@softure-ai/mcp-access 0.1.7 → 0.1.9

package/dist/server/oauth-http.js

@@ -4,11 +4,14 @@
 // handler takes a Web `Request` and returns a `Response`, so any fetch-shaped host can mount it;
 // the Next adapter only supplies the context and the session.
 import { errorLogLabel, getModule } from "@softure-ai/core";
+import { readSmallBody } from "@softure-ai/security";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
+import { findServedResourceOrigin } from "../origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, refreshMcpGrant, registerMcpClient, } from "./oauth.js";
 import { parseClientRegistration } from "./oauth-validation.js";
 import { getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
+import { resolveMcpOrigins } from "./origins.js";
 import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 /** The security bucket OAuth registration and token requests count in. */
 export const MCP_OAUTH_RATE_LIMIT_BUCKET = "mcp-oauth";
@@ -32,8 +35,8 @@ const CORS_HEADERS = {
 };
 /** Responses that carry credentials must not be stored (RFC 6749 §5.1). */
 const NO_STORE = { "cache-control": "no-store", pragma: "no-cache" };
-/** Discovery documents change only with a deploy. */
-const DISCOVERY_CACHE = { "cache-control": "public, max-age=300" };
+/** Discovery documents change only with a deploy, and with the host they were asked on. */
+const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-proto" };
 function protocolJson(body, status = 200, extra = {}) {
     return Response.json(body, { status, headers: { ...CORS_HEADERS, ...NO_STORE, ...extra } });
 }
@@ -47,23 +50,36 @@ export function answerOAuthPreflight() {
 }
 // ---------------------------------------------------------------------------------------------
 // Discovery
-/** The issuer: the app's origin, without a path or a trailing slash. */
-export function getOAuthIssuer(config) {
-    return new URL(config.appOrigin).origin;
+/**
+ * The issuer: the app's origin, without a path or a trailing slash. `origins` are the request's
+ * (`resolveMcpOrigins`); without them, the configured `appOrigin`.
+ */
+export function getOAuthIssuer(config, origins = resolveMcpOrigins(config)) {
+    return origins.appOrigin;
 }
 /** The URL the endpoint's `401` names in `resource_metadata` (RFC 9728 §5.1). */
-export function getProtectedResourceMetadataUrl(config) {
-    return `${getOAuthIssuer(config)}${PROTECTED_RESOURCE_METADATA_PATH}${new URL(getMcpEndpointUrl(config)).pathname}`;
+export function getProtectedResourceMetadataUrl(config, origins = resolveMcpOrigins(config)) {
+    return `${getOAuthIssuer(config, origins)}${PROTECTED_RESOURCE_METADATA_PATH}${new URL(getMcpEndpointUrl(config, origins)).pathname}`;
 }
 /** Whether the app turned OAuth on; the OAuth routes answer 404 otherwise. */
 export function isOAuthEnabled(config) {
     return getMcpAccessOptions(config).oauth.enabled;
 }
-/** Authorization server metadata (RFC 8414 §2). Tokens are opaque: no `jwks_uri`, no OpenID. */
-export function getAuthorizationServerMetadata(config) {
-    const issuer = getOAuthIssuer(config);
+/** The app's extra keys under the generated ones (`oauth.metadata`). */
+function readExtension(extension, origins) {
+    if (extension === undefined)
+        return {};
+    return typeof extension === "function" ? extension(origins) : extension;
+}
+/**
+ * Authorization server metadata (RFC 8414 §2), with the app's `oauth.metadata.authorizationServer`
+ * keys added; generated keys win. Tokens are opaque: no OpenID.
+ */
+export function getAuthorizationServerMetadata(config, origins = resolveMcpOrigins(config)) {
+    const issuer = getOAuthIssuer(config, origins);
     const routes = getMcpAccessRoutes(config);
     return {
+        ...readExtension(getMcpAccessOptions(config).oauth.metadata.authorizationServer, origins),
         issuer,
         authorization_endpoint: `${issuer}${routes.oauthConsent}`,
         token_endpoint: `${issuer}${routes.oauthToken}`,
@@ -79,35 +95,40 @@ export function getAuthorizationServerMetadata(config) {
     };
 }
 /**
- * Protected resource metadata (RFC 9728 §2). At the endpoint's own path the resource is the
- * endpoint URL; at the root it is the origin, because RFC 9728 §3.3 ties `resource` to the URL the
- * metadata URL was built from.
+ * Protected resource metadata (RFC 9728 §2), with the app's `oauth.metadata.protectedResource`
+ * keys added; generated keys win, except the app's `resource_name`. At the endpoint's own path the
+ * resource is the endpoint URL; at the root it is the origin the document was asked on
