passes.\napp.get(\"/.well-known/oauth-authorization-server\", (c) => {\n return c.json({\n issuer: URLS.as,\n token_endpoint: `${URLS.as}/token`,\n authorization_endpoint: `${URLS.idp}/authorize`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"urn:ietf:params:oauth:grant-type:jwt-bearer\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n });\n});\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n/**\n * RFC 7523 JWT Bearer Grant: ID-JAG → access_token.\n *\n * Validation order follows the Okta reference (jwt-authorization-grant.js):\n * client auth → typ → sig (against IdP JWKS) → iss → aud → client_id → clock.\n * jose.jwtVerify handles exp/iat for us.\n */\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({ error: \"unsupported_grant_type\", error_description: String(body.grant_type) }, 400);\n }\n\n // 1. Client auth — accept both basic and post, we advertise both\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n if (clientId !== AS_CLIENT_ID || clientSecret !== AS_CLIENT_SECRET) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({ error: \"invalid_request\", error_description: \"missing assertion\" }, 400);\n }\n\n // 2. typ header before sig — cheap fail-fast\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== ID_JAG_TYP) {\n return c.json({ error: \"invalid_grant\", error_description: `typ must be ${ID_JAG_TYP}, got ${header.typ}` }, 400);\n }\n\n // 3. sig + iss + aud + clock — all via jwtVerify against IdP's JWKS\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, idpJwks, {\n issuer: URLS.idp,\n audience: [URLS.as, `${URLS.as}/`], // trailing-slash tolerant\n clockTolerance: 30,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `ID-JAG verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // 4. client_id binding — the IdP says this JAG is for AS_CLIENT_ID, and\n // that must match who just authenticated with us\n if (claims.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG client_id (${claims.client_id}) does not match authenticating client (${clientId})`,\n }, 400);\n }\n\n // 5. Mint access token — JWT so the RS can verify it without calling back to us\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as)\n .setAudience(RS_RESOURCE)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n});\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"POST\", path: \"/token\", note: \"jwt-bearer\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3002 }, app.fetch);\n","label",[127],"cf428260-17d8-11f1-bb2f-42dde27851f2","shared","5422f8f4-5cde-4273-b6cd-78b8a6760435",2,["D",1772635538267],"directory",[138],"pulls","branches","forks","envVars",{"_151":59,"_153":59},"connections",{"_151":59,"_152":59},"count","unfilledCount","emptyCount",{"_42":137,"_31":138,"_29":139,"_129":-5,"_40":41,"_39":140,"_131":119,"_37":182,"_13":59,"_33":142,"_35":-5,"_23":24,"_135":-5,"_160":183,"_26":184},{"_42":175,"_31":176,"_29":177,"_129":139,"_40":41,"_39":140,"_131":24,"_37":178,"_13":59,"_33":34,"_35":179,"_23":24,"_135":-5,"_160":180,"_26":181},{"_42":171,"_31":32,"_29":30,"_129":139,"_40":41,"_39":14,"_131":24,"_37":172,"_13":59,"_33":34,"_35":36,"_23":24,"_135":-5,"_160":173,"_26":174},{"_42":163,"_31":164,"_29":165,"_129":139,"_40":41,"_39":166,"_131":119,"_37":167,"_13":59,"_33":34,"_35":168,"_23":24,"_135":-5,"_160":169,"_26":170},{"_42":126,"_31":127,"_29":128,"_129":-5,"_40":41,"_39":130,"_131":24,"_37":159,"_13":59,"_33":133,"_35":134,"_23":24,"_135":44,"_160":161,"_26":162},["D",1772635537685],"children",[],[127],"cf832f5e-17d8-11f1-b9d8-42dde27851f2","keys.ts","cf83303a-17d8-11f1-b9d8-42dde27851f2",3,["D",1772635538694],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[138,164],"cfb6c0e4-17d8-11f1-a079-42dde27851f2",["D",1772635539035],[],[138,32],"cf42593e-17d8-11f1-bb2f-42dde27851f2","config.ts","cf4259f2-17d8-11f1-bb2f-42dde27851f2",["D",1772635538267],"/**\n * Hardcoded wiring for the XAA demo stack.\n *\n * Two DISTINCT credential pairs — the IdP and the AS are separate trust\n * domains. The client registers separately with each. (xaa.dev uses one\n * cred for both, which is confusing; we don't.)\n */\n\n// Client's registration at the IdP — used for OIDC login + token-exchange\nexport const IDP_CLIENT_ID = \"claude-code-at-idp\";\nexport const IDP_CLIENT_SECRET = \"idp-secret-demo-only\";\n\n// Client's registration at the AS — used for jwt-bearer grant\nexport const AS_CLIENT_ID = \"claude-code-at-as\";\nexport const AS_CLIENT_SECRET = \"as-secret-demo-only\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n };\n\nexport const RS_RESOURCE = `${URLS.rs}/mcp`;\n",[],[138,176],["D",1772635538267],[155,156,157],[138],["D",1772635537332],{"_93":92,"_100":96},{"_93":92,"_94":-5,"_95":96,"_18":53,"_97":98,"_99":24},{"_13":82,"_31":83,"_42":41,"_84":43,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":44,"_91":92},"ctx",{"_75":-5,"_121":222,"_223":224,"_225":226,"_227":24,"_228":24,"_229":24,"_230":119,"_231":-5,"_232":-7,"_233":-7,"_234":59,"_235":24,"_236":24,"_237":-5,"_238":24,"_239":24,"_240":24,"_241":-5},"ENV",{"_193":194,"_195":196,"_197":83,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v4