npm - @softure-ai/mcp-access - Versions diffs - 0.1.10 → 0.1.12 - Mend

@softure-ai/mcp-access 0.1.10 → 0.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

package/CHANGELOG.md +17 -0
package/README.md +15 -8
package/dist/index.js +1 -1
package/dist/next/index.d.ts +1 -1
package/dist/next/index.d.ts.map +1 -1
package/dist/next/index.js +1 -1
package/dist/next/index.js.map +1 -1
package/dist/options.js +3 -3
package/dist/origins.d.ts +3 -14
package/dist/origins.d.ts.map +1 -1
package/dist/origins.js +4 -20
package/dist/origins.js.map +1 -1
package/dist/server/oauth-http.d.ts +4 -3
package/dist/server/oauth-http.d.ts.map +1 -1
package/dist/server/oauth-http.js +22 -7
package/dist/server/oauth-http.js.map +1 -1
package/dist/server/origins.d.ts +1 -1
package/dist/server/origins.d.ts.map +1 -1
package/dist/server/origins.js +7 -2
package/dist/server/origins.js.map +1 -1
package/module.json +1 -1
package/package.json +2 -2
package/src/index.ts +1 -1
package/src/next/index.ts +1 -1
package/src/options.ts +3 -3
package/src/origins.ts +6 -27
package/src/server/oauth-http.ts +19 -7
package/src/server/origins.ts +6 -5

package/CHANGELOG.md CHANGED Viewed

@@ -4,6 +4,23 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
+## 0.1.12
+- Without a `resolveAppOrigin` option, the app origin comes from core's `resolveAppOrigin` (#311): a listed origin
+  from the config's `origins` block the request was sent to, else `appOrigin`; `origins.trustRequestHost` replaces
+  `resolveAppOrigin: readRequestOrigin`. `readRequestHost` and `readRequestOrigin` are core's (`readRequestOrigin`
+  answers `null` for a host that is no host). The consent decision still reads `Host` only. Discovery documents vary
+  on `x-forwarded-host` too.
+- `getRequestOrigins(config, path)` is exported from `@softure-ai/mcp-access/next`. Needs `@softure-ai/core` 0.1.8.
+## 0.1.11
+- The consent decision accepts a form whose `Origin` host is the host the request was sent to
+  (`Host`), next to the app origin it accepted before, like Next's Server Action check. An image
+  with a fixed public origin run under another host (browser tests on `http://localhost:6510`)
+  no longer gets `403`. Other hosts, `Origin: null`, a missing or malformed `Origin` and
+  non-http(s) schemes are still refused; `iss` and `resource` still use the app origin (#294).
 ## 0.1.10
 - The days left on a token are counted with `toCalendarDay` from `@softure-ai/core` instead of a local `en-CA`

