Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // What client_id to stamp in the JAG. Depends on how the target AS models\n // clients — see AS_REGISTRY in register.ts.\n const asClientId = await deriveAsClientIdFor(audience, regUri, resource, clientId);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

\n`);\n});\n\napp.post(\"/authorize/grant\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const state = body.state as string | undefined;\n\n const code = await new jose.SignJWT({\n client_id: body.client_id as string,\n redirect_uri: redirectUri,\n code_challenge: body.code_challenge as string,\n email: DEMO_USER.email,\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(`${URLS.idp}/token`)\n .setSubject(DEMO_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const dest = new URL(redirectUri);\n dest.searchParams.set(\"code\", code);\n if (state) dest.searchParams.set(\"state\", state);\n return new Response(null, { status: 302, headers: { Location: dest.toString() } });\n});\n\n// ─── Debug — wide open ──────────────────────────────────────────────────────\n\napp.get(\"/debug/mint-id-token\", async (c) => {\n const { idp } = await debugCreds();\n return c.text(await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI));\n});\n\n// Full MCP_CONFORMANCE_SERVER_CONTEXT, ready to pipe into the scenario.\napp.get(\"/debug/context\", async (c) => {\n const { idp, as } = await debugCreds();\n const idToken = await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI);\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"IdP\",\n name: \"xaa-mcp-idp\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/openid-configuration\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"stateless — HMAC of your redirect_uri\" },\n { method: \"GET\", path: \"/authorize\", note: \"one-click demo login\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + token-exchange\" },\n { method: \"GET\", path: \"/debug/mint-id-token\", note: \"skip login entirely\" },\n { method: \"GET\", path: \"/debug/context\", note: \"full MCP_CONFORMANCE_SERVER_CONTEXT\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3001 }, app.fetch);\n","deleted","label","children",[],"path",[46],"6cb608f2-2d21-11f1-a835-42dde27851f2","register.ts","b95a3062-17e0-11f1-968a-42dde27851f2","967e5590-cb60-46bf-9ab1-7f13875f622b",15,["D",1774975700609],5,"script","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\",\n enc.encode(KEY),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(\n prefix: string,\n issuer: string,\n redirectUri: string,\n resource = \"\",\n): Promise {\n return `${prefix}_id_${\n (await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)\n }`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(\n prefix: string,\n issuer: string,\n redirectUri: string,\n resource = \"\",\n) {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return {\n client_id,\n client_secret,\n redirect_uri: redirectUri,\n ...(resource && { resource }),\n };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(\n clientId: string,\n clientSecret: string,\n): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(\n prefix: string,\n issuer: string,\n clientId: string,\n redirectUri: string,\n): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"what client_id do I stamp in the JAG\" decision. Depends on how\n * the target AS models clients:\n *\n * - as1: AS mints its own IDs. IdP re-derives by running the same HMAC\n * the AS ran at /register, keyed on the client's redirect_uri.\n *\n * - as2: Client brings their own ID — whatever their IdP knows them as.\n * (Matches Okta's model: the catalog app stamps its own Okta client_id.)\n * The demo IdP plays along by stamping the requester's IdP client_id,\n * which it has right there in the token-exchange request body. The AS\n * never re-derives the id; it re-derives the *secret*, which is bound\n * to (iss, client_id, resource).\n */\nconst AS_REGISTRY: Record<\n string,\n { mode: \"derive\"; prefix: string } | { mode: \"passthrough\" }\n> = {\n [URLS.as]: { mode: \"derive\", prefix: AS_PREFIX },\n [URLS.as2]: { mode: \"passthrough\" },\n \"https://api.local.figma.engineering:8443\": { mode: \"passthrough\" },\n \"https://api.staging.figma.com\": { mode: \"passthrough\" },\n \"https://api.figma.com\": { mode: \"passthrough\" },\n};\n\nexport async function deriveAsClientIdFor(\n asIssuer: string,\n redirectUri: string,\n resource: string,\n requesterClientId: string,\n): Promise {\n const spec = AS_REGISTRY[asIssuer] ??