@thoughtspot/mcp-auth 2.1.1 → 3.0.0

package/README.md

@@ -53,6 +53,34 @@ export default {
 
 The token callback page expects `oauth-callback.{html,css,js}` available via an `assetsFetcher`. Either ship the bundled assets in `./assets/` to your Worker's `[assets]` binding, or pass a custom fetcher.
 
+## OAuth state (3.0.0+)
+
+The authorization request is kept server-side in the `OAUTH_KV` binding (the same namespace the OAuth provider uses) under an opaque, single-use state ID, bound to the browser that started the flow with an `HttpOnly; Secure; SameSite=Lax` `__Host-` cookie. Only the state ID travels through the approval form, the SAML `targetURLPath` and `/callback`.
+
+Custom callback pages must follow this contract:
+
+- `oauth-callback.html` contains `<script type="application/json" id="oauth-flow">{{OAUTH_FLOW}}</script>`. It is replaced with `{"state": "...", "instanceUrl": "..."}`.
+- The page posts `{ "token": { "data": { "token": "..." } }, "state": "<state>" }` to `/store-token`. Any `oauthReqInfo` or `instanceUrl` in the body is ignored.
+- A `403` from `/callback` or `/store-token` means the state is missing, expired, already used, or was opened in a different browser; the response body is a message safe to show the user.
+
+### Local development over plain HTTP
+
+Browsers drop `Secure` / `__Host-` cookies set over plain HTTP unless the host is `localhost`, `*.localhost` or a loopback IP. A hosts-file alias such as `http://myserver.com` does not qualify, so the binding cookie is lost and every flow fails with a 403.
+
+For local development only, add this to `.dev.vars`:
+
+```
+OAUTH_ALLOW_INSECURE_DEV_COOKIE=true
+```
+
+HTTP requests then use a `ts_mcp_oauth_binding` cookie without `Secure` (still `HttpOnly; SameSite=Lax`), and a warning is logged each time one is issued. HTTPS requests always get the `__Host-` / `Secure` cookie, even with the variable set. Never set it in a deployed environment.
+
+### Upgrading from 2.x
+
+- Replace the `{{OAUTH_REQ_INFO}}` script block with the `{{OAUTH_FLOW}}` one above, stop reading `window.INSTANCE_URL`, and send `state` instead of `oauthReqInfo`/`instanceUrl` to `/store-token`. The bundled `./assets/` already do this.
+- `renderTokenCallback(flow, assets, origin)`, `renderApprovalDialog(request, { stateId, ... })`, `parseRedirectApproval()` (returns `{ stateId, instanceUrl }`) and `buildSamlRedirectUrl(instanceUrl, stateId, origin)` changed signatures.
+- Authorization flows in progress during the upgrade must be restarted. Existing grants and tokens are unaffected.
+
 ## License
 
 ThoughtSpot Development Tools End User License Agreement — see [LICENSE](LICENSE).

package/assets/oauth-callback.html

@@ -58,7 +58,7 @@
             </div>
         </div>
     </div>
-    <script type="application/json" id="oauth-req-info">{{OAUTH_REQ_INFO}}</script>
+    <script type="application/json" id="oauth-flow">{{OAUTH_FLOW}}</script>
     <script src="oauth-callback.js"></script>
 </body>
 </html> 

package/assets/oauth-callback.js

@@ -1,7 +1,19 @@
 // Immediately invoke the async function
 (async () => {
-    const oauthReqInfo = JSON.parse(document.getElementById('oauth-req-info').textContent);
-    
+    // /store-token answers errors in plain text, but fall back gracefully if a
+    // JSON body ({ error } or { message }) comes back instead.
+    async function readErrorMessage(response) {
+        const text = await response.text();
+        try {
+            const parsed = JSON.parse(text);
+            return parsed?.error || parsed?.message || text;
+        } catch {
+            return text;
+        }
+    }
+
+    let oauthFlow;
+
     // Ensure manual section is hidden initially
     const manualSection = document.getElementById('manual-token-section');
     const freeTrialErrorSection = document.getElementById('free-trial-error-section');
@@ -9,12 +21,15 @@
     manualSection.style.display = 'none';
 
     try {
-        // Check if INSTANCE_URL is available and valid
-        if (!window.INSTANCE_URL) {
+        // Parsed inside try so a malformed block shows an error, not a stuck spinner.
+        oauthFlow = JSON.parse(document.getElementById('oauth-flow').textContent);
+
+        // Check the instance URL is available
+        if (!oauthFlow.instanceUrl) {
             throw new Error('Instance URL not available. Please ensure you accessed this page through the proper OAuth flow.');
         }
 
-        const base = new URL(window.INSTANCE_URL);
+        const base = new URL(oauthFlow.instanceUrl);
         if (!base.pathname.endsWith('/')) {
             base.pathname += '/';
         }
@@ -108,15 +123,13 @@
                             },
                             body: JSON.stringify({ 
                                 token: tokenData,
-                                oauthReqInfo: oauthReqInfo,
-                                instanceUrl: window.INSTANCE_URL
+                                state: oauthFlow.state
                             })
                         });
-                        const responseData = await storeResponse.json();
                         if (!storeResponse.ok) {
-                            const errorText = await storeResponse.text();
-                            throw new Error(`Failed to store token (Status: ${storeResponse.status}): ${errorText}`);
+                            throw new Error(await readErrorMessage(storeResponse));
                         }
+                        const responseData = await storeResponse.json();
                         window.location.href = responseData.redirectTo;
                     } catch (err) {
                         document.getElementById('status').textContent = err.message;
@@ -140,16 +153,13 @@
             },
             body: JSON.stringify({ 
                 token: data,
-                oauthReqInfo: oauthReqInfo,
-                instanceUrl: window.INSTANCE_URL
+                state: oauthFlow.state
             })
         });
-        const responseData = await storeResponse.json();
-
         if (!storeResponse.ok) {
-            const errorText = await storeResponse.text();
-            throw new Error(`Failed to store token (Status: ${storeResponse.status}): ${errorText}`);
+            throw new Error(await readErrorMessage(storeResponse));
         }
+        const responseData = await storeResponse.json();
 
