[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_218":219,"_220":221},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_164":-5,"_20":165,"_22":166,"_167":168,"_169":170,"_25":171,"_24":-5,"_172":-5,"_173":-5,"_174":54,"_175":176,"_177":45,"_178":-5,"_179":-5,"_180":181},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","pcarleton","name","xaa-mcp-idp","branchName","main","version","path","","project",{"_34":111,"_13":14,"_46":112,"_113":-5,"_114":54,"_115":116,"_117":116,"_118":-5,"_119":-5,"_120":121,"_122":-5,"_123":54,"_124":-5,"_125":-5,"_126":62,"_127":128,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":134,"_135":134,"_136":137,"_138":137,"_139":137,"_140":134,"_141":134,"_142":143,"_144":145,"_146":147,"_148":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":63,"_51":-5,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_18":56},"id","7d041da4-18a2-11f1-a4ec-42dde27851f2","http.ts","fileId","cdc80a5e-17d8-11f1-bdf7-42dde27851f2","parentId","branchId","cd910fae-17d8-11f1-9aee-42dde27851f2","branchVersion",12,"latest",true,"createdAt",["D",1772722158549],3,"fileType","http","content","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, DEMO_USER } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\nimport {\n register,\n validateSecret,\n validateRedirect,\n deriveAsClientIdFor,\n debugCreds,\n DEBUG_REDIRECT_URI,\n IDP_PREFIX,\n} from \"./shared/register.ts\";\n\nconst ID_JAG_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id-jag\";\nconst ID_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\";\nconst TOKEN_EXCHANGE_GRANT = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n\nconst kp = await getOrCreateKeypair(\"xaa_idp_signing_key_v1\");\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── OIDC discovery + JWKS ──────────────────────────────────────────────────\n\napp.get(\"/.well-known/openid-configuration\", (c) =>\n c.json({\n issuer: URLS.idp,\n authorization_endpoint: `${URLS.idp}/authorize`,\n token_endpoint: `${URLS.idp}/token`,\n jwks_uri: `${URLS.idp}/.well-known/jwks.json`,\n registration_endpoint: `${URLS.idp}/register`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"ES256\"],\n grant_types_supported: [\"authorization_code\", TOKEN_EXCHANGE_GRANT],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n// ─── /register — stateless HMAC derivation ──────────────────────────────────\n\napp.get(\"/register\", (c) =>\n c.html(`Register — IdP\n\n

Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // What client_id to stamp in the JAG. Depends on how the target AS models\n // clients — see AS_REGISTRY in register.ts.\n const asClientId = await deriveAsClientIdFor(audience, regUri, resource, clientId);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

\n`);\n});\n\napp.post(\"/authorize/grant\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const state = body.state as string | undefined;\n\n const code = await new jose.SignJWT({\n client_id: body.client_id as string,\n redirect_uri: redirectUri,\n code_challenge: body.code_challenge as string,\n email: DEMO_USER.email,\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(`${URLS.idp}/token`)\n .setSubject(DEMO_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const dest = new URL(redirectUri);\n dest.searchParams.set(\"code\", code);\n if (state) dest.searchParams.set(\"state\", state);\n return new Response(null, { status: 302, headers: { Location: dest.toString() } });\n});\n\n// ─── Debug — wide open ──────────────────────────────────────────────────────\n\napp.get(\"/debug/mint-id-token\", async (c) => {\n const { idp } = await debugCreds();\n return c.text(await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI));\n});\n\n// Full MCP_CONFORMANCE_SERVER_CONTEXT, ready to pipe into the scenario.