\n AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n if (spec.mode === \"passthrough\") return requesterClientId;\n return deriveClientId(spec.prefix, asIssuer, redirectUri, resource);\n}\n\n/**\n * as2 secret derivation. Binds the secret to the full (issuer, client_id,\n * resource) tuple — the secret IS the trust decision. The client_id is\n * IdP-controlled (whatever Okta stamps); the secret is us-controlled.\n */\nexport async function deriveAs2Secret(\n idpIssuer: string,\n clientId: string,\n resource: string,\n): Promise {\n return `as2_sec_${\n (await hmacHex(`${idpIssuer}|${clientId}|${resource}`)).slice(0, 16)\n }`;\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(\n AS_PREFIX,\n URLS.as,\n DEBUG_REDIRECT_URI,\n `${URLS.rs}/mcp`,\n );\n return { idp, as };\n}\n\n/**\n * Creds for conformance against as2 via the demo IdP. The AS client_id IS the\n * IdP client_id (that's what the demo IdP stamps in the JAG — passthrough mode).\n */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = {\n client_id: idp.client_id,\n client_secret: await deriveAs2Secret(\n URLS.idp,\n idp.client_id,\n `${URLS.rs2}/mcp`,\n ),\n };\n return { idp, as };\n}",[],[79,69],"shared","ce3ca81e-17d8-11f1-a7f9-42dde27851f2","keys.ts","ce3ca90e-17d8-11f1-a7f9-42dde27851f2",["D",1772635536555],0,"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[79,81],"ce9b360e-17d8-11f1-a7d4-42dde27851f2","html.ts","ce9b38ac-17d8-11f1-a7d4-42dde27851f2",4,["D",1772635536998],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[79,89],"af1b6ff6-18a0-11f1-b33c-42dde27851f2","config.ts","ce052ce0-17d8-11f1-b9d8-42dde27851f2",10,["D",1772721383668],2,"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[79,97],"ce0556de-17d8-11f1-b9d8-42dde27851f2",["D",1772635536184],"directory",[39,40,41,42],[79],{"_44":105,"_13":79,"_47":71,"_49":-5,"_50":51,"_52":101,"_54":34,"_55":114,"_16":84,"_58":107,"_60":-5,"_62":36,"_63":-5,"_66":115},{"_44":45,"_13":46,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":34,"_55":112,"_16":57,"_58":59,"_60":61,"_62":36,"_63":14,"_66":113},["D",1772722158549],[46],["D",1772635536184],[79],"pulls","branches",1,"forks","envVars",{"_124":84,"_126":84},"connections",{"_124":84,"_125":84},"count","unfilledCount","emptyCount","cd909aba-17d8-11f1-9aee-42dde27851f2",["D",1772635535432],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_180":176},"org",{"_11":12,"_174":-5,"_175":176,"_136":137,"_177":178,"_179":36},"branch",{"_16":72,"_13":165,"_44":51,"_166":127,"_167":-5,"_168":-5,"_169":-5,"_170":-5,"_171":-5,"_172":14,"_173":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","","adoptOrgId",{"_44":127,"_13":14,"_55":224,"_129":-5,"_130":36,"_131":132,"_133":132,"_134":-5,"_135":-5,"_136":137,"_138":-5,"_139":36,"_140":-5,"_141":-5,"_142":84,"_143":144,"_145":-5,"_146":-5,"_147":-5,"_148":-5,"_149":150,"_151":150,"_152":153,"_154":153,"_155":153,"_156":150,"_157":150,"_158":225,"_160":226,"_162":227,"_164":36},"tree",[206,211],[206,207,208,209,210,211],{"_116":84,"_117":118,"_119":84,"_120":204,"_122":205},[200,201],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":105,"_13":79,"_47":71,"_49":-5,"_50":51,"_52":101,"_54":34,"_55":114,"_16":84,"_58":107,"_60":-5,"_62":36,"_63":-5,"_66":203},{"_44":45,"_13":46,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":34,"_55":112,"_16":57,"_58":59,"_60":61,"_62":36,"_63":14,"_66":202},[46],[79],{"_124":84,"_126":84},{"_124":84,"_125":84},{"_44":105,"_13":79,"_47":71,"_49":-5,"_50":51,"_52":101,"_54":34,"_55":106,"_16":84,"_58":107,"_60":-5,"_62":36,"_63":-5,"_64":222,"_66":223},{"_44":96,"_13":97,"_47":98,"_49":71,"_50":51,"_52":99,"_54":34,"_55":100,"_16":101,"_58":75,"_60":102,"_62":36,"_63":-5,"_64":220,"_66":221},{"_44":88,"_13":89,"_47":90,"_49":71,"_50":51,"_52":91,"_54":34,"_55":92,"_16":84,"_58":75,"_60":93,"_62":36,"_63":-5,"_64":218,"_66":219},{"_44":80,"_13":81,"_47":82,"_49":71,"_50":51,"_52":57,"_54":34,"_55":83,"_16":84,"_58":75,"_60":85,"_62":36,"_63":-5,"_64":216,"_66":217},{"_44":68,"_13":69,"_47":70,"_49":71,"_50":51,"_52":72,"_54":34,"_55":73,"_16":74,"_58":75,"_60":76,"_62":36,"_63":-5,"_64":214,"_66":215},{"_44":45,"_13":46,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":34,"_55":56,"_16":57,"_58":59,"_60":61,"_62":36,"_63":14,"_64":212,"_66":213},[],[46],[],[79,69],[],[79,81],[],[79,89],[],[79,97],[207,208,209,210],[79],["D",1772635535432],{"_11":12,"_180":176},{"_11":12,"_174":-5,"_175":176,"_136":137,"_177":178,"_179":36},{"_16":72,"_13":165,"_44":51,"_166":127,"_167":-5,"_168":-5,"_169":-5,"_170":-5,"_171":-5,"_172":14,"_173":12},"ctx",{"_158":-5,"_197":261,"_262":263,"_264":265,"_266":36,"_267":36,"_268":36,"_269":34,"_270":-5,"_271":-7,"_272":-7,"_273":84,"_274":36,"_275":36,"_276":-5,"_277":36,"_278":36,"_279":36,"_280":-5},"ENV",{"_232":233,"_234":235,"_236":165,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

pcarleton

xaa-mcp-idp