         window.location.href = responseData.redirectTo;
         

package/dist/auth-state.d.ts

@@ -0,0 +1,53 @@
+import type { AuthRequest } from "@cloudflare/workers-oauth-provider";
+/**
+ * Server-side record of an in-flight OAuth authorization.
+ *
+ * The validated auth request from GET /authorize is kept here, and only the
+ * opaque `stateId` travels through the browser (approval form, SAML
+ * targetURLPath, /callback, /store-token). Each record is bound to the browser
+ * that started the flow via an HttpOnly cookie, so a state ID minted by one
+ * browser cannot be completed from another.
+ */
+/** Long enough for SAML + MFA, or logging in to a free trial in another tab. */
+export declare const AUTH_STATE_TTL_SECONDS: number;
+export declare const BROWSER_BINDING_COOKIE = "__Host-ts_mcp_oauth_binding";
+/**
+ * Local-development fallback for plain-HTTP hosts other than localhost (e.g. a
+ * hosts-file alias), where browsers drop `Secure` / `__Host-` cookies.
+ */
+export declare const DEV_BROWSER_BINDING_COOKIE = "ts_mcp_oauth_binding";
+/** Shown for every state failure so callers can't tell missing, expired and mismatched apart. */
+export declare const INVALID_AUTH_STATE_MESSAGE = "This sign-in link has expired or was opened in a different browser. Restart the connection from your MCP client.";
+export interface AuthStateRecord {
+    oauthReqInfo: AuthRequest;
+    instanceUrl?: string;
+    bindingHash: string;
+    expiresAt: number;
+}
+export interface BrowserBinding {
+    bindingId: string;
+    setCookieHeader: string;
+}
+export interface BindingCookieOptions {
+    /**
+     * Local development only: on plain-HTTP requests, use a cookie without
+     * `Secure` / `__Host-`. HTTPS requests always get the secure cookie.
+     */
+    allowInsecureDevCookie?: boolean;
+}
+/**
+ * Reuses the browser's existing binding cookie, or creates one. Reusing it lets
+ * several OAuth flows run in the same browser without overwriting each other.
+ * The cookie is always re-issued so its lifetime covers the newest flow.
+ */
+export declare function getOrCreateBrowserBinding(request: Request, options?: BindingCookieOptions): BrowserBinding;
+export declare function createAuthState(kv: KVNamespace, oauthReqInfo: AuthRequest, bindingId: string): Promise<string>;
+/**
+ * Loads a state record and checks it belongs to the calling browser. Throws a
+ * generic 403 when the state is missing, expired, or bound to another browser.
+ */
+export declare function loadAuthState(kv: KVNamespace, stateId: string | null | undefined, request: Request, options?: BindingCookieOptions): Promise<AuthStateRecord>;
+export declare function setAuthStateInstanceUrl(kv: KVNamespace, stateId: string, record: AuthStateRecord, instanceUrl: string): Promise<AuthStateRecord>;
+/** Deletes the record so the state cannot be used to mint a second grant. */
+export declare function consumeAuthState(kv: KVNamespace, stateId: string): Promise<void>;
+//# sourceMappingURL=auth-state.d.ts.map

package/dist/auth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAItE;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAAU,CAAC;AAE9C,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,qHAC4E,CAAC;AAEpH,MAAM,WAAW,eAAe;IAC/B,YAAY,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC;AAuDD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GAChC,cAAc,CA4BhB;AAED,wBAAsB,eAAe,CACpC,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,WAAW,EACzB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAClC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GAChC,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAED,wBAAsB,uBAAuB,CAC5C,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED,6EAA6E;AAC7E,wBAAsB,gBAAgB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth-state.js

