[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_201":202,"_203":204},"routes/_app.x.$handle.$name",{"_94":93,"_32":45,"_102":84,"_27":103,"_13":14,"_104":-5,"_11":105,"_106":107,"_108":109,"_110":111,"_112":113,"_20":-5,"_114":-5,"_115":-5,"_116":25,"_117":118,"_119":120,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",12,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","http.ts","latestPath","fileId","cdc80a5e-17d8-11f1-bdf7-42dde27851f2","name","fileType","http","content","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, DEMO_USER } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\nimport {\n register,\n validateSecret,\n validateRedirect,\n deriveAsClientIdFor,\n debugCreds,\n DEBUG_REDIRECT_URI,\n IDP_PREFIX,\n} from \"./shared/register.ts\";\n\nconst ID_JAG_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id-jag\";\nconst ID_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\";\nconst TOKEN_EXCHANGE_GRANT = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n\nconst kp = await getOrCreateKeypair(\"xaa_idp_signing_key_v1\");\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── OIDC discovery + JWKS ──────────────────────────────────────────────────\n\napp.get(\"/.well-known/openid-configuration\", (c) =>\n c.json({\n issuer: URLS.idp,\n authorization_endpoint: `${URLS.idp}/authorize`,\n token_endpoint: `${URLS.idp}/token`,\n jwks_uri: `${URLS.idp}/.well-known/jwks.json`,\n registration_endpoint: `${URLS.idp}/register`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"ES256\"],\n grant_types_supported: [\"authorization_code\", TOKEN_EXCHANGE_GRANT],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n// ─── /register — stateless HMAC derivation ──────────────────────────────────\n\napp.get(\"/register\", (c) =>\n c.html(`Register — IdP\n\n

Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Derive the client's ID at the requested AS for the requested resource.\n // The AS derived this same value at /register given (reg_uri, resource).\n const asClientId = await deriveAsClientIdFor(audience, regUri, resource);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // What client_id to stamp in the JAG. Depends on how the target AS models\n // clients — see AS_REGISTRY in register.ts.\n const asClientId = await deriveAsClientIdFor(audience, regUri, resource, clientId);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

\n`);\n});\n\napp.post(\"/authorize/grant\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const state = body.state as string | undefined;\n\n const code = await new jose.SignJWT({\n client_id: body.client_id as string,\n redirect_uri: redirectUri,\n code_challenge: body.code_challenge as string,\n email: DEMO_USER.email,\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(`${URLS.idp}/token`)\n .setSubject(DEMO_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const dest = new URL(redirectUri);\n dest.searchParams.set(\"code\", code);\n if (state) dest.searchParams.set(\"state\", state);\n return new Response(null, { status: 302, headers: { Location: dest.toString() } });\n});\n\n// ─── Debug — wide open ──────────────────────────────────────────────────────\n\napp.get(\"/debug/mint-id-token\", async (c) => {\n const { idp } = await debugCreds();\n return c.text(await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI));\n});\n\n// Full MCP_CONFORMANCE_SERVER_CONTEXT, ready to pipe into the scenario.\napp.get(\"/debug/context\", async (c) => {\n const { idp, as } = await debugCreds();\n const idToken = await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI);\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"IdP\",\n name: \"xaa-mcp-idp\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/openid-configuration\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"stateless — HMAC of your redirect_uri\" },\n { method: \"GET\", path: \"/authorize\", note: \"one-click demo login\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + token-exchange\" },\n { method: \"GET\", path: \"/debug/mint-id-token\", note: \"skip login entirely\" },\n { method: \"GET\", path: \"/debug/context\", note: \"full MCP_CONFORMANCE_SERVER_CONTEXT\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3001 }, app.fetch);\n","createdAt",["D",1772722158549],"branchVersion","branchId","cd910fae-17d8-11f1-9aee-42dde27851f2","id","cd909aba-17d8-11f1-9aee-42dde27851f2","xaa-mcp-idp",["D",1772635535432],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_101":97},"org",{"_94":93,"_95":-5,"_96":97,"_18":54,"_98":99,"_100":25},"branch",{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":197,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":198,"_78":199,"_80":200,"_82":25},"tree",[152,157],"files",[152,153,154,155,156,157],"counts",{"_141":60,"_142":143,"_144":60,"_145":146,"_147":148},"contents",[125,126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":134,"_32":135,"_30":136,"_128":-5,"_41":42,"_40":137,"_129":120,"_38":138,"_13":60,"_33":139,"_35":-5,"_24":25,"_132":-5,"_27":140},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":120,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":45,"_27":133},"7d041da4-18a2-11f1-a4ec-42dde27851f2","parentId","latest",["D",1772722158549],3,"label",[28],"ce0556de-17d8-11f1-b9d8-42dde27851f2","shared","967e5590-cb60-46bf-9ab1-7f13875f622b",2,["D",1772635536184],"directory",[135],"pulls","branches",1,"forks","envVars",{"_149":60,"_151":60},"connections",{"_149":60,"_150":60},"count","unfilledCount","emptyCount",{"_43":134,"_32":135,"_30":136,"_128":-5,"_41":42,"_40":137,"_129":120,"_38":194,"_13":60,"_33":139,"_35":-5,"_24":25,"_132":-5,"_159":195,"_27":196},{"_43":186,"_32":187,"_30":188,"_128":136,"_41":42,"_40":189,"_129":120,"_38":190,"_13":137,"_33":167,"_35":191,"_24":25,"_132":-5,"_159":192,"_27":193},{"_43":178,"_32":179,"_30":180,"_128":136,"_41":42,"_40":181,"_129":120,"_38":182,"_13":60,"_33":167,"_35":183,"_24":25,"_132":-5,"_159":184,"_27":185},{"_43":171,"_32":172,"_30":173,"_128":136,"_41":42,"_40":131,"_129":120,"_38":174,"_13":60,"_33":167,"_35":175,"_24":25,"_132":-5,"_159":176,"_27":177},{"_43":162,"_32":163,"_30":164,"_128":136,"_41":42,"_40":165,"_129":25,"_38":166,"_13":137,"_33":167,"_35":168,"_24":25,"_132":-5,"_159":169,"_27":170},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":120,"_38":158,"_13":131,"_33":34,"_35":37,"_24":25,"_132":45,"_159":160,"_27":161},["D",1772722158549],"children",[],[28],"af89d6c6-18a0-11f1-a9c3-42dde27851f2","register.ts","b95a3062-17e0-11f1-968a-42dde27851f2",11,["D",1772721384394],"script","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\nexport const AS2_PREFIX = \"as2\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\", enc.encode(KEY), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(prefix: string, issuer: string, redirectUri: string, resource = \"\"): Promise {\n return `${prefix}_id_${(await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)}`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(prefix: string, issuer: string, redirectUri: string, resource = \"\") {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return { client_id, client_secret, redirect_uri: redirectUri, ...(resource && { resource }) };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(clientId: string, clientSecret: string): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(prefix: string, issuer: string, clientId: string, redirectUri: string): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"app<>app\" derivation. At token-exchange the demo IdP knows:\n * reg_uri (from id_token), audience (= AS issuer), resource (MCP URL).\n *\n * Different ASes key differently:\n * - as1: binding key is the client's redirect_uri (matches as.ts /register)\n * - as2: binding key is the IdP's own issuer URL (matches as2.ts /register) —\n * the demo IdP stamps its own identity as the binding, which is exactly\n * what as2 re-derives from JAG.iss at /token.\n */\nconst AS_REGISTRY: Record = {\n [URLS.as]: { prefix: AS_PREFIX, binding: \"redirect_uri\" },\n [URLS.as2]: { prefix: AS2_PREFIX, binding: \"idp_issuer\" },\n};\n\nexport async function deriveAsClientIdFor(asIssuer: string, redirectUri: string, resource: string): Promise {\n const spec = AS_REGISTRY[asIssuer] ?? AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n const bindingKey = spec.binding === \"idp_issuer\" ? URLS.idp : redirectUri;\n return deriveClientId(spec.prefix, asIssuer, bindingKey, resource);\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS_PREFIX, URLS.as, DEBUG_REDIRECT_URI, `${URLS.rs}/mcp`);\n return { idp, as };\n}\n\n/** Creds for conformance against as2 via the demo IdP. Binding key = IdP issuer. */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS2_PREFIX, URLS.as2, URLS.idp, `${URLS.rs2}/mcp`);\n return { idp, as };\n}\n",[],[135,163],"ce3ca81e-17d8-11f1-a7f9-42dde27851f2","keys.ts","ce3ca90e-17d8-11f1-a7f9-42dde27851f2",["D",1772635536555],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[135,172],"ce9b360e-17d8-11f1-a7d4-42dde27851f2","html.ts","ce9b38ac-17d8-11f1-a7d4-42dde27851f2",4,["D",1772635536998],"/** Shared index-page template for all three vals. */\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[135,179],"af1b6ff6-18a0-11f1-b33c-42dde27851f2","config.ts","ce052ce0-17d8-11f1-b9d8-42dde27851f2",10,["D",1772721383668],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[135,187],["D",1772635536184],[153,154,155,156],[135],["D",1772635535432],{"_94":93,"_101":97},{"_94":93,"_95":-5,"_96":97,"_18":54,"_98":99,"_100":25},{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"ctx",{"_76":-5,"_122":234,"_235":236,"_237":238,"_239":25,"_240":25,"_241":25,"_242":120,"_243":-5,"_244":-7,"_245":-7,"_246":60,"_247":25,"_248":25,"_249":-5,"_250":25,"_251":25,"_252":25,"_253":-5},"ENV",{"_205":206,"_207":208,"_209":84,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v12