\napp.get(\"/debug/context\", async (c) => {\n const { idp, as } = await debugCreds();\n const idToken = await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI);\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"IdP\",\n name: \"xaa-mcp-idp\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/openid-configuration\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"stateless — HMAC of your redirect_uri\" },\n { method: \"GET\", path: \"/authorize\", note: \"one-click demo login\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + token-exchange\" },\n { method: \"GET\", path: \"/debug/mint-id-token\", note: \"skip login entirely\" },\n { method: \"GET\", path: \"/debug/context\", note: \"full MCP_CONFORMANCE_SERVER_CONTEXT\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3001 }, app.fetch);\n","deleted",false,"label",[36],"ce0556de-17d8-11f1-b9d8-42dde27851f2","shared","967e5590-cb60-46bf-9ab1-7f13875f622b",2,["D",1772635536184],0,"directory",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":63,"_51":-5,"_53":54,"_55":-5,"_68":72,"_18":73},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_68":69,"_18":70},["D",1772722158549],"children",[],[36],["D",1772635536184],[74,75,76,77],[58],{"_34":103,"_13":104,"_37":105,"_39":59,"_40":41,"_42":106,"_44":45,"_46":107,"_17":60,"_49":84,"_51":108,"_53":54,"_55":-5,"_68":109,"_18":110},{"_34":95,"_13":96,"_37":97,"_39":59,"_40":41,"_42":98,"_44":45,"_46":99,"_17":62,"_49":84,"_51":100,"_53":54,"_55":-5,"_68":101,"_18":102},{"_34":88,"_13":89,"_37":90,"_39":59,"_40":41,"_42":48,"_44":45,"_46":91,"_17":62,"_49":84,"_51":92,"_53":54,"_55":-5,"_68":93,"_18":94},{"_34":78,"_13":79,"_37":80,"_39":59,"_40":41,"_42":81,"_44":45,"_46":82,"_17":83,"_49":84,"_51":85,"_53":54,"_55":-5,"_68":86,"_18":87},"6cb608f2-2d21-11f1-a835-42dde27851f2","register.ts","b95a3062-17e0-11f1-968a-42dde27851f2",15,["D",1774975700609],5,"script","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\",\n enc.encode(KEY),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(\n prefix: string,\n issuer: string,\n redirectUri: string,\n resource = \"\",\n): Promise {\n return `${prefix}_id_${\n (await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)\n }`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(\n prefix: string,\n issuer: string,\n redirectUri: string,\n resource = \"\",\n) {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return {\n client_id,\n client_secret,\n redirect_uri: redirectUri,\n ...(resource && { resource }),\n };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(\n clientId: string,\n clientSecret: string,\n): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(\n prefix: string,\n issuer: string,\n clientId: string,\n redirectUri: string,\n): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"what client_id do I stamp in the JAG\" decision. Depends on how\n * the target AS models clients:\n *\n * - as1: AS mints its own IDs. IdP re-derives by running the same HMAC\n * the AS ran at /register, keyed on the client's redirect_uri.\n *\n * - as2: Client brings their own ID — whatever their IdP knows them as.\n * (Matches Okta's model: the catalog app stamps its own Okta client_id.)\n * The demo IdP plays along by stamping the requester's IdP client_id,\n * which it has right there in the token-exchange request body. The AS\n * never re-derives the id; it re-derives the *secret*, which is bound\n * to (iss, client_id, resource).\n */\nconst AS_REGISTRY: Record<\n string,\n { mode: \"derive\"; prefix: string } | { mode: \"passthrough\" }\n> = {\n [URLS.as]: { mode: \"derive\", prefix: AS_PREFIX },\n [URLS.as2]: { mode: \"passthrough\" },\n \"https://api.local.figma.engineering:8443\": { mode: \"passthrough\" },\n \"https://api.staging.figma.com\": { mode: \"passthrough\" },\n \"https://api.figma.com\": { mode: \"passthrough\" },\n};\n\nexport async function deriveAsClientIdFor(\n asIssuer: string,\n redirectUri: string,\n resource: string,\n requesterClientId: string,\n): Promise {\n const spec = AS_REGISTRY[asIssuer] ??\n AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n if (spec.mode === \"passthrough\") return requesterClientId;\n return deriveClientId(spec.prefix, asIssuer, redirectUri, resource);\n}\n\n/**\n * as2 secret derivation. Binds the secret to the full (issuer, client_id,\n * resource) tuple — the secret IS the trust decision. The client_id is\n * IdP-controlled (whatever Okta stamps); the secret is us-controlled.\n */\nexport async function deriveAs2Secret(\n idpIssuer: string,\n clientId: string,\n resource: string,\n): Promise {\n return `as2_sec_${\n (await hmacHex(`${idpIssuer}|${clientId}|${resource}`)).slice(0, 16)\n }`;\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(\n AS_PREFIX,\n URLS.as,\n DEBUG_REDIRECT_URI,\n `${URLS.rs}/mcp`,\n );\n return { idp, as };\n}\n\n/**\n * Creds for conformance against as2 via the demo IdP. The AS client_id IS the\n * IdP client_id (that's what the demo IdP stamps in the JAG — passthrough mode).\n */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = {\n client_id: idp.client_id,\n client_secret: await deriveAs2Secret(\n URLS.idp,\n idp.client_id,\n `${URLS.rs2}/mcp`,\n ),\n };\n return { idp, as };\n}",[],[58,79],"ce3ca81e-17d8-11f1-a7f9-42dde27851f2","keys.ts","ce3ca90e-17d8-11f1-a7f9-42dde27851f2",["D",1772635536555],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[58,89],"ce9b360e-17d8-11f1-a7d4-42dde27851f2","html.ts","ce9b38ac-17d8-11f1-a7d4-42dde27851f2",4,["D",1772635536998],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[58,96],"af1b6ff6-18a0-11f1-b33c-42dde27851f2","config.ts","ce052ce0-17d8-11f1-b9d8-42dde27851f2",10,["D",1772721383668],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[58,104],"cd909aba-17d8-11f1-9aee-42dde27851f2",["D",1772635535432],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_163":159},"org",{"_11":12,"_157":-5,"_158":159,"_120":121,"_160":161,"_162":54},"branch",{"_17":81,"_13":16,"_34":41,"_149":111,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":14,"_156":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":111,"_13":14,"_46":214,"_113":-5,"_114":54,"_115":116,"_117":116,"_118":-5,"_119":-5,"_120":121,"_122":-5,"_123":54,"_124":-5,"_125":-5,"_126":62,"_127":128,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":134,"_135":134,"_136":137,"_138":137,"_139":137,"_140":134,"_141":134,"_142":215,"_144":216,"_146":217,"_148":54},[196,201],"files",[196,197,198,199,200,201],"counts",{"_186":62,"_187":188,"_189":62,"_31":190,"_191":192},[182,183],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":63,"_51":-5,"_53":54,"_55":-5,"_18":185},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_18":184},[36],[58],"pulls","branches",1,"forks",{"_193":62,"_195":62},"connections",{"_193":62,"_194":62},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":63,"_51":-5,"_53":54,"_55":-5,"_68":212,"_18":213},{"_34":103,"_13":104,"_37":105,"_39":59,"_40":41,"_42":106,"_44":45,"_46":107,"_17":60,"_49":84,"_51":108,"_53":54,"_55":-5,"_68":210,"_18":211},{"_34":95,"_13":96,"_37":97,"_39":59,"_40":41,"_42":98,"_44":45,"_46":99,"_17":62,"_49":84,"_51":100,"_53":54,"_55":-5,"_68":208,"_18":209},{"_34":88,"_13":89,"_37":90,"_39":59,"_40":41,"_42":48,"_44":45,"_46":91,"_17":62,"_49":84,"_51":92,"_53":54,"_55":-5,"_68":206,"_18":207},{"_34":78,"_13":79,"_37":80,"_39":59,"_40":41,"_42":81,"_44":45,"_46":82,"_17":83,"_49":84,"_51":85,"_53":54,"_55":-5,"_68":204,"_18":205},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":14,"_68":202,"_18":203},[],[36],[],[58,79],[],[58,89],[],[58,96],[],[58,104],[197,198,199,200],[58],["D",1772635535432],{"_11":12,"_163":159},{"_11":12,"_157":-5,"_158":159,"_120":121,"_160":161,"_162":54},{"_17":81,"_13":16,"_34":41,"_149":111,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":14,"_156":12},"ctx",{"_142":-5,"_179":251,"_252":253,"_254":255,"_256":54,"_257":54,"_258":54,"_259":45,"_260":-5,"_261":-7,"_262":-7,"_263":62,"_264":54,"_265":54,"_266":-5,"_267":54,"_268":54,"_269":54,"_270":-5},"ENV",{"_222":223,"_224":225,"_226":16,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]