@@ -0,0 +1,143 @@
+import { timingSafeEqual } from "node:crypto";
+import { parse, serialize } from "hono/utils/cookie";
+import { McpServerError } from "./errors";
+/**
+ * Server-side record of an in-flight OAuth authorization.
+ *
+ * The validated auth request from GET /authorize is kept here, and only the
+ * opaque `stateId` travels through the browser (approval form, SAML
+ * targetURLPath, /callback, /store-token). Each record is bound to the browser
+ * that started the flow via an HttpOnly cookie, so a state ID minted by one
+ * browser cannot be completed from another.
+ */
+/** Long enough for SAML + MFA, or logging in to a free trial in another tab. */
+export const AUTH_STATE_TTL_SECONDS = 15 * 60;
+const AUTH_STATE_KEY_PREFIX = "mcp_auth_state:";
+export const BROWSER_BINDING_COOKIE = "__Host-ts_mcp_oauth_binding";
+/**
+ * Local-development fallback for plain-HTTP hosts other than localhost (e.g. a
+ * hosts-file alias), where browsers drop `Secure` / `__Host-` cookies.
+ */
+export const DEV_BROWSER_BINDING_COOKIE = "ts_mcp_oauth_binding";
+/** Shown for every state failure so callers can't tell missing, expired and mismatched apart. */
+export const INVALID_AUTH_STATE_MESSAGE = "This sign-in link has expired or was opened in a different browser. Restart the connection from your MCP client.";
+async function sha256Hex(input) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+function usesInsecureDevCookie(request, options) {
+    return (options.allowInsecureDevCookie === true &&
+        new URL(request.url).protocol === "http:");
+}
+function bindingCookieName(request, options) {
+    return usesInsecureDevCookie(request, options)
+        ? DEV_BROWSER_BINDING_COOKIE
+        : BROWSER_BINDING_COOKIE;
+}
+function readBindingCookie(request, options) {
+    const cookieHeader = request.headers.get("Cookie");
+    if (!cookieHeader)
+        return undefined;
+    const name = bindingCookieName(request, options);
+    return parse(cookieHeader, name)[name];
+}
+function stateKey(stateId) {
+    return `${AUTH_STATE_KEY_PREFIX}${stateId}`;
+}
+function invalidAuthState() {
+    return new McpServerError({
+        message: "Invalid OAuth state",
+        userMessage: INVALID_AUTH_STATE_MESSAGE,
+    }, 403);
+}
+/**
+ * Reuses the browser's existing binding cookie, or creates one. Reusing it lets
+ * several OAuth flows run in the same browser without overwriting each other.
+ * The cookie is always re-issued so its lifetime covers the newest flow.
+ */
+export function getOrCreateBrowserBinding(request, options = {}) {
+    const bindingId = readBindingCookie(request, options) ?? crypto.randomUUID();
+    // Lax, not Strict: /callback is reached by a cross-site top-level redirect
+    // from ThoughtSpot / the IdP and must still carry the cookie.
+    if (usesInsecureDevCookie(request, options)) {
+        console.warn("OAuth binding cookie issued without Secure: insecure dev cookies are enabled for this HTTP request. Never enable this in production.");
+        return {
+            bindingId,
+            setCookieHeader: serialize(DEV_BROWSER_BINDING_COOKIE, bindingId, {
+                path: "/",
+                httpOnly: true,
+                sameSite: "Lax",
+                maxAge: AUTH_STATE_TTL_SECONDS,
+            }),
+        };
+    }
+    return {
+        bindingId,
+        setCookieHeader: serialize(BROWSER_BINDING_COOKIE, bindingId, {
+            path: "/",
+            secure: true,
+            httpOnly: true,
+            sameSite: "Lax",
+            maxAge: AUTH_STATE_TTL_SECONDS,
+        }),
+    };
+}
+export async function createAuthState(kv, oauthReqInfo, bindingId) {
+    const stateId = crypto.randomUUID();
+    const record = {
+        oauthReqInfo,
+        bindingHash: await sha256Hex(bindingId),
+        expiresAt: Date.now() + AUTH_STATE_TTL_SECONDS * 1000,
+    };
+    await kv.put(stateKey(stateId), JSON.stringify(record), {
+        expirationTtl: AUTH_STATE_TTL_SECONDS,
+    });
+    return stateId;
+}
+/**
+ * Loads a state record and checks it belongs to the calling browser. Throws a
+ * generic 403 when the state is missing, expired, or bound to another browser.
+ */
+export async function loadAuthState(kv, stateId, request, options = {}) {
+    const bindingId = readBindingCookie(request, options);
+    if (!stateId || !bindingId) {
+        throw invalidAuthState();
+    }
+    const raw = await kv.get(stateKey(stateId));
+    if (!raw) {
+        throw invalidAuthState();
+    }
+    let record;
+    try {
+        record = JSON.parse(raw);
+    }
+    catch (error) {
+        console.error("Corrupt OAuth state record:", error);
+        throw invalidAuthState();
+    }
+    if (Date.now() > record.expiresAt) {
+        throw invalidAuthState();
+    }
+    const expected = new TextEncoder().encode(record.bindingHash);
+    const actual = new TextEncoder().encode(await sha256Hex(bindingId));
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        throw invalidAuthState();
+    }
+    return record;
+}
+export async function setAuthStateInstanceUrl(kv, stateId, record, instanceUrl) {
+    const updated = { ...record, instanceUrl };
+    // expiresAt is unchanged, so the logical lifetime does not extend; the KV TTL
+    // only governs cleanup.
+    await kv.put(stateKey(stateId), JSON.stringify(updated), {
+        expirationTtl: AUTH_STATE_TTL_SECONDS,
+    });
+    return updated;
+}
+/** Deletes the record so the state cannot be used to mint a second grant. */
+export async function consumeAuthState(kv, stateId) {
+    await kv.delete(stateKey(stateId));
+}
+//# sourceMappingURL=auth-state.js.map

package/dist/auth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.js","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GACtC,kHAAkH,CAAC;AAsBpH,KAAK,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAC/B,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,qBAAqB,CAC7B,OAAgB,EAChB,OAA6B;IAE7B,OAAO,CACN,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACvC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CACzC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,OAAgB,EAChB,OAA6B;IAE7B,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,sBAAsB,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CACzB,OAAgB,EAChB,OAA6B;IAE7B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAChC,OAAO,GAAG,qBAAqB,GAAG,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACxB,OAAO,IAAI,cAAc,CACxB;QACC,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,0BAA0B;KACvC,EACD,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CACX,sIAAsI,CACtI,CAAC;QACF,OAAO;YACN,SAAS;YACT,eAAe,EAAE,SAAS,CAAC,0BAA0B,EAAE,SAAS,EAAE;gBACjE,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,sBAAsB;aAC9B,CAAC;SACF,CAAC;IACH,CAAC;IACD,OAAO;QACN,SAAS;QACT,eAAe,EAAE,SAAS,CAAC,sBAAsB,EAAE,SAAS,EAAE;YAC7D,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,sBAAsB;SAC9B,CAAC;KACF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAe,EACf,YAAyB,EACzB,SAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,MAAM,GAAoB;QAC/B,YAAY;QACZ,WAAW,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI;KACrD,CAAC;IACF,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QACvD,aAAa,EAAE,sBAAsB;KACrC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,EAAe,EACf,OAAkC,EAClC,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,EAAe,EACf,OAAe,EACf,MAAuB,EACvB,WAAmB;IAEnB,MAAM,OAAO,GAAoB,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,8EAA8E;IAC9E,wBAAwB;IACxB,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACxD,aAAa,EAAE,sBAAsB;KACrC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,EAAe,EACf,OAAe;IAEf,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/handlers.d.ts

