[{"_1":2,"_182":-5,"_183":-5},"loaderData",{"_3":4,"_95":96},"root",{"_5":6,"_36":37,"_68":69},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isBusinessOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","7c7c06753d7a5ed5a1f192e99b6d1a35b1b6fb2d","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","API_URL","https://api.val.town","clerkState",{"_70":71},"__internal_clerk_state",{"_72":73,"_74":47,"_75":76,"_77":76,"_78":20,"_79":76,"_80":76,"_81":76,"_82":76,"_83":84,"_93":20,"_94":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_85":20,"_19":20,"_86":76,"_87":88,"_89":76,"_90":47,"_91":20,"_92":76},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_97":98,"_99":100,"_101":102,"_103":104,"_156":157,"_179":180,"_181":-5},"handle","pcarleton","name","xaa-mcp-as2","path","shared/register.ts","project",{"_105":106,"_99":100,"_107":108,"_109":-5,"_110":20,"_111":112,"_113":-5,"_114":-5,"_12":115,"_116":-5,"_117":20,"_118":-5,"_119":-5,"_120":33,"_14":121,"_122":-5,"_123":-5,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_23":134,"_137":138,"_142":143,"_155":20},"id","b21da020-18a0-11f1-8e30-42dde27851f2","createdAt",["D",1772721388727],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_97":98,"_135":136},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","org",{"_97":98,"_139":136,"_12":115,"_140":141},"avatar","tier","pro","branch",{"_144":145,"_99":45,"_105":146,"_147":106,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":100,"_154":98},"version",9,"b21dfade-18a0-11f1-8e30-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_105":158,"_99":159,"_160":161,"_162":163,"_164":146,"_165":166,"_167":168,"_107":169,"_144":170,"_171":172,"_173":174,"_175":20,"_176":-5,"_101":177},"7e7276cc-18a2-11f1-86ae-42dde27851f2","register.ts","fileId","b3538af4-18a0-11f1-bc84-42dde27851f2","parentId","d7b61624-e0e0-44e2-bbf1-c0a82a4b3c07","branchId","branchVersion",7,"latest",true,["D",1772722161027],1,"fileType","script","content","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\", enc.encode(KEY), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(prefix: string, issuer: string, redirectUri: string, resource = \"\"): Promise {\n return `${prefix}_id_${(await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)}`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(prefix: string, issuer: string, redirectUri: string, resource = \"\") {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return { client_id, client_secret, redirect_uri: redirectUri, ...(resource && { resource }) };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(clientId: string, clientSecret: string): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(prefix: string, issuer: string, clientId: string, redirectUri: string): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"what client_id do I stamp in the JAG\" decision. Depends on how\n * the target AS models clients:\n *\n * - as1: AS mints its own IDs. IdP re-derives by running the same HMAC\n * the AS ran at /register, keyed on the client's redirect_uri.\n *\n * - as2: Client brings their own ID — whatever their IdP knows them as.\n * (Matches Okta's model: the catalog app stamps its own Okta client_id.)\n * The demo IdP plays along by stamping the requester's IdP client_id,\n * which it has right there in the token-exchange request body. The AS\n * never re-derives the id; it re-derives the *secret*, which is bound\n * to (iss, client_id, resource).\n */\nconst AS_REGISTRY: Record = {\n [URLS.as]: { mode: \"derive\", prefix: AS_PREFIX },\n [URLS.as2]: { mode: \"passthrough\" },\n};\n\nexport async function deriveAsClientIdFor(\n asIssuer: string,\n redirectUri: string,\n resource: string,\n requesterClientId: string,\n): Promise {\n const spec = AS_REGISTRY[asIssuer] ?? AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n if (spec.mode === \"passthrough\") return requesterClientId;\n return deriveClientId(spec.prefix, asIssuer, redirectUri, resource);\n}\n\n/**\n * as2 secret derivation. Binds the secret to the full (issuer, client_id,\n * resource) tuple — the secret IS the trust decision. The client_id is\n * IdP-controlled (whatever Okta stamps); the secret is us-controlled.\n */\nexport async function deriveAs2Secret(idpIssuer: string, clientId: string, resource: string): Promise {\n return `as2_sec_${(await hmacHex(`${idpIssuer}|${clientId}|${resource}`)).slice(0, 16)}`;\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS_PREFIX, URLS.as, DEBUG_REDIRECT_URI, `${URLS.rs}/mcp`);\n return { idp, as };\n}\n\n/**\n * Creds for conformance against as2 via the demo IdP. The AS client_id IS the\n * IdP client_id (that's what the demo IdP stamps in the JAG — passthrough mode).\n */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = {\n client_id: idp.client_id,\n client_secret: await deriveAs2Secret(URLS.idp, idp.client_id, `${URLS.rs2}/mcp`),\n };\n return { idp, as };\n}\n","deleted","label",[178,159],"shared","permalink","https://www.val.town/x/pcarleton/xaa-mcp-as2/code/shared/register.ts","extension","actionData","errors"]