+ * (`servedOrigin`, one of `resourceOrigins`) or else the app origin, because RFC 9728 §3.3 ties
+ * `resource` to the URL the metadata URL was built from.
  */
-export function getProtectedResourceMetadata(config, variant) {
+export function getProtectedResourceMetadata(config, variant, origins = resolveMcpOrigins(config), servedOrigin = null) {
+    const issuer = getOAuthIssuer(config, origins);
     return {
-        resource: variant === "endpoint" ? getMcpEndpointUrl(config) : getOAuthIssuer(config),
-        authorization_servers: [getOAuthIssuer(config)],
+        resource_name: getMcpAccessOptions(config).serverName,
+        ...readExtension(getMcpAccessOptions(config).oauth.metadata.protectedResource, origins),
+        resource: variant === "endpoint" ? getMcpEndpointUrl(config, origins) : (servedOrigin ?? issuer),
+        authorization_servers: [issuer],
         scopes_supported: [...OAUTH_SCOPES],
         bearer_methods_supported: ["header"],
-        resource_name: getMcpAccessOptions(config).serverName,
     };
 }
-/** `GET` of a discovery document; 404 while OAuth is off. */
-export function serveDiscoveryDocument(config, document) {
+/** `GET` of a discovery document for `request` (its origins); 404 while OAuth is off. */
+export function serveDiscoveryDocument(config, document, request = null) {
     if (!isOAuthEnabled(config))
         return Response.json({ error: "not_found" }, { status: 404, headers: CORS_HEADERS });
-    return Response.json(document(config), { headers: { ...CORS_HEADERS, ...DISCOVERY_CACHE } });
+    return Response.json(document(config, resolveMcpOrigins(config, request), request), { headers: { ...CORS_HEADERS, ...DISCOVERY_CACHE } });
 }
+/** `serveDiscoveryDocument`'s builder for the root protected resource metadata, on the host it was asked on. */
+export const getRootProtectedResourceMetadata = (config, origins, request) => getProtectedResourceMetadata(config, "root", origins, request === null ? null : findServedResourceOrigin(origins, request));
 /**
  * Whether `resource` (RFC 8707) names this server: absent (clients from before RFC 8707), the
- * endpoint URL or the origin, each with or without a trailing slash.
+ * endpoint URL, the app origin or one of `resourceOrigins`, each with or without a trailing slash.
  */
-export function isAcceptableResource(config, resource) {
+export function isAcceptableResource(config, resource, origins = resolveMcpOrigins(config)) {
     if (resource === null || resource === "")
         return true;
-    const endpoint = getMcpEndpointUrl(config).replace(/\/+$/, "");
-    const origin = getOAuthIssuer(config);
-    return [endpoint, `${endpoint}/`, origin, `${origin}/`].includes(resource);
+    const endpoint = getMcpEndpointUrl(config, origins).replace(/\/+$/, "");
+    return [endpoint, getOAuthIssuer(config, origins), ...origins.resourceOrigins].some((accepted) => resource === accepted || resource === `${accepted}/`);
 }
 /** Whether the client asks to write. Unknown scopes are ignored (RFC 6749 §3.3); every grant reads. */
 export function isWriteScopeRequested(scope) {
@@ -146,6 +167,15 @@ async function limitProtocolRequest(ctx, request, clientId = null) {
     }
 }
 // ---------------------------------------------------------------------------------------------
+// Request bodies
+/** The body as text, read up to `oauth.maxBodyBytes`: registration and token are public, so the cap comes before any parsing. */
+function readCappedBody(config, request) {
+    return readSmallBody(request, { maxBytes: getMcpAccessOptions(config).oauth.maxBodyBytes });
+}
+function bodyTooLarge(config) {
+    return protocolError("invalid_request", `The request body is larger than ${String(getMcpAccessOptions(config).oauth.maxBodyBytes)} bytes.`, 413);
+}
+// ---------------------------------------------------------------------------------------------
 // Registration
 /**
  * `POST` dynamic client registration (RFC 7591). Public by definition: claude.ai and ChatGPT
@@ -157,12 +187,16 @@ export async function handleClientRegistration(ctx, request) {
     const limited = await limitProtocolRequest(ctx, request);
     if (limited !== null)
         return limited;
+    const notJson = () => protocolError("invalid_client_metadata", "The request body must be a JSON object.");
+    const text = await readCappedBody(ctx.config, request);
+    if (!text.ok)
+        return text.error === "security.body_too_large" ? bodyTooLarge(ctx.config) : notJson();
     let body;
     try {
-        body = await request.json();