@@ -4,7 +4,14 @@ import type { AssetsFetcher, AuthHooks, BaseProps, ServerInfo } from "./types";
 export interface AuthAppEnv {
     Bindings: {
         OAUTH_PROVIDER: OAuthHelpers;
+        /** Same KV namespace the OAuth provider uses; also holds in-flight auth state. */
+        OAUTH_KV: KVNamespace;
         ASSETS?: AssetsFetcher;
+        /**
+         * Local development only (e.g. in `.dev.vars`): "true" lets plain-HTTP
+         * requests use a binding cookie without `Secure`. Never set in production.
+         */
+        OAUTH_ALLOW_INSECURE_DEV_COOKIE?: string;
     } & Record<string, unknown>;
 }
 export interface CreateAuthAppOptions {

package/dist/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAa5B,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EAET,SAAS,EACT,UAAU,EACV,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QAAE,cAAc,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACP,CAAC;CACF;AAED,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;CAC9C;AAyBD,wBAAgB,aAAa,CAC5B,OAAO,EAAE,oBAAoB,GAC3B,IAAI,CAAC,UAAU,CAAC,CA8clB"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGX,YAAY,EACZ,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAqB5B,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EAET,SAAS,EACT,UAAU,EACV,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QACT,cAAc,EAAE,YAAY,CAAC;QAC7B,kFAAkF;QAClF,QAAQ,EAAE,WAAW,CAAC;QACtB,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB;;;WAGG;QACH,+BAA+B,CAAC,EAAE,MAAM,CAAC;KACzC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AA2DD,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;CAC9C;AAyBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC,CAoc7E"}

