${opts.name}

\n${rows}\n

`;\n}\n",[19,70],"af1b6ff6-18a0-11f1-b33c-42dde27851f2","config.ts","ce052ce0-17d8-11f1-b9d8-42dde27851f2",10,["D",1772721383668],2,"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[19,77],"ce0556de-17d8-11f1-b9d8-42dde27851f2",["D",1772635536184],"directory",[19],{"_37":84,"_13":19,"_40":43,"_42":-5,"_44":45,"_46":81,"_48":49,"_50":100,"_17":66,"_53":86,"_55":-5,"_57":58,"_59":-5,"_97":101,"_18":102},{"_37":90,"_13":91,"_40":92,"_42":-5,"_44":45,"_46":93,"_48":49,"_50":94,"_17":64,"_53":95,"_55":96,"_57":58,"_59":14,"_97":98,"_18":99},"7d041da4-18a2-11f1-a4ec-42dde27851f2","http.ts","cdc80a5e-17d8-11f1-bdf7-42dde27851f2",12,["D",1772722158549],"http","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, DEMO_USER } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\nimport {\n register,\n validateSecret,\n validateRedirect,\n deriveAsClientIdFor,\n debugCreds,\n DEBUG_REDIRECT_URI,\n IDP_PREFIX,\n} from \"./shared/register.ts\";\n\nconst ID_JAG_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id-jag\";\nconst ID_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\";\nconst TOKEN_EXCHANGE_GRANT = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n\nconst kp = await getOrCreateKeypair(\"xaa_idp_signing_key_v1\");\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── OIDC discovery + JWKS ──────────────────────────────────────────────────\n\napp.get(\"/.well-known/openid-configuration\", (c) =>\n c.json({\n issuer: URLS.idp,\n authorization_endpoint: `${URLS.idp}/authorize`,\n token_endpoint: `${URLS.idp}/token`,\n jwks_uri: `${URLS.idp}/.well-known/jwks.json`,\n registration_endpoint: `${URLS.idp}/register`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"ES256\"],\n grant_types_supported: [\"authorization_code\", TOKEN_EXCHANGE_GRANT],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n// ─── /register — stateless HMAC derivation ──────────────────────────────────\n\napp.get(\"/register\", (c) =>\n c.html(`Register — IdP\n\n

Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // What client_id to stamp in the JAG. Depends on how the target AS models\n // clients — see AS_REGISTRY in register.ts.\n const asClientId = await deriveAsClientIdFor(audience, regUri, resource, clientId);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