package/README.md CHANGED Viewed

@@ -86,7 +86,7 @@ mcpAccess({
 | `oauth.authorizationCodeLifetimeMinutes` | `integer` 1–10 | `10` | Lifetime of an authorization code (single use). |
 | `oauth.maxBodyBytes` | `integer` 1024–1048576 | `16384` | The largest body the registration, token and consent decision routes read. Larger: `413` (`invalid_request` on registration and token), before it fills memory. Real bodies stay under 4 KiB. |
 | `oauth.metadata` | `{ authorizationServer?, protectedResource? }`, each an object or `(origins) => object` | — | Extra keys of the discovery documents (`jwks_uri`, `service_documentation`, `resource_documentation`, `agent_auth`…). Generated keys win; a static object that sets one is refused at startup. The protected resource document takes the app's `resource_name` (default: `serverName`). |
-| `resolveAppOrigin` | `(request) => string \| null` | — | The app origin of one request, when it is not the fixed `appOrigin` (an image built once and served elsewhere, a proxy). `readRequestOrigin` reads it from `Host`. Null keeps `appOrigin`; anything but a bare http(s) origin throws. |
+| `resolveAppOrigin` | `(request) => string \| null` | — | The app origin of one request, ahead of the config's `origins` block (prefer that block: every module reads it). `readRequestOrigin` reads it from `Host`. Null falls back to the block's rule; anything but a bare http(s) origin throws. |
 | `resourceOrigins` | `string[]` (≤ 16 http(s) origins) | `[]` | Other public hosts of the app, e.g. the apex next to `app.`: the root protected resource metadata asked on one of them names it as `resource`, and the OAuth endpoints accept it as `resource`. |
 | `routes` | `{ page?, endpoint?, oauthConsent?, oauthDecision?, oauthToken?, oauthRegister? }` | `/account/mcp`, `/api/mcp`, `/oauth/authorize`, `/api/oauth/authorize`, `/api/oauth/token`, `/api/oauth/register` | Move the page, the endpoint or the OAuth paths; URLs in the setup and the metadata are the app origin (`appOrigin`, or `resolveAppOrigin`'s) + the path. |
 | `messages` | partial `en` / `pl` | — | Copy overrides. |
@@ -168,19 +168,26 @@ export { getProtectedResourceMetadataRoute as GET, answerOAuthPreflight as OPTIO
 `/.well-known/oauth-*`, `/api/oauth/token` and `/api/oauth/register` are public: keep them out of
 a proxy guard, like `/api/mcp`. The consent page and the decision route check the session
 themselves (the page sends a signed-out person to the login page and back); the decision route
-also refuses a request whose `Origin` is not the app origin.
+also refuses a request whose `Origin` is neither the app origin nor an http(s) origin on the host
+the request was sent to (`Host`), the rule Next applies to Server Actions.
 TypeScript's `**` skips dot folders: with an `include` list in `tsconfig.json`, add
 `"app/.well-known/**/*.ts"`.
 **Origins.** Every OAuth URL (issuer, endpoints, `resource`, `resource_metadata`, `iss`) and the
-decision's `Origin` check use the app origin of the request: `appOrigin`, unless
-`resolveAppOrigin` answers. The discovery routes read the request, so Next never renders them at
-build time, and they answer with `Vary: host, x-forwarded-proto`.
+decision's `Origin` check use the app origin of the request: core's `resolveAppOrigin` (a listed
+origin from the config's `origins` block the request was sent to, else `appOrigin`; core README,
+"Request origins"), unless the module's `resolveAppOrigin` option answers. The decision also accepts a form posted from the host the request was
+sent to, so an image with a fixed public origin run under another host (a release pipeline's
+browser tests on `http://localhost:6510`) completes the consent without a resolver. The discovery
+routes read the request, so Next never renders them at build time, and they answer with
+`Vary: host, x-forwarded-host, x-forwarded-proto`. `getRequestOrigins(config, path)` from
+`@softure-ai/mcp-access/next` gives a page or a server action the same origins from Next's `headers()`.
 - *An image built once and served under another origin* (a test stack on another port, a
-  production image against a local stack): `resolveAppOrigin: process.env.APP_ORIGIN ? undefined :
-  readRequestOrigin`. `readRequestOrigin` trusts `Host` and `X-Forwarded-Proto`, so use it only
-  behind a proxy that passes `Host` through and refuses hosts it does not serve. The consent page,
+  production image against a local stack): `origins: { trustRequestHost: !process.env.APP_ORIGIN }`
+  in the config (the older `resolveAppOrigin: readRequestOrigin` option does the same for this
+  module only). It trusts `Host` and `X-Forwarded-Proto`, so use it only behind a proxy that passes
+  `Host` through and refuses hosts it does not serve. The consent page,
   its decision and the token endpoint then agree on the origin the browser used.
 - *A second public host* (product on `https://app.example.com`, site on `https://example.com`):
   `resourceOrigins: ["https://example.com"]`, and route that host's `/.well-known/oauth-*` to the

package/dist/index.js CHANGED Viewed

@@ -29,7 +29,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.1.10",
+        version: "0.1.12",
         dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
         dbSchema: "mcp",
         tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/dist/next/index.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 export { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
 export { OAuthConsentPage, type OAuthConsentPageProps } from "./oauth-page.js";
 export { answerOAuthPreflight, decideOAuthAuthorizationRoute, exchangeOAuthTokenRoute, getAuthorizationServerMetadataRoute, getProtectedResourceMetadataRoute, registerOAuthClientRoute, } from "./oauth-routes.js";
-export { getMcpAccessContext } from "./context.js";
+export { getMcpAccessContext, getRequestOrigins } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;~~AACnD~~,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/next/index.js CHANGED Viewed

@@ -3,7 +3,7 @@
 export { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
 export { OAuthConsentPage } from "./oauth-page.js";
 export { answerOAuthPreflight, decideOAuthAuthorizationRoute, exchangeOAuthTokenRoute, getAuthorizationServerMetadataRoute, getProtectedResourceMetadataRoute, registerOAuthClientRoute, } from "./oauth-routes.js";
-export { getMcpAccessContext } from "./context.js";
+export { getMcpAccessContext, getRequestOrigins } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";
 //# sourceMappingURL=index.js.map

package/dist/next/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAA8B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;~~AACnD~~,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAA8B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/options.js CHANGED Viewed

@@ -119,9 +119,9 @@ export const mcpAccessOptionsSchema = z
      */
     legacyTokenPattern: legacyTokenPatternSchema.optional(),
     /**
-     * The app origin of a request, when it is not the fixed `appOrigin`: an image built once and
-     * served under another origin, or a proxy whose `request.url` does not carry the public host.
-     * `readRequestOrigin` (`/server`) reads it from `Host`. Null keeps `appOrigin`.
+     * The app origin of a request, when the config's `origins` block (core `resolveAppOrigin`) does not
+     * answer it: prefer `origins.trustedOrigins` or `origins.trustRequestHost` there, which every
+     * module reads. `readRequestOrigin` reads it from `Host`. Null falls back to the config's rule.
      */
     resolveAppOrigin: z.custom((value) => typeof value === "function", "must be a function (request) => string | null").optional(),
     /**

package/dist/origins.d.ts CHANGED Viewed

@@ -1,24 +1,13 @@
+import { readRequestHost, readRequestOrigin, type OriginRequest } from "@softure-ai/core";
+export { readRequestHost, readRequestOrigin };
 /** What the origin helpers read from a request: a Web `Request`, or Next's `headers()` with a URL. */
-export interface McpOriginRequest {
-    readonly url: string;
-    readonly headers: {
-        get(name: string): string | null;
-    };
-}
+export type McpOriginRequest = OriginRequest;
 export interface McpOrigins {
     /** The issuer, and the origin of every endpoint, of `resource_metadata` and of the consent form. */
     readonly appOrigin: string;
     /** Other public hosts (`resourceOrigins`), each a bare origin. */
     readonly resourceOrigins: readonly string[];
 }
-/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
-export declare function readRequestHost(request: McpOriginRequest): string;
-/**
- * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
- * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
- * proxy passes `Host` through and refuses hosts it does not serve.
- */
-export declare function readRequestOrigin(request: McpOriginRequest): string;
 /**
  * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
  * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.

package/dist/origins.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAGA,~~sGAAsG;AACtG~~,~~MAAM~~,~~WAAW~~,~~gBAAgB;IAC/B~~,~~QAAQ~~,~~CAAC~~,~~GAAG~~,EAAE,MAAM,CAAC;~~IACrB~~,~~QAAQ~~,~~CAAC~~,~~OAAO~~,EAAE~~;QAAE~~,~~GAAG~~,CAAC,~~IAAI~~,~~EAAE~~,MAAM,~~GAAG~~,~~MAAM,~~GAAG,~~IAAI~~,~~CAAA;KAAE,~~CAAC;~~CACxD;AAED~~,MAAM,WAAW,UAAU;IACzB,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;~~AAOD,oHAAoH;AACpH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAEjE;~~AAED~~;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAKnE;AAED~~;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAKtG"}
1	+ {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,eAAe,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AAE9C,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE7C,MAAM,WAAW,UAAU;IACzB,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAKtG"}

package/dist/origins.js CHANGED Viewed

@@ -1,24 +1,8 @@
 // The origins one request is served under: the app origin every OAuth URL is built from, and the
 // other public hosts whose root may be named as a protected resource. Pure: no config, no database.
-function firstValue(header) {
-    const value = header?.split(",")[0]?.trim().toLowerCase();
-    return value === undefined || value === "" ? null : value;
-}
-/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
-export function readRequestHost(request) {
-    return firstValue(request.headers.get("host")) ?? new URL(request.url).host;
-}
-/**
- * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
- * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
- * proxy passes `Host` through and refuses hosts it does not serve.
- */
-export function readRequestOrigin(request) {
-    const url = new URL(request.url);
-    const proto = firstValue(request.headers.get("x-forwarded-proto"));
-    const scheme = proto === "http" || proto === "https" ? proto : url.protocol.replace(/:$/, "");
-    return new URL(`${scheme}://${readRequestHost(request)}`).origin;
-}
+// Reading the request is core's rule (`readRequestHost`, `readRequestOrigin`, issue #311).
+import { readForwardedProto, readRequestHost, readRequestOrigin } from "@softure-ai/core";
+export { readRequestHost, readRequestOrigin };
 /**
  * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
  * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.
@@ -26,7 +10,7 @@ export function readRequestOrigin(request) {
 export function findServedResourceOrigin(origins, request) {
     const host = readRequestHost(request);
     const candidates = origins.resourceOrigins.filter((origin) => new URL(origin).host === host);
-    const proto = firstValue(request.headers.get("x-forwarded-proto"));
+    const proto = readForwardedProto(request);
     return candidates.find((origin) => new URL(origin).protocol === `${proto ?? ""}:`) ?? candidates[0] ?? null;
 }
 //# sourceMappingURL=origins.js.map

package/dist/origins.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.js","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,oGAAoG;~~AAepG~~,~~SAAS,UAAU,CAAC,MAAqB~~;~~IACvC~~,~~MAAM~~,~~KAAK,GAAG,MAAM,~~EAAE,~~KAAK~~,~~CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,~~EAAE,~~IAAI~~,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,~~CAAC~~,~~OAAyB;IACzD,~~MAAM,~~GAAG~~,~~GAAG,IAAI,GAAG,~~CAAC~~,OAAO,CAAC,GAAG,CAAC,CAAC~~;~~IACjC~~,~~MAAM,KAAK,GAAG,UAAU,CAAC,~~OAAO,~~CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,~~EAAE,~~EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,~~eAAe,~~CAAC~~,~~OAAO~~,~~CAAC,~~EAAE,CAAC~~,CAAC,MAAM,CAAC~~;~~AACnE,CAAC;AAED~~;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAmB,EAAE,OAAyB;IACrF,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,~~UAAU~~,CAAC,OAAO,CAAC,~~OAAO,~~CAAC~~,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC~~;~~IACnE~~,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9G,CAAC"}
1	+ {"version":3,"file":"origins.js","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAsB,MAAM,kBAAkB,CAAC;AAE9G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AAY9C;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAmB,EAAE,OAAyB;IACrF,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9G,CAAC"}

package/dist/server/oauth-http.d.ts CHANGED Viewed

@@ -119,9 +119,10 @@ export declare function getConsentPath(config: SoftureConfig, params: URLSearchP
 /**
  * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
  * the answer is a redirect to the client, possibly a native app scheme, and must work without
- * JavaScript. The form must come from the app's origin (the session cookie's `SameSite=Lax` is the
- * first layer), and the request is validated again from the posted fields. `userId` is the
- * session's user, or null: then the person goes back to the consent page, which asks them to sign in.
+ * JavaScript. The form must come from the app's origin or the host the request was sent to (the
+ * session cookie's `SameSite=Lax` is the first layer), and the request is validated again from the
+ * posted fields. `userId` is the session's user, or null: then the person goes back to the consent
+ * page, which asks them to sign in.
  */
 export declare function handleAuthorizationDecision(ctx: McpAccessContext, request: Request, userId: string | null): Promise<Response>;
 //# sourceMappingURL=oauth-http.d.ts.map

package/dist/server/oauth-http.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIhF,OAAO,~~EAA4B~~,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;~~AACjG~~,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAenD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,6FAA6F;AAC7F,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,eAAO,MAAM,YAAY,oCAA6C,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kIAAmI,CAAC;AA4BrK,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAE/C;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE7G;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE9H;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAQD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC;;;;;;;;;;;;EAkBpH;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,GAAE,UAAsC,EAC/C,YAAY,GAAE,MAAM,GAAG,IAAW;;;;;;EAWnC;AAED,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAAK,OAAO,CAAC;AAE1H,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,QAAQ,CAG5I;AAED,gHAAgH;AAChH,eAAO,MAAM,gCAAgC,EAAE,iBAC8E,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,UAAsC,GAAG,OAAO,CAI7I;AAED,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEnE;AAmDD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoCzG;AA2CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwBnG;AAmCD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EAC/C,OAAO,GAAE,UAAsC,GAC9C,MAAM,CAMR;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,eAAe,CAO/F;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,UAA0C,GAClD,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAErF;~~AAwBD;;;;;;GAMG~~;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnI"}
1	+ {"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIhF,OAAO,EAA6C,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAenD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,6FAA6F;AAC7F,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,eAAO,MAAM,YAAY,oCAA6C,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kIAAmI,CAAC;AA4BrK,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAE/C;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE7G;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE9H;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAQD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC;;;;;;;;;;;;EAkBpH;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,GAAE,UAAsC,EAC/C,YAAY,GAAE,MAAM,GAAG,IAAW;;;;;;EAWnC;AAED,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAAK,OAAO,CAAC;AAE1H,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,QAAQ,CAG5I;AAED,gHAAgH;AAChH,eAAO,MAAM,gCAAgC,EAAE,iBAC8E,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,UAAsC,GAAG,OAAO,CAI7I;AAED,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEnE;AAmDD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoCzG;AA2CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwBnG;AAmCD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EAC/C,OAAO,GAAE,UAAsC,GAC9C,MAAM,CAMR;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,eAAe,CAO/F;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,UAA0C,GAClD,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAErF;AAmCD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnI"}

package/dist/server/oauth-http.js CHANGED Viewed

@@ -6,7 +6,7 @@
 import { errorLogLabel, getModule } from "@softure-ai/core";
 import { readSmallBody } from "@softure-ai/security";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
-import { findServedResourceOrigin } from "../origins.js";
+import { findServedResourceOrigin, readRequestHost } from "../origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, refreshMcpGrant, registerMcpClient, } from "./oauth.js";
 import { parseClientRegistration } from "./oauth-validation.js";
@@ -36,7 +36,7 @@ const CORS_HEADERS = {
 /** Responses that carry credentials must not be stored (RFC 6749 §5.1). */
 const NO_STORE = { "cache-control": "no-store", pragma: "no-cache" };
 /** Discovery documents change only with a deploy, and with the host they were asked on. */
-const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-proto" };
+const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-host, x-forwarded-proto" };
 function protocolJson(body, status = 200, extra = {}) {
     return Response.json(body, { status, headers: { ...CORS_HEADERS, ...NO_STORE, ...extra } });
 }
@@ -364,10 +364,24 @@ export function getConsentPath(config, params) {
 function seeOther(location) {
     return new Response(null, { status: 303, headers: { location, "cache-control": "no-store" } });
 }
-/** Whether the form was posted from this app: `Origin` must be the request's app origin. */
+/**
+ * Whether the form was posted from this app: `Origin` is the request's app origin, or an http(s)
+ * origin whose host is the host the request was sent to (`Host`), the rule Next applies to Server
+ * Actions. The second covers an image with a fixed public origin served under another host. A
+ * cross-site page cannot make the two hosts agree; `null`, missing, malformed values and anything
+ * but a bare http(s) origin (a path, user info) fail.
+ */
 function isSameOrigin(request, origins) {
     const origin = request.headers.get("origin");
-    return origin !== null && origin === origins.appOrigin;
+    if (origin === null)
+        return false;
+    if (origin === origins.appOrigin)
+        return true;
+    if (!URL.canParse(origin))
+        return false;
+    const url = new URL(origin);
+    const isBareHttpOrigin = (url.protocol === "http:" || url.protocol === "https:") && url.origin === origin;
+    return isBareHttpOrigin && url.host === readRequestHost(request);
 }
 /**
  * The consent form, read up to `oauth.maxBodyBytes`, or the answer to a body that is too large
@@ -384,9 +398,10 @@ async function readDecisionForm(config, request) {
 /**
  * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
  * the answer is a redirect to the client, possibly a native app scheme, and must work without
- * JavaScript. The form must come from the app's origin (the session cookie's `SameSite=Lax` is the
- * first layer), and the request is validated again from the posted fields. `userId` is the
- * session's user, or null: then the person goes back to the consent page, which asks them to sign in.
+ * JavaScript. The form must come from the app's origin or the host the request was sent to (the
+ * session cookie's `SameSite=Lax` is the first layer), and the request is validated again from the
+ * posted fields. `userId` is the session's user, or null: then the person goes back to the consent
+ * page, which asks them to sign in.
  */
 export async function handleAuthorizationDecision(ctx, request, userId) {
     if (!isOAuthEnabled(ctx.config))

package/dist/server/oauth-http.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAA4B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAA0C,MAAM,eAAe,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AAEpG,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,iBAAiB;AAEjB,iIAAiI;AACjI,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnJ,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;QACzD,kFAAkF;QAClF,OAAO,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAgB;IACrE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAA4B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAA0C,MAAM,eAAe,CAAC;AAElH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;AAEtH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,iBAAiB;AAEjB,iIAAiI;AACjI,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnJ,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;QACzD,kFAAkF;QAClF,OAAO,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1G,OAAO,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAgB;IACrE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/origins.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { SoftureConfig } from "@softure-ai/core";
+import { type SoftureConfig } from "@softure-ai/core";
 import type { McpOriginRequest, McpOrigins } from "../origins.js";
 /**
  * The origins for `request`, or the configured ones without a request. A resolver that returns

package/dist/server/origins.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,~~EAAE,~~aAAa,EAAE,MAAM,kBAAkB,CAAC;~~AAEtD~~,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGlE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,UAAU,~~CAOtG~~"}
1	+ {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGlE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,UAAU,CAQtG"}

package/dist/server/origins.js CHANGED Viewed

@@ -1,3 +1,6 @@
+// The origins of one request: the `resolveAppOrigin` option when it answers, else core `resolveAppOrigin` (a listed
+// origin the request was sent to, see the config's `origins`, else `appOrigin`), plus `resourceOrigins`.
+import { resolveAppOrigin } from "@softure-ai/core";
 import { isBareOrigin } from "../options.js";
 import { getMcpAccessOptions } from "./options.js";
 /**
@@ -6,10 +9,12 @@ import { getMcpAccessOptions } from "./options.js";
  */
 export function resolveMcpOrigins(config, request) {
     const options = getMcpAccessOptions(config);
-    const resolved = request === undefined || request === null || options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
+    if (request === undefined || request === null)
+        return { appOrigin: config.appOrigin, resourceOrigins: options.resourceOrigins };
+    const resolved = options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
     if (resolved !== null && !isBareOrigin(resolved)) {
         throw new Error(`@softure-ai/mcp-access: resolveAppOrigin returned "${resolved.slice(0, 100)}", which is not an http(s) origin without a path`);
     }
-    return { appOrigin: new URL(resolved ?? config.appOrigin).origin, resourceOrigins: options.resourceOrigins };
+    return { appOrigin: new URL(resolved ?? resolveAppOrigin(config, request)).origin, resourceOrigins: options.resourceOrigins };
 }
 //# sourceMappingURL=origins.js.map

package/dist/server/origins.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"~~AAGA~~,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAiC;IACxF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,~~MAAM~~,~~QAAQ,GAAG,~~OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,~~IAAI~~,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;~~IAChJ~~,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,~~MAAM~~,CAAC,~~SAAS~~,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;~~AAC/G~~,CAAC"}
1	+ {"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,yGAAyG;AACzG,OAAO,EAAE,gBAAgB,EAAsB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAiC;IACxF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnG,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;AAChI,CAAC"}

package/module.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "dependsOn": { "security": "^0.1.0", "auth": "^0.1.0" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js.",
   "license": "MIT",
   "type": "module",
@@ -54,7 +54,7 @@
   },
   "dependencies": {
     "@softure-ai/auth": "^0.1.0",
-    "@softure-ai/core": "^0.1.7",
+    "@softure-ai/core": "^0.1.8",
     "@softure-ai/db": "^0.1.0",
     "@softure-ai/security": "^0.1.0",
     "zod": "^4.6.5"

package/src/index.ts CHANGED Viewed

@@ -32,7 +32,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.1.10",
+    version: "0.1.12",
     dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/src/next/index.ts CHANGED Viewed

@@ -10,6 +10,6 @@ export {
   getProtectedResourceMetadataRoute,
   registerOAuthClientRoute,
 } from "./oauth-routes.js";
-export { getMcpAccessContext } from "./context.js";
+export { getMcpAccessContext, getRequestOrigins } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";

package/src/options.ts CHANGED Viewed

@@ -137,9 +137,9 @@ export const mcpAccessOptionsSchema = z
      */
     legacyTokenPattern: legacyTokenPatternSchema.optional(),
     /**
-     * The app origin of a request, when it is not the fixed `appOrigin`: an image built once and
-     * served under another origin, or a proxy whose `request.url` does not carry the public host.
-     * `readRequestOrigin` (`/server`) reads it from `Host`. Null keeps `appOrigin`.
+     * The app origin of a request, when the config's `origins` block (core `resolveAppOrigin`) does not
+     * answer it: prefer `origins.trustedOrigins` or `origins.trustRequestHost` there, which every
+     * module reads. `readRequestOrigin` reads it from `Host`. Null falls back to the config's rule.
      */
     resolveAppOrigin: z.custom<McpAppOriginResolver>((value) => typeof value === "function", "must be a function (request) => string | null").optional(),
     /**

package/src/origins.ts CHANGED Viewed

@@ -1,11 +1,12 @@
 // The origins one request is served under: the app origin every OAuth URL is built from, and the
 // other public hosts whose root may be named as a protected resource. Pure: no config, no database.
+// Reading the request is core's rule (`readRequestHost`, `readRequestOrigin`, issue #311).
+import { readForwardedProto, readRequestHost, readRequestOrigin, type OriginRequest } from "@softure-ai/core";
+export { readRequestHost, readRequestOrigin };
 /** What the origin helpers read from a request: a Web `Request`, or Next's `headers()` with a URL. */
-export interface McpOriginRequest {
-  readonly url: string;
-  readonly headers: { get(name: string): string | null };
-}
+export type McpOriginRequest = OriginRequest;
 export interface McpOrigins {
   /** The issuer, and the origin of every endpoint, of `resource_metadata` and of the consent form. */
@@ -14,28 +15,6 @@ export interface McpOrigins {
   readonly resourceOrigins: readonly string[];
 }
-function firstValue(header: string | null): string | null {
-  const value = header?.split(",")[0]?.trim().toLowerCase();
-  return value === undefined || value === "" ? null : value;
-}
-/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
-export function readRequestHost(request: McpOriginRequest): string {
-  return firstValue(request.headers.get("host")) ?? new URL(request.url).host;
-}
-/**
- * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
- * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
- * proxy passes `Host` through and refuses hosts it does not serve.
- */
-export function readRequestOrigin(request: McpOriginRequest): string {
-  const url = new URL(request.url);
-  const proto = firstValue(request.headers.get("x-forwarded-proto"));
-  const scheme = proto === "http" || proto === "https" ? proto : url.protocol.replace(/:$/, "");
-  return new URL(`${scheme}://${readRequestHost(request)}`).origin;
-}
 /**
  * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
  * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.
@@ -43,6 +22,6 @@ export function readRequestOrigin(request: McpOriginRequest): string {
 export function findServedResourceOrigin(origins: McpOrigins, request: McpOriginRequest): string | null {
   const host = readRequestHost(request);
   const candidates = origins.resourceOrigins.filter((origin) => new URL(origin).host === host);
-  const proto = firstValue(request.headers.get("x-forwarded-proto"));
+  const proto = readForwardedProto(request);
   return candidates.find((origin) => new URL(origin).protocol === `${proto ?? ""}:`) ?? candidates[0] ?? null;
 }

package/src/server/oauth-http.ts CHANGED Viewed

@@ -7,7 +7,7 @@ import { errorLogLabel, getModule, type SoftureConfig } from "@softure-ai/core";
 import { readSmallBody, type ReadSmallBodyResult } from "@softure-ai/security";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
 import type { McpMetadataExtension } from "../options.js";
-import { findServedResourceOrigin, type McpOriginRequest, type McpOrigins } from "../origins.js";
+import { findServedResourceOrigin, readRequestHost, type McpOriginRequest, type McpOrigins } from "../origins.js";
 import type { OAuthClientRow } from "../schema.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import {
@@ -53,7 +53,7 @@ const CORS_HEADERS = {
 /** Responses that carry credentials must not be stored (RFC 6749 §5.1). */
 const NO_STORE = { "cache-control": "no-store", pragma: "no-cache" };
 /** Discovery documents change only with a deploy, and with the host they were asked on. */
-const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-proto" };
+const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-host, x-forwarded-proto" };
 function protocolJson(body: unknown, status = 200, extra: Readonly<Record<string, string>> = {}): Response {
   return Response.json(body, { status, headers: { ...CORS_HEADERS, ...NO_STORE, ...extra } });
@@ -454,10 +454,21 @@ function seeOther(location: string): Response {
   return new Response(null, { status: 303, headers: { location, "cache-control": "no-store" } });
 }
-/** Whether the form was posted from this app: `Origin` must be the request's app origin. */
+/**
+ * Whether the form was posted from this app: `Origin` is the request's app origin, or an http(s)
+ * origin whose host is the host the request was sent to (`Host`), the rule Next applies to Server
+ * Actions. The second covers an image with a fixed public origin served under another host. A
+ * cross-site page cannot make the two hosts agree; `null`, missing, malformed values and anything
+ * but a bare http(s) origin (a path, user info) fail.
+ */
 function isSameOrigin(request: Request, origins: McpOrigins): boolean {
   const origin = request.headers.get("origin");
-  return origin !== null && origin === origins.appOrigin;
+  if (origin === null) return false;
+  if (origin === origins.appOrigin) return true;
+  if (!URL.canParse(origin)) return false;
+  const url = new URL(origin);
+  const isBareHttpOrigin = (url.protocol === "http:" || url.protocol === "https:") && url.origin === origin;
+  return isBareHttpOrigin && url.host === readRequestHost(request);
 }
 /**
@@ -475,9 +486,10 @@ async function readDecisionForm(config: SoftureConfig, request: Request): Promis
 /**
  * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
  * the answer is a redirect to the client, possibly a native app scheme, and must work without
- * JavaScript. The form must come from the app's origin (the session cookie's `SameSite=Lax` is the
- * first layer), and the request is validated again from the posted fields. `userId` is the
- * session's user, or null: then the person goes back to the consent page, which asks them to sign in.
+ * JavaScript. The form must come from the app's origin or the host the request was sent to (the
+ * session cookie's `SameSite=Lax` is the first layer), and the request is validated again from the
+ * posted fields. `userId` is the session's user, or null: then the person goes back to the consent
+ * page, which asks them to sign in.
  */
 export async function handleAuthorizationDecision(ctx: McpAccessContext, request: Request, userId: string | null): Promise<Response> {
   if (!isOAuthEnabled(ctx.config)) return new Response(null, { status: 404 });

package/src/server/origins.ts CHANGED Viewed

@@ -1,6 +1,6 @@
-// The origins of one request, from the app's options: `resolveAppOrigin` when it answers, else the
-// configured `appOrigin`, plus `resourceOrigins`.
-import type { SoftureConfig } from "@softure-ai/core";
+// The origins of one request: the `resolveAppOrigin` option when it answers, else core `resolveAppOrigin` (a listed
+// origin the request was sent to, see the config's `origins`, else `appOrigin`), plus `resourceOrigins`.
+import { resolveAppOrigin, type SoftureConfig } from "@softure-ai/core";
 import { isBareOrigin } from "../options.js";
 import type { McpOriginRequest, McpOrigins } from "../origins.js";
 import { getMcpAccessOptions } from "./options.js";
@@ -11,9 +11,10 @@ import { getMcpAccessOptions } from "./options.js";
  */
 export function resolveMcpOrigins(config: SoftureConfig, request?: McpOriginRequest | null): McpOrigins {
   const options = getMcpAccessOptions(config);
-  const resolved = request === undefined || request === null || options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
+  if (request === undefined || request === null) return { appOrigin: config.appOrigin, resourceOrigins: options.resourceOrigins };
+  const resolved = options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
   if (resolved !== null && !isBareOrigin(resolved)) {
     throw new Error(`@softure-ai/mcp-access: resolveAppOrigin returned "${resolved.slice(0, 100)}", which is not an http(s) origin without a path`);
   }
-  return { appOrigin: new URL(resolved ?? config.appOrigin).origin, resourceOrigins: options.resourceOrigins };
+  return { appOrigin: new URL(resolved ?? resolveAppOrigin(config, request)).origin, resourceOrigins: options.resourceOrigins };
 }