package/dist/handlers.js

@@ -1,9 +1,52 @@
 import { Hono } from "hono";
-import { decodeBase64Url, encodeBase64Url } from "hono/utils/encode";
+import { consumeAuthState, createAuthState, getOrCreateBrowserBinding, loadAuthState, setAuthStateInstanceUrl, } from "./auth-state";
 import { McpServerError } from "./errors";
-import { buildSamlRedirectUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, parseRedirectApproval, renderApprovalDialog, verifyClientSecret, } from "./oauth-utils";
+import { buildCallbackUrl, buildSamlRedirectUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, parseRedirectApproval, renderApprovalDialog, verifyClientSecret, } from "./oauth-utils";
 import { renderTokenCallback } from "./token-utils";
 import { PUBLIC_ROUTES } from "./routes";
+function bindingCookieOptions(env) {
+    return {
+        allowInsecureDevCookie: env.OAUTH_ALLOW_INSECURE_DEV_COOKIE === "true",
+    };
+}
+/** Workaround for https://thoughtspot.atlassian.net/browse/SCAL-258056 */
+const SAML_TARGET_PATH_SUFFIX = "/10023.html";
+const FREE_TRIAL_INSTANCE_PATTERN = /^https:\/\/(?:team|my)\d+\.thoughtspot\.cloud\/?$/;
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+/**
+ * Re-checks a stored auth request against its client before minting a grant.
+ * completeAuthorization() does not repeat parseAuthRequest()'s checks, so this
+ * guards against a record that was never validated (or a library change).
+ */
+function assertGrantableAuthRequest(oauthReqInfo, client) {
+    if (!client ||
+        oauthReqInfo.responseType !== "code" ||
+        oauthReqInfo.codeChallengeMethod !== "S256" ||
+        !oauthReqInfo.codeChallenge ||
+        !client.redirectUris.includes(oauthReqInfo.redirectUri)) {
+        throw new McpServerError({ message: "Invalid OAuth request" }, 400);
+    }
+}
+/** Responds with McpServerError's safe user message, or a generic 500. */
+function authErrorResponse(error) {
+    if (error instanceof McpServerError && error.statusCode < 500) {
+        return new Response(error.getUserMessage(), {
+            status: error.statusCode,
+            headers: {
+                "Content-Type": "text/plain; charset=utf-8",
+                ...NO_STORE_HEADERS,
+            },
+        });
+    }
+    console.error("OAuth flow error:", error);
+    return new Response("Internal server error", {
+        status: 500,
+        headers: {
+            "Content-Type": "text/plain; charset=utf-8",
+            ...NO_STORE_HEADERS,
+        },
+    });
+}
 function recordAuthMetric(hooks, name, status, c) {
     if (!hooks?.onAuthMetric)
         return;
@@ -23,12 +66,15 @@ export function createAuthApp(options) {
     const { serverInfo, hooks, assetsFetcher, extraRoutes } = options;
     const app = new Hono();
     const handler = {
-        async getAuthorize(request, oauthProvider) {
+        async getAuthorize(request, oauthProvider, kv, cookieOptions) {
             const oauthReqInfo = await oauthProvider.parseAuthRequest(request);
             const { clientId } = oauthReqInfo;
             if (!clientId) {
                 throw new McpServerError({ message: "Missing client ID" }, 400);
             }
+            if (oauthReqInfo.responseType !== "code") {
+                throw new McpServerError({ message: "Unsupported response type: only 'code' is allowed" }, 400);
+            }
             if (!oauthReqInfo.codeChallenge) {
                 throw new McpServerError({ message: "PKCE is required: missing code challenge" }, 400);
             }
@@ -36,31 +82,33 @@ export function createAuthApp(options) {
                 throw new McpServerError({ message: "PKCE code challenge method must be S256" }, 400);
             }
             const client = await oauthProvider.lookupClient(clientId);
-            return renderApprovalDialog(request, {
+            // Keep the validated request server-side; only the opaque state ID and
+            // a browser-binding cookie go to the browser.
+            const { bindingId, setCookieHeader } = getOrCreateBrowserBinding(request, cookieOptions);
+            const stateId = await createAuthState(kv, oauthReqInfo, bindingId);
+            const response = renderApprovalDialog(request, {
                 client,
                 serverInfo,
-                state: { oauthReqInfo },
+                stateId,
             });
+            response.headers.append("Set-Cookie", setCookieHeader);
+            response.headers.set("Cache-Control", "no-store");
+            return response;
         },
-        async postAuthorize(request, requestUrl) {
+        async postAuthorize(request, requestUrl, kv, cookieOptions) {
             try {
-                const { state, instanceUrl } = await parseRedirectApproval(request);
-                if (!state.oauthReqInfo) {
-                    throw new McpServerError({ message: "Missing OAuth request info" }, 400);
-                }
+                const { stateId, instanceUrl } = await parseRedirectApproval(request);
                 if (!instanceUrl) {
                     throw new McpServerError({ message: "Missing instance URL" }, 400);
                 }
+                const record = await loadAuthState(kv, stateId, request, cookieOptions);
+                await setAuthStateInstanceUrl(kv, stateId, record, instanceUrl);
                 const origin = new URL(requestUrl).origin;
                 // Free-trial shortcut: skip SAML, assume logged in.
-                if (instanceUrl.match(/^https:\/\/(?:team|my)\d+\.thoughtspot\.cloud\/?$/)) {
-                    const callbackUrl = new URL("/callback", origin);
-                    callbackUrl.searchParams.set("instanceUrl", instanceUrl);
-                    callbackUrl.searchParams.set("oauthReqInfo", encodeBase64Url(new TextEncoder().encode(JSON.stringify(state.oauthReqInfo))
-                        .buffer));
-                    return callbackUrl.toString();
+                if (FREE_TRIAL_INSTANCE_PATTERN.test(instanceUrl)) {
+                    return buildCallbackUrl(stateId, origin);
                 }
-                return buildSamlRedirectUrl(instanceUrl, state.oauthReqInfo, origin);
+                return buildSamlRedirectUrl(instanceUrl, stateId, origin);
             }
             catch (error) {
                 if (error instanceof McpServerError)
@@ -68,62 +116,58 @@ export function createAuthApp(options) {
                 throw new McpServerError(error, 500);
             }
         },
-        async handleCallback(request, assets, requestUrl) {
+        async handleCallback(request, assets, requestUrl, kv, cookieOptions) {
             const url = new URL(request.url);
-            const instanceUrl = url.searchParams.get("instanceUrl");
-            const encodedOauthReqInfo = url.searchParams
-                .get("oauthReqInfo")
-                // Workaround for https://thoughtspot.atlassian.net/browse/SCAL-258056
-                ?.replace("/10023.html", "");
-            if (!instanceUrl) {
+            const stateId = url.searchParams
+                .get("state")
+                ?.replace(SAML_TARGET_PATH_SUFFIX, "");
+            // Any instanceUrl / oauthReqInfo in the query is ignored: both come
+            // from the server-side record. The state is not consumed here so the
+            // page can be reloaded (free-trial login, manual token paste).
+            const record = await loadAuthState(kv, stateId, request, cookieOptions);
+            if (!stateId || !record.instanceUrl) {
                 throw new McpServerError({ message: "Missing instance URL" }, 400);
             }
-            if (!encodedOauthReqInfo) {
-                throw new McpServerError({ message: "Missing OAuth request info" }, 400);
-            }
-            let decodedOAuthReqInfo;
-            try {
-                decodedOAuthReqInfo = JSON.parse(new TextDecoder().decode(decodeBase64Url(encodedOauthReqInfo)));
-            }
-            catch (error) {
-                throw new McpServerError({ message: "Invalid OAuth request info format", details: error }, 400);
-            }
             const origin = new URL(requestUrl).origin;
             try {