+        body = JSON.parse(text.value);
     }
     catch {
-        return protocolError("invalid_client_metadata", "The request body must be a JSON object.");
+        return notJson();
     }
     const parsed = parseClientRegistration(body);
     if (!parsed.ok)
@@ -222,7 +256,14 @@ const INVALID_GRANT = "The code or refresh token is invalid, expired, used or is
 export async function handleTokenRequest(ctx, request) {
     if (!isOAuthEnabled(ctx.config))
         return protocolError("not_found", "OAuth is not enabled.", 404);
-    const form = new URLSearchParams(await request.text().catch(() => ""));
+    const origins = resolveMcpOrigins(ctx.config, request);
+    const text = await readCappedBody(ctx.config, request);
+    if (!text.ok && text.error === "security.body_too_large") {
+        // Counted by address alone: the client id inside an oversized body is never read.
+        return (await limitProtocolRequest(ctx, request)) ?? bodyTooLarge(ctx.config);
+    }
+    // An unreadable body is an empty form, which the client check refuses.
+    const form = new URLSearchParams(text.ok ? text.value : "");
     const credentials = readClientCredentials(request, form);
     const limited = await limitProtocolRequest(ctx, request, credentials.clientId);
     if (limited !== null)
@@ -232,15 +273,15 @@ export async function handleTokenRequest(ctx, request) {
         if (client === null || !isClientSecretValid(client, credentials.clientSecret === "" ? null : credentials.clientSecret)) {
             return protocolError("invalid_client", "Unknown client or wrong client credentials.", 401, credentials.isBasic ? { "www-authenticate": 'Basic realm="mcp"' } : {});
         }
-        return await answerGrant(ctx, form, client);
+        return await answerGrant(ctx, { form, client, origins });
     }
     catch (error) {
         console.error(`@softure-ai/mcp-access: the OAuth token endpoint failed: ${errorLogLabel(error)}`);
         return protocolError("server_error", "The token could not be issued.", 500);
     }
 }
-async function answerGrant(ctx, form, client) {
-    if (!isAcceptableResource(ctx.config, form.get("resource"))) {
+async function answerGrant(ctx, { form, client, origins }) {
+    if (!isAcceptableResource(ctx.config, form.get("resource"), origins)) {
         return protocolError("invalid_target", "The resource parameter does not name this MCP server.");
     }
     const grantType = form.get("grant_type");
@@ -267,9 +308,9 @@ async function answerGrant(ctx, form, client) {
  * The client's redirect URI with parameters added, keeping the query it registered (RFC 6749
  * §3.1.2), and always `iss` (RFC 9207), so the client knows the answer came from this server.
  */
-export function buildClientRedirect(config, redirectUri, params) {
+export function buildClientRedirect(config, redirectUri, params, origins = resolveMcpOrigins(config)) {
     const url = new URL(redirectUri);
-    for (const [key, value] of Object.entries({ ...params, iss: getOAuthIssuer(config) })) {
+    for (const [key, value] of Object.entries({ ...params, iss: getOAuthIssuer(config, origins) })) {
         if (value !== null)
             url.searchParams.set(key, value);
     }
@@ -289,9 +330,10 @@ export function readAuthorizationParams(source) {
  * Validates an authorization request (RFC 6749 §4.1.1), for the consent page and the decision.
  * Order is a security rule (RFC 6749 §4.1.2.1): until the client and its redirect URI are
  * confirmed, an error is shown to the person, never redirected, or the server would redirect
- * anyone anywhere. Only then do errors go back to the client.
+ * anyone anywhere. Only then do errors go back to the client. `origins` are the request's
+ * (the consent page's and the decision's must agree); without them, the configured ones.
  */
-export async function validateAuthorizationRequest(ctx, params) {
+export async function validateAuthorizationRequest(ctx, params, origins = resolveMcpOrigins(ctx.config)) {
     const clientId = params.get("client_id");
     const client = clientId === null ? null : await findOAuthClient(ctx, clientId);
     if (client === null)
@@ -303,7 +345,7 @@ export async function validateAuthorizationRequest(ctx, params) {
     const back = (error, description) => ({
         kind: "redirect-error",
         redirectUri,
-        location: buildClientRedirect(ctx.config, redirectUri, { error, error_description: description, state }),
+        location: buildClientRedirect(ctx.config, redirectUri, { error, error_description: description, state }, origins),
