[{"_1":2,"_179":-5,"_180":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","939580425be10a31a46c456dba7cc90bab2194e6","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_154":155,"_176":177,"_178":-5},"handle","pcarleton","name","xaa-mcp-idp","path","shared/register.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":-5,"_112":-5,"_12":113,"_114":-5,"_115":20,"_116":-5,"_117":-5,"_118":33,"_14":119,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_23":132,"_135":136,"_140":141,"_153":20},"id","cd909aba-17d8-11f1-9aee-42dde27851f2","createdAt",["D",1772635535432],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_133":134},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","org",{"_95":96,"_137":134,"_12":113,"_138":139},"avatar","tier","pro","branch",{"_142":143,"_97":45,"_103":144,"_145":104,"_146":-5,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":98,"_152":96},"version",9,"cd910fae-17d8-11f1-9aee-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":156,"_97":157,"_158":159,"_160":161,"_162":144,"_163":143,"_164":165,"_105":166,"_142":167,"_168":169,"_170":171,"_172":20,"_173":-5,"_99":174},"7e2ef794-17e4-11f1-8264-42dde27851f2","register.ts","fileId","b95a3062-17e0-11f1-968a-42dde27851f2","parentId","967e5590-cb60-46bf-9ab1-7f13875f622b","branchId","branchVersion","latest",true,["D",1772640556196],1,"fileType","script","content","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\", enc.encode(KEY), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(prefix: string, issuer: string, redirectUri: string, resource = \"\"): Promise {\n return `${prefix}_id_${(await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)}`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(prefix: string, issuer: string, redirectUri: string, resource = \"\") {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return { client_id, client_secret, redirect_uri: redirectUri, ...(resource && { resource }) };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(clientId: string, clientSecret: string): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(prefix: string, issuer: string, clientId: string, redirectUri: string): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"app<>app\" mapping. At token-exchange the IdP knows: reg_uri\n * (from id_token), audience (= AS issuer), resource (the MCP URL being\n * requested). Those are exactly what the AS keyed off at /register.\n */\nexport async function deriveAsClientIdFor(asIssuer: string, redirectUri: string, resource: string): Promise {\n return deriveClientId(AS_PREFIX, asIssuer, redirectUri, resource);\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS_PREFIX, URLS.as, DEBUG_REDIRECT_URI, `${URLS.rs}/mcp`);\n return { idp, as };\n}\n","deleted","label",[175,157],"shared","permalink","https://www.val.town/x/pcarleton/xaa-mcp-idp/code/shared/register.ts","extension","actionData","errors"]