-                return await renderTokenCallback(instanceUrl, decodedOAuthReqInfo, assets, origin);
+                return await renderTokenCallback({ state: stateId, instanceUrl: record.instanceUrl }, assets, origin);
             }
             catch (error) {
                 throw new McpServerError({ message: "Error rendering token callback", details: error }, 500);
             }
         },
-        async storeToken(request, oauthProvider) {
+        async storeToken(request, oauthProvider, kv, cookieOptions) {
             // biome-ignore lint/suspicious/noExplicitAny: payload shape is consumer-defined
             let token;
-            // biome-ignore lint/suspicious/noExplicitAny: AuthRequest from oauth provider
-            let oauthReqInfo;
-            let instanceUrl;
+            let stateId;
             try {
                 // biome-ignore lint/suspicious/noExplicitAny: free-form body
                 const body = (await request.json());
-                token = body.token;
-                oauthReqInfo = body.oauthReqInfo;
-                instanceUrl = body.instanceUrl;
+                token = body?.token;
+                stateId = body?.state;
             }
             catch (error) {
                 throw new McpServerError({ message: "Invalid JSON format", details: error }, 400);
             }
-            if (!token || !oauthReqInfo || !instanceUrl) {
-                throw new McpServerError({ message: "Missing token or OAuth request info or instanceUrl" }, 400);
+            if (typeof token?.data?.token !== "string" ||
+                !token.data.token ||
+                typeof stateId !== "string" ||
+                !stateId) {
+                throw new McpServerError({ message: "Missing token or OAuth state" }, 400);
             }
-            const { clientId } = oauthReqInfo;
-            if (!clientId) {
-                throw new McpServerError({ message: "Missing clientId" }, 400);
+            const record = await loadAuthState(kv, stateId, request, cookieOptions);
+            if (!record.instanceUrl) {
+                throw new McpServerError({ message: "Missing instance URL" }, 400);
             }
-            const clientName = await oauthProvider.lookupClient(clientId);
+            // Single use: delete before minting so a replay finds nothing.
+            await consumeAuthState(kv, stateId);
+            const { oauthReqInfo, instanceUrl } = record;
+            const client = await oauthProvider.lookupClient(oauthReqInfo.clientId);
+            assertGrantableAuthRequest(oauthReqInfo, client);
             const baseProps = {
                 accessToken: token.data.token,
                 instanceUrl: instanceUrl,
-                clientName: clientName,
+                clientName: client,
             };
             // Let the consumer fold token-exchange-only fields (e.g. refresh token,
             // expiry) into the grant, so they persist onto every later request.
@@ -205,7 +249,7 @@ export function createAuthApp(options) {
     };
     app.get(PUBLIC_ROUTES.authorize, async (c) => {
         try {
-            const response = await wrap(hooks, "authorize-get", () => handler.getAuthorize(c.req.raw, c.env.OAUTH_PROVIDER));
+            const response = await wrap(hooks, "authorize-get", () => handler.getAuthorize(c.req.raw, c.env.OAUTH_PROVIDER, c.env.OAUTH_KV, bindingCookieOptions(c.env)));
             recordAuthMetric(hooks, "oauth_authorize_requests_total", response.status, c);
             return response;
         }
@@ -217,7 +261,7 @@ export function createAuthApp(options) {
     });
     app.post(PUBLIC_ROUTES.authorize, async (c) => {
         try {
-            const redirectUrl = await wrap(hooks, "authorize-post", () => handler.postAuthorize(c.req.raw, c.req.url));
+            const redirectUrl = await wrap(hooks, "authorize-post", () => handler.postAuthorize(c.req.raw, c.req.url, c.env.OAUTH_KV, bindingCookieOptions(c.env)));
             const response = Response.redirect(redirectUrl);
             recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
             return response;
@@ -229,9 +273,7 @@ export function createAuthApp(options) {
                 recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
                 return response;
             }
-            const response = new Response(`Internal Server Error ${error}`, {
-                status: 500,
-            });
+            const response = authErrorResponse(error);
             recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
             return response;
         }
@@ -244,60 +286,31 @@ export function createAuthApp(options) {
             return response;
         }
         try {
-            const htmlContent = await wrap(hooks, "oauth-callback", () => handler.handleCallback(c.req.raw, assets, c.req.url));
+            const htmlContent = await wrap(hooks, "oauth-callback", () => handler.handleCallback(c.req.raw, assets, c.req.url, c.env.OAUTH_KV, bindingCookieOptions(c.env)));
             const response = new Response(htmlContent, {
-                headers: { "Content-Type": "text/html" },
+                headers: { "Content-Type": "text/html", ...NO_STORE_HEADERS },
             });
             recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
             return response;
         }
         catch (error) {
-            if (error instanceof Error) {
-                if (error.message.includes("Missing instance URL")) {
-                    const response = c.text(`Missing instance URL ${error}`, 400);
-                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
-                    return response;
-                }
-                if (error.message.includes("Missing OAuth request info")) {
-                    const response = c.text(`Missing OAuth request info ${error}`, 400);
-                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
-                    return response;
-                }
-                if (error.message.includes("Invalid OAuth request info format")) {
-                    const response = c.text(`Invalid OAuth request info format ${error}`, 400);
-                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
-                    return response;
-                }
-            }
-            const response = c.text(`Internal server error ${error}`, 500);
+            const response = authErrorResponse(error);
             recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
             return response;
         }
     });
     app.post(PUBLIC_ROUTES.storeToken, async (c) => {
         try {
-            const result = await wrap(hooks, "store-token", () => handler.storeToken(c.req.raw, c.env.OAUTH_PROVIDER));
+            const result = await wrap(hooks, "store-token", () => handler.storeToken(c.req.raw, c.env.OAUTH_PROVIDER, c.env.OAUTH_KV, bindingCookieOptions(c.env)));
             const response = new Response(JSON.stringify(result), {
                 status: 200,
-                headers: { "Content-Type": "application/json" },
+                headers: { "Content-Type": "application/json", ...NO_STORE_HEADERS },
             });
             recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
             return response;
         }
         catch (error) {
-            if (error instanceof Error) {
-                if (error.message.includes("Invalid JSON format")) {
-                    const response = c.text(`Invalid JSON format ${error}`, 400);
-                    recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
-                    return response;
-                }
-                if (error.message.includes("Missing token or OAuth request info or instanceUrl")) {
-                    const response = c.text(`Missing token or OAuth request info or instanceUrl ${error}`, 400);
-                    recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
-                    return response;
-                }
-            }
-            const response = c.text(`Internal server error ${error}`, 500);
+            const response = authErrorResponse(error);
             recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
             return response;
         }

package/dist/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA8BzC,SAAS,gBAAgB,CACxB,KAAuC,EACvC,IAAoB,EACpB,MAAc,EACd,CAA4D;IAE5D,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO;IACjC,IAAI,CAAC;QACJ,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,KAAuC,EACvC,IAAY,EACZ,EAAoB;IAEpB,IAAI,KAAK,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,OAA6B;IAE7B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IAEnC,MAAM,OAAO,GAAG;QACf,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,aAA2B;YAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YAElC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;gBACjC,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,0CAA0C,EAAE,EACvD,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,YAAY,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;gBACjD,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,yCAAyC,EAAE,EACtD,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,oBAAoB,CAAC,OAAO,EAAE;gBACpC,MAAM;gBACN,UAAU;gBACV,KAAK,EAAE,EAAE,YAAY,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,UAAkB;YACvD,IAAI,CAAC;gBACJ,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEpE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACzC,GAAG,CACH,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBAE1C,oDAAoD;gBACpD,IACC,WAAW,CAAC,KAAK,CAAC,mDAAmD,CAAC,EACrE,CAAC;oBACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;oBACzD,WAAW,CAAC,YAAY,CAAC,GAAG,CAC3B,cAAc,EACd,eAAe,CACd,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;yBAC1D,MAAqB,CACvB,CACD,CAAC;oBACF,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC/B,CAAC;gBAED,OAAO,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,cAAc;oBAAE,MAAM,KAAK,CAAC;gBACjD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;QAED,KAAK,CAAC,cAAc,CACnB,OAAgB,EAChB,MAAqB,EACrB,UAAkB;YAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY;iBAC1C,GAAG,CAAC,cAAc,CAAC;gBACpB,sEAAsE;gBACtE,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAE9B,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1B,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YAED,IAAI,mBAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAC9D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE,EAChE,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAC/B,WAAW,EACX,mBAAmB,EACnB,MAAM,EACN,MAAM,CACN,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,EAC7D,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,OAAgB,EAAE,aAA2B;YAC7D,gFAAgF;YAChF,IAAI,KAAU,CAAC;YACf,8EAA8E;YAC9E,IAAI,YAAiB,CAAC;YACtB,IAAI,WAA+B,CAAC;YAEpC,IAAI,CAAC;gBACJ,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAQ,CAAC;gBAC3C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;gBACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,GAAG,CACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,oDAAoD,EAAE,EACjE,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE9D,MAAM,SAAS,GAAc;gBAC5B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBAC7B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,UAAU;aACtB,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,KAAK,GAAG,KAAK,EAAE,gBAAgB;gBACpC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAEb,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC;gBAChE,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;gBAC9B,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,KAAK;aACL,CAAC,CAAC;YAEH,OAAO,EAAE,UAAU,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,wBAAwB,CAC7B,OAAgB,EAChB,QAAgB,EAChB,aAA2B;YAE3B,kEAAkE;YAClE,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACJ,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;YACzC,IACC,CAAC,QAAQ;gBACT,OAAO,YAAY,KAAK,QAAQ;gBAChC,YAAY,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;gBACF,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YAED,MAAM,iBAAiB,GAAG,IAAI,EAAE,aAAa,CAAC;YAC9C,MAAM,oBAAoB,GAAG,IAAI,EAAE,oBAAoB,CAAC;YAExD,MAAM,cAAc,GACnB,iBAAiB,KAAK,SAAS;gBAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;oBAChC,iBAAiB,CAAC,MAAM,GAAG,CAAC;oBAC5B,iBAAiB,CAAC,KAAK,CACtB,CAAC,GAAY,EAAiB,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,CACnD,CAAC,CAAC;YACL,MAAM,iBAAiB,GACtB,oBAAoB,KAAK,SAAS;gBAClC,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBACnC,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC/B,oBAAoB,CAAC,KAAK,CACzB,CAAC,GAAY,EAAiB,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAC1C,CAAC,CAAC;YACL,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACzD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,UAAU,GAAa,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC/D,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,EAAE,CAAC;YAEN,IACC,CAAC,cAAc;gBACf,CAAC,iBAAiB;gBAClB,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAChD,CAAC;gBACF,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1D,yEAAyE;YACzE,yEAAyE;YACzE,4EAA4E;YAC5E,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC7C,YAAY,EACZ,MAAM,EAAE,YAAY,CACpB,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvD,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAC9C,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CACpC,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,gDAAgD,EAAE,EAC7D,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;gBAC9C,MAAM,IAAI,cAAc,CACvB;oBACC,OAAO,EAAE,qDAAqD,wBAAwB,EAAE;iBACxF,EACD,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAC1D,YAAY,EAAE,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO;gBACN,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,MAAM;aAC9C,CAAC;QACH,CAAC;KACD,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,CACxD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACrD,CAAC;YACF,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAC3C,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IACC,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC7C,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;gBACF,OAAO,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,yBAAyB,KAAK,EAAE,EAAE;gBAC/D,MAAM,EAAE,GAAG;aACX,CAAC,CAAC;YACH,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,sDAAsD,EACtD,GAAG,CACH,CAAC;YACF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CACpD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE;gBAC1C,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACxC,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC9D,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;oBAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBACpE,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,qCAAqC,KAAK,EAAE,EAC5C,GAAG,CACH,CAAC;oBACF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CACpD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACnD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACrD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;oBACnD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,gBAAgB,CACf,KAAK,EACL,yBAAyB,EACzB,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;oBACF,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IACC,KAAK,CAAC,OAAO,CAAC,QAAQ,CACrB,oDAAoD,CACpD,EACA,CAAC;oBACF,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,sDAAsD,KAAK,EAAE,EAC7D,GAAG,CACH,CAAC;oBACF,gBAAgB,CACf,KAAK,EACL,yBAAyB,EACzB,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;oBACF,OAAO,QAAQ,CAAC;gBACjB,CAAC;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,EAAE,CACpE,OAAO,CAAC,wBAAwB,CAC/B,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,cAAc,CACpB,CACD,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC3C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;oBAC7D,MAAM,EAAE,KAAK,CAAC,UAAU;oBACxB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAC/C,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,WAAW,