\n`);\n});\n\napp.post(\"/authorize/grant\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const state = body.state as string | undefined;\n\n const code = await new jose.SignJWT({\n client_id: body.client_id as string,\n redirect_uri: redirectUri,\n code_challenge: body.code_challenge as string,\n email: DEMO_USER.email,\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(`${URLS.idp}/token`)\n .setSubject(DEMO_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const dest = new URL(redirectUri);\n dest.searchParams.set(\"code\", code);\n if (state) dest.searchParams.set(\"state\", state);\n return new Response(null, { status: 302, headers: { Location: dest.toString() } });\n});\n\n// ─── Debug — wide open ──────────────────────────────────────────────────────\n\napp.get(\"/debug/mint-id-token\", async (c) => {\n const { idp } = await debugCreds();\n return c.text(await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI));\n});\n\n// Full MCP_CONFORMANCE_SERVER_CONTEXT, ready to pipe into the scenario.\napp.get(\"/debug/context\", async (c) => {\n const { idp, as } = await debugCreds();\n const idToken = await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI);\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"IdP\",\n name: \"xaa-mcp-idp\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/openid-configuration\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"stateless — HMAC of your redirect_uri\" },\n { method: \"GET\", path: \"/authorize\", note: \"one-click demo login\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + token-exchange\" },\n { method: \"GET\", path: \"/debug/mint-id-token\", note: \"skip login entirely\" },\n { method: \"GET\", path: \"/debug/context\", note: \"full MCP_CONFORMANCE_SERVER_CONTEXT\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3001 }, app.fetch);\n","children",[],[91],["D",1772635536184],[103,104,105,106],[19],{"_37":76,"_13":77,"_40":78,"_42":43,"_44":45,"_46":79,"_48":49,"_50":116,"_17":81,"_53":54,"_55":82,"_57":58,"_59":-5,"_97":117,"_18":118},{"_37":69,"_13":70,"_40":71,"_42":43,"_44":45,"_46":72,"_48":49,"_50":113,"_17":66,"_53":54,"_55":74,"_57":58,"_59":-5,"_97":114,"_18":115},{"_37":61,"_13":62,"_40":63,"_42":43,"_44":45,"_46":64,"_48":49,"_50":110,"_17":66,"_53":54,"_55":67,"_57":58,"_59":-5,"_97":111,"_18":112},{"_37":38,"_13":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":107,"_17":52,"_53":54,"_55":56,"_57":58,"_59":-5,"_97":108,"_18":109},["D",1774975700609],[],[19,39],["D",1772635536555],[],[19,62],["D",1772635536998],[],[19,70],["D",1772721383668],[],[19,77],"cd909aba-17d8-11f1-9aee-42dde27851f2",["D",1772635535432],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_171":167},"org",{"_11":12,"_165":-5,"_166":167,"_128":129,"_168":169,"_170":58},"branch",{"_17":47,"_13":16,"_37":45,"_157":119,"_158":-5,"_159":-5,"_160":-5,"_161":-5,"_162":-5,"_163":14,"_164":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_37":119,"_13":14,"_50":228,"_121":-5,"_122":58,"_123":124,"_125":124,"_126":-5,"_127":-5,"_128":129,"_130":-5,"_131":58,"_132":-5,"_133":-5,"_134":66,"_135":136,"_137":-5,"_138":-5,"_139":-5,"_140":-5,"_141":142,"_143":142,"_144":145,"_146":145,"_147":145,"_148":142,"_149":142,"_150":229,"_152":230,"_154":231,"_156":58},[210,215],"files",[210,211,212,213,214,215],"counts",{"_200":66,"_201":202,"_203":66,"_32":204,"_205":206},[192,193,194,195],{"_37":84,"_13":19,"_40":43,"_42":-5,"_44":45,"_46":81,"_48":49,"_50":85,"_17":66,"_53":86,"_55":-5,"_57":58,"_59":-5,"_18":191},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],{"_37":76,"_13":77,"_40":78,"_42":43,"_44":45,"_46":79,"_48":49,"_50":80,"_17":81,"_53":54,"_55":82,"_57":58,"_59":-5,"_18":199},{"_37":69,"_13":70,"_40":71,"_42":43,"_44":45,"_46":72,"_48":49,"_50":73,"_17":66,"_53":54,"_55":74,"_57":58,"_59":-5,"_18":198},{"_37":61,"_13":62,"_40":63,"_42":43,"_44":45,"_46":64,"_48":49,"_50":65,"_17":66,"_53":54,"_55":67,"_57":58,"_59":-5,"_18":197},{"_37":38,"_13":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_17":52,"_53":54,"_55":56,"_57":58,"_59":-5,"_18":196},[19,39],[19,62],[19,70],[19,77],"pulls","branches",1,"forks",{"_207":66,"_209":66},"connections",{"_207":66,"_208":66},"count","unfilledCount","emptyCount",{"_37":84,"_13":19,"_40":43,"_42":-5,"_44":45,"_46":81,"_48":49,"_50":100,"_17":66,"_53":86,"_55":-5,"_57":58,"_59":-5,"_97":226,"_18":227},{"_37":76,"_13":77,"_40":78,"_42":43,"_44":45,"_46":79,"_48":49,"_50":116,"_17":81,"_53":54,"_55":82,"_57":58,"_59":-5,"_97":224,"_18":225},{"_37":69,"_13":70,"_40":71,"_42":43,"_44":45,"_46":72,"_48":49,"_50":113,"_17":66,"_53":54,"_55":74,"_57":58,"_59":-5,"_97":222,"_18":223},{"_37":61,"_13":62,"_40":63,"_42":43,"_44":45,"_46":64,"_48":49,"_50":110,"_17":66,"_53":54,"_55":67,"_57":58,"_59":-5,"_97":220,"_18":221},{"_37":38,"_13":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":107,"_17":52,"_53":54,"_55":56,"_57":58,"_59":-5,"_97":218,"_18":219},{"_37":90,"_13":91,"_40":92,"_42":-5,"_44":45,"_46":93,"_48":49,"_50":94,"_17":64,"_53":95,"_55":96,"_57":58,"_59":14,"_97":216,"_18":217},[],[91],[],[19,39],[],[19,62],[],[19,70],[],[19,77],[211,212,213,214],[19],["D",1772635535432],{"_11":12,"_171":167},{"_11":12,"_165":-5,"_166":167,"_128":129,"_168":169,"_170":58},{"_17":47,"_13":16,"_37":45,"_157":119,"_158":-5,"_159":-5,"_160":-5,"_161":-5,"_162":-5,"_163":14,"_164":12},"ctx",{"_150":-5,"_188":265,"_266":267,"_268":269,"_270":58,"_271":58,"_272":58,"_273":49,"_274":-5,"_275":-7,"_276":-7,"_277":66,"_278":58,"_279":58,"_280":-5,"_281":58,"_282":58,"_283":58,"_284":-5},"ENV",{"_236":237,"_238":239,"_240":16,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]