     });
     if (params.get("response_type") !== "code")
         return back("unsupported_response_type", "Only response_type=code is supported.");
@@ -311,7 +353,7 @@ export async function validateAuthorizationRequest(ctx, params) {
     if (codeChallenge === null || !isValidCodeChallenge(codeChallenge) || params.get("code_challenge_method") !== PKCE_METHOD) {
         return back("invalid_request", "PKCE is required: code_challenge with code_challenge_method S256.");
     }
-    if (!isAcceptableResource(ctx.config, params.get("resource")))
+    if (!isAcceptableResource(ctx.config, params.get("resource"), origins))
         return back("invalid_target", "The resource parameter does not name this MCP server.");
     return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteScopeRequested(params.get("scope")) } };
 }
@@ -322,10 +364,22 @@ export function getConsentPath(config, params) {
 function seeOther(location) {
     return new Response(null, { status: 303, headers: { location, "cache-control": "no-store" } });
 }
-/** Whether the form was posted from this app: `Origin` must be the app's origin. */
-function isSameOrigin(config, request) {
+/** Whether the form was posted from this app: `Origin` must be the request's app origin. */
+function isSameOrigin(request, origins) {
     const origin = request.headers.get("origin");
-    return origin !== null && origin === getOAuthIssuer(config);
+    return origin !== null && origin === origins.appOrigin;
+}
+/**
+ * The consent form, read up to `oauth.maxBodyBytes`, or the answer to a body that is too large
+ * (413) or unreadable (400). Parsed by the platform, so urlencoded and multipart forms both work.
+ */
+async function readDecisionForm(config, request) {
+    const refuse = (status) => new Response(null, { status, headers: { "cache-control": "no-store" } });
+    const text = await readCappedBody(config, request);
+    if (!text.ok)
+        return refuse(text.error === "security.body_too_large" ? 413 : 400);
+    const parsed = new Response(text.value, { headers: { "content-type": request.headers.get("content-type") ?? "" } });
+    return (await parsed.formData().catch(() => null)) ?? refuse(400);
 }
 /**
  * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
@@ -337,24 +391,25 @@ function isSameOrigin(config, request) {
 export async function handleAuthorizationDecision(ctx, request, userId) {
     if (!isOAuthEnabled(ctx.config))
         return new Response(null, { status: 404 });
-    if (!isSameOrigin(ctx.config, request))
+    const origins = resolveMcpOrigins(ctx.config, request);
+    if (!isSameOrigin(request, origins))
         return new Response(null, { status: 403, headers: { "cache-control": "no-store" } });
-    const form = await request.formData().catch(() => null);
-    if (form === null)
-        return new Response(null, { status: 400, headers: { "cache-control": "no-store" } });
+    const form = await readDecisionForm(ctx.config, request);
+    if (form instanceof Response)
+        return form;
     const params = readAuthorizationParams(form);
     const consent = getConsentPath(ctx.config, params);
     if (userId === null)
         return seeOther(consent);
     try {
-        const outcome = await validateAuthorizationRequest(ctx, params);
+        const outcome = await validateAuthorizationRequest(ctx, params, origins);
         if (outcome.kind === "show-error")
             return seeOther(consent);
         if (outcome.kind === "redirect-error")
             return seeOther(outcome.location);
         const { client, redirectUri, state, codeChallenge, isWriteRequested } = outcome.request;
         if (form.get("decision") !== "allow") {
-            return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }));
+            return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }, origins));
         }
         const code = await createAuthorizationCode(ctx, {
             clientRowId: client.id,
@@ -364,7 +419,7 @@ export async function handleAuthorizationDecision(ctx, request, userId) {
             // Writes need the client's request, the app's allowWrites and the person's tick.
             canWrite: isWriteRequested && getMcpAccessOptions(ctx.config).allowWrites && form.get("canWrite") !== null,
         });
-        return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }));
+        return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }, origins));
     }
     catch (error) {
         console.error(`@softure-ai/mcp-access: recording an OAuth decision failed: ${errorLogLabel(error)}`);

package/dist/server/oauth-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,qDAAqD;AACrD,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC;AAEnE,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB;IACnE,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,8BAA8B,CAAC,MAAqB;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAqB,EAAE,OAA4B;IAC9F,OAAO;QACL,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;QACrF,qBAAqB,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;KACtD,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA4C;IACxG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB;IACjF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,IAAqB,EAAE,MAAsB;IAC7F,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,WAAmB,EAAE,MAA+C;IAC7H,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACtF,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,GAAqB,EAAE,MAAuB;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;KACzG,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IACtJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,MAAqB,EAAE,OAAgB;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAA4B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAA0C,MAAM,eAAe,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AAEpG,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,iBAAiB;AAEjB,iIAAiI;AACjI,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnJ,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;QACzD,kFAAkF;QAClF,OAAO,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAgB;IACrE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/options.d.ts

@@ -1,6 +1,7 @@
 import { type Locale, type SoftureConfig } from "@softure-ai/core";
 import type { McpAccessMessages } from "../messages/index.js";
 import type { McpAccessOptions } from "../options.js";
+import type { McpOrigins } from "../origins.js";
 /** The enabled module. Throws when the app did not enable it: calling its functions then is a bug. */
 export declare function getMcpAccessModule(config: SoftureConfig): import("@softure-ai/core").AnySoftureModule;
 export declare function getMcpAccessOptions(config: SoftureConfig): McpAccessOptions;
@@ -19,8 +20,8 @@ export interface McpAccessRoutes {
     readonly oauthRegister: string;
 }
 export declare function getMcpAccessRoutes(config: SoftureConfig): McpAccessRoutes;
-/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
-export declare function getMcpEndpointUrl(config: SoftureConfig): string;
+/** The absolute URL MCP clients call: the app's origin (the request's, when given) and the endpoint route. */
+export declare function getMcpEndpointUrl(config: SoftureConfig, origins?: McpOrigins): string;
 /** The module's copy in the app's locale, with the app's overrides applied. */
 export declare function getMcpAccessMessages(config: SoftureConfig): McpAccessMessages;
 /** The text in `locale`, else in `en`. */

package/dist/server/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,+CAMvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAG3E;AAED,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBzE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAG7E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9F"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,+CAMvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAG3E;AAED,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBzE;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAErF;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAG7E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9F"}

package/dist/server/options.js

@@ -31,9 +31,9 @@ export function getMcpAccessRoutes(config) {
         oauthRegister: read("oauthRegister"),
     };
 }
-/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
-export function getMcpEndpointUrl(config) {
-    return new URL(getMcpAccessRoutes(config).endpoint, config.appOrigin).toString();
+/** The absolute URL MCP clients call: the app's origin (the request's, when given) and the endpoint route. */
+export function getMcpEndpointUrl(config, origins) {
+    return new URL(getMcpAccessRoutes(config).endpoint, origins?.appOrigin ?? config.appOrigin).toString();
 }
 /** The module's copy in the app's locale, with the app's overrides applied. */
 export function getMcpAccessMessages(config) {

package/dist/server/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,SAAS,EAAmC,MAAM,kBAAkB,CAAC;AAI9E,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,uEAAuE;IACvE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAA2B,CAAC;AAChE,CAAC;AAiBD,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAU,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,uCAAuC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QAC1B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,+EAA+E;IAC/E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAsB,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,MAAc;IACpF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,SAAS,EAAmC,MAAM,kBAAkB,CAAC;AAK9E,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,uEAAuE;IACvE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAA2B,CAAC;AAChE,CAAC;AAiBD,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAU,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,uCAAuC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QAC1B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAoB;IAC3E,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzG,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,+EAA+E;IAC/E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAsB,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,MAAc;IACpF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/server/origins.d.ts

@@ -0,0 +1,8 @@
+import type { SoftureConfig } from "@softure-ai/core";
+import type { McpOriginRequest, McpOrigins } from "../origins.js";
+/**
+ * The origins for `request`, or the configured ones without a request. A resolver that returns
+ * something other than a bare http(s) origin is a setup bug: thrown by name, never served.
+ */
+export declare function resolveMcpOrigins(config: SoftureConfig, request?: McpOriginRequest | null): McpOrigins;
+//# sourceMappingURL=origins.d.ts.map

package/dist/server/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGlE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,UAAU,CAOtG"}

package/dist/server/origins.js

@@ -0,0 +1,15 @@
+import { isBareOrigin } from "../options.js";
+import { getMcpAccessOptions } from "./options.js";
+/**
+ * The origins for `request`, or the configured ones without a request. A resolver that returns
+ * something other than a bare http(s) origin is a setup bug: thrown by name, never served.
+ */
+export function resolveMcpOrigins(config, request) {
+    const options = getMcpAccessOptions(config);
+    const resolved = request === undefined || request === null || options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
+    if (resolved !== null && !isBareOrigin(resolved)) {
+        throw new Error(`@softure-ai/mcp-access: resolveAppOrigin returned "${resolved.slice(0, 100)}", which is not an http(s) origin without a path`);
+    }
+    return { appOrigin: new URL(resolved ?? config.appOrigin).origin, resourceOrigins: options.resourceOrigins };
+}
+//# sourceMappingURL=origins.js.map

package/dist/server/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAiC;IACxF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChJ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;AAC/G,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "dependsOn": { "security": "^0.1.0", "auth": "^0.1.0" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -32,7 +32,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.1.7",
+    version: "0.1.9",
     dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],
@@ -94,12 +94,17 @@ export {
   MAX_TOKEN_NAME_LENGTH,
   SERVER_NAME_PATTERN,
   TOOL_NAME_PATTERN,
+  GENERATED_AUTHORIZATION_SERVER_KEYS,
+  GENERATED_PROTECTED_RESOURCE_KEYS,
   type McpAccessOptions,
   type McpAccessOptionsInput,
+  type McpAppOriginResolver,
+  type McpMetadataExtension,
   type McpOAuthOptions,
   type McpToolAccess,
   type McpToolDefinition,
   type McpToolDefinitionInput,
 } from "./options.js";
-export { accessTokens, oauthAuthorizationCodes, oauthClients, oauthGrants } from "./schema.js";
+export { readRequestOrigin, type McpOriginRequest, type McpOrigins } from "./origins.js";
+export { accessTokens, oauthAuthorizationCodes, oauthClients, oauthGrants, type OAuthClientRow, type OAuthTokenEndpointAuthMethod } from "./schema.js";
 export { getAccessTokenStatus, type AccessTokenStatusOptions } from "./token-status.js";

package/src/next/actions.ts

@@ -14,7 +14,7 @@ import { MAX_TOKEN_NAME_LENGTH } from "../options.js";
 import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "../server/options.js";
 import { revokeOAuthGrant } from "../server/oauth.js";
 import { issueAccessToken, revokeAccessToken } from "../server/tokens.js";
-import { getMcpAccessContext } from "./context.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 import { formatDate } from "./format.js";
 
 /** Longer values are cut: the server functions refuse them anyway, and nothing huge is echoed back. */
@@ -49,6 +49,8 @@ export async function issueTokenAction(_previous: IssueTokenFormState, formData:
   // Every field has a `catch`, so parsing cannot fail.
   const input = issueInput.parse({ name: formData.get("name"), canWrite: formData.get("canWrite") });
   try {
+    // Resolved before issuing: a failure afterwards would leave a token nobody received.
+    const endpointUrl = getMcpEndpointUrl(config, await getRequestOrigins(config, getMcpAccessRoutes(config).page));
     const result = await issueAccessToken(await getMcpAccessContext(config), { userId: user.id, name: input.name, canWrite: input.canWrite !== null });
     if (!result.ok) return { status: "error", error: result.error };
     refreshPage(config);
@@ -63,7 +65,7 @@ export async function issueTokenAction(_previous: IssueTokenFormState, formData:
         expiresText: formatMessage(messages.issued.expires, { date: formatDate(config, issued.expiresAt) }),
         setup: getMcpClientSetup({
           serverName: getMcpAccessOptions(config).serverName,
-          endpointUrl: getMcpEndpointUrl(config),
+          endpointUrl,
           token: issued.token,
           promptTemplate: messages.setup.assistantPrompt,
         }),

package/src/next/context.ts

@@ -1,14 +1,21 @@
 // What the adapter hands the server functions: the registered config, the process-wide database
 // handle and the wall clock.
-import { systemClock, type SoftureConfig } from "@softure-ai/core";
+import type { SoftureConfig } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
-import { getConfiguredDatabase } from "@softure-ai/db";
+import type { McpOrigins } from "../origins.js";
+import { createMcpAccessContext } from "../server/context.js";
+import { resolveMcpOrigins } from "../server/origins.js";
 import type { McpAccessContext } from "../server/tokens.js";
 
-export async function getMcpAccessContext(config: SoftureConfig = getSoftureConfig()): Promise<McpAccessContext> {
-  if (config.database === null) {
-    throw new Error("@softure-ai/mcp-access: softure.config.ts has no database; mcp-access needs one");
-  }
-  const { db } = await getConfiguredDatabase(config.database);
-  return { db, clock: systemClock, config };
+export function getMcpAccessContext(config: SoftureConfig = getSoftureConfig()): Promise<McpAccessContext> {
+  return createMcpAccessContext(config);
+}
+
+/**
+ * The origins of the request a page or a server action runs in, from Next's `headers()`: the same
+ * ones the route handlers resolve, so the consent page and its decision agree.
+ */
+export async function getRequestOrigins(config: SoftureConfig, path: string): Promise<McpOrigins> {
+  const { headers } = await import("next/headers");
+  return resolveMcpOrigins(config, { url: new URL(path, config.appOrigin).toString(), headers: await headers() });
 }

package/src/next/index.ts

@@ -10,5 +10,6 @@ export {
   getProtectedResourceMetadataRoute,
   registerOAuthClientRoute,
 } from "./oauth-routes.js";
+export { getMcpAccessContext } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";

package/src/next/oauth-page.tsx

@@ -13,7 +13,7 @@ import { getConsentPath, isOAuthEnabled, readAuthorizationParams, validateAuthor
 import { describeRedirectUri } from "../server/oauth-validation.js";
 import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
 import { ConsentError, ConsentForm } from "../ui/consent-form.js";
-import { getMcpAccessContext } from "./context.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 
 type SearchParams = Promise<Record<string, string | string[] | undefined>>;
 
@@ -31,7 +31,8 @@ export async function OAuthConsentPage({ searchParams }: OAuthConsentPageProps)
   const user = await requireUser({ next: getConsentPath(config, params), searchParams: query });
 
   const messages = getMcpAccessMessages(config);
-  const outcome = await validateAuthorizationRequest(await getMcpAccessContext(config), params);
+  const origins = await getRequestOrigins(config, getMcpAccessRoutes(config).oauthConsent);
+  const outcome = await validateAuthorizationRequest(await getMcpAccessContext(config), params, origins);
   if (outcome.kind !== "valid") {
     const message =
       outcome.kind === "redirect-error" ? messages.consent.invalidRequest : outcome.reason === "unknown_client" ? messages.consent.unknownClient : messages.consent.redirectMismatch;