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEN,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,uBAAuB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuBzC,SAAS,oBAAoB,CAC5B,GAA2B;IAE3B,OAAO;QACN,sBAAsB,EAAE,GAAG,CAAC,+BAA+B,KAAK,MAAM;KACtE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C,MAAM,2BAA2B,GAChC,mDAAmD,CAAC;AAErD,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAC;AAElE;;;;GAIG;AACH,SAAS,0BAA0B,CAClC,YAAyB,EACzB,MAAyB;IAEzB,IACC,CAAC,MAAM;QACP,YAAY,CAAC,YAAY,KAAK,MAAM;QACpC,YAAY,CAAC,mBAAmB,KAAK,MAAM;QAC3C,CAAC,YAAY,CAAC,aAAa;QAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC/D,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE;YAC3C,MAAM,EAAE,KAAK,CAAC,UAAU;YACxB,OAAO,EAAE;gBACR,cAAc,EAAE,2BAA2B;gBAC3C,GAAG,gBAAgB;aACnB;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE;QAC5C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACR,cAAc,EAAE,2BAA2B;YAC3C,GAAG,gBAAgB;SACnB;KACD,CAAC,CAAC;AACJ,CAAC;AAgBD,SAAS,gBAAgB,CACxB,KAAuC,EACvC,IAAoB,EACpB,MAAc,EACd,CAA4D;IAE5D,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO;IACjC,IAAI,CAAC;QACJ,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,KAAuC,EACvC,IAAY,EACZ,EAAoB;IAEpB,IAAI,KAAK,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA6B;IAC1D,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IAEnC,MAAM,OAAO,GAAG;QACf,KAAK,CAAC,YAAY,CACjB,OAAgB,EAChB,aAA2B,EAC3B,EAAe,EACf,aAAmC;YAEnC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YAElC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,YAAY,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC1C,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAChE,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;gBACjC,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,0CAA0C,EAAE,EACvD,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,YAAY,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;gBACjD,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,yCAAyC,EAAE,EACtD,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE1D,uEAAuE;YACvE,8CAA8C;YAC9C,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,yBAAyB,CAC/D,OAAO,EACP,aAAa,CACb,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE;gBAC9C,MAAM;gBACN,UAAU;gBACV,OAAO;aACP,CAAC,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACvD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAClD,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,aAAa,CAClB,OAAgB,EAChB,UAAkB,EAClB,EAAe,EACf,aAAmC;YAEnC,IAAI,CAAC;gBACJ,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEtE,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;gBACxE,MAAM,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBAE1C,oDAAoD;gBACpD,IAAI,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,CAAC;gBAED,OAAO,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,cAAc;oBAAE,MAAM,KAAK,CAAC;gBACjD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;QAED,KAAK,CAAC,cAAc,CACnB,OAAgB,EAChB,MAAqB,EACrB,UAAkB,EAClB,EAAe,EACf,aAAmC;YAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY;iBAC9B,GAAG,CAAC,OAAO,CAAC;gBACb,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAExC,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAC/B,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EACnD,MAAM,EACN,MAAM,CACN,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,EAC7D,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,KAAK,CAAC,UAAU,CACf,OAAgB,EAChB,aAA2B,EAC3B,EAAe,EACf,aAAmC;YAEnC,gFAAgF;YAChF,IAAI,KAAU,CAAC;YACf,IAAI,OAAgB,CAAC;YAErB,IAAI,CAAC;gBACJ,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAQ,CAAC;gBAC3C,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;gBACpB,OAAO,GAAG,IAAI,EAAE,KAAK,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,GAAG,CACH,CAAC;YACH,CAAC;YAED,IACC,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,KAAK,QAAQ;gBACtC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gBACjB,OAAO,OAAO,KAAK,QAAQ;gBAC3B,CAAC,OAAO,EACP,CAAC;gBACF,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAC3C,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,+DAA+D;YAC/D,MAAM,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAEpC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvE,0BAA0B,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAc;gBAC5B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBAC7B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,MAAM;aAClB,CAAC;YACF,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,KAAK,GAAG,KAAK,EAAE,gBAAgB;gBACpC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAEb,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC;gBAChE,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;gBAC9B,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,KAAK;aACL,CAAC,CAAC;YAEH,OAAO,EAAE,UAAU,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,wBAAwB,CAC7B,OAAgB,EAChB,QAAgB,EAChB,aAA2B;YAE3B,kEAAkE;YAClE,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACJ,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;YACzC,IACC,CAAC,QAAQ;gBACT,OAAO,YAAY,KAAK,QAAQ;gBAChC,YAAY,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;gBACF,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACzC,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,IAAI,EAAE,aAAa,CAAC;YAC9C,MAAM,oBAAoB,GAAG,IAAI,EAAE,oBAAoB,CAAC;YAExD,MAAM,cAAc,GACnB,iBAAiB,KAAK,SAAS;gBAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;oBAChC,iBAAiB,CAAC,MAAM,GAAG,CAAC;oBAC5B,iBAAiB,CAAC,KAAK,CACtB,CAAC,GAAY,EAAiB,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,CACnD,CAAC,CAAC;YACL,MAAM,iBAAiB,GACtB,oBAAoB,KAAK,SAAS;gBAClC,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBACnC,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC/B,oBAAoB,CAAC,KAAK,CACzB,CAAC,GAAY,EAAiB,EAAE,CAC/B,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAC1C,CAAC,CAAC;YACL,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACzD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,UAAU,GAAa,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC/D,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,EAAE,CAAC;YAEN,IACC,CAAC,cAAc;gBACf,CAAC,iBAAiB;gBAClB,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAChD,CAAC;gBACF,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1D,yEAAyE;YACzE,yEAAyE;YACzE,4EAA4E;YAC5E,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC7C,YAAY,EACZ,MAAM,EAAE,YAAY,CACpB,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvD,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACzC,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAC9C,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CACpC,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,gDAAgD,EAAE,EAC7D,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;gBAC9C,MAAM,IAAI,cAAc,CACvB;oBACC,OAAO,EAAE,qDAAqD,wBAAwB,EAAE;iBACxF,EACD,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAC1D,YAAY,EAAE,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO;gBACN,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,MAAM;aAC9C,CAAC;QACH,CAAC;KACD,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,CACxD,OAAO,CAAC,YAAY,CACnB,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,cAAc,EACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EACd,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CACD,CAAC;YACF,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,aAAa,CACpB,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EACd,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CACD,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IACC,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC7C,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;gBACF,OAAO,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,sDAAsD,EACtD,GAAG,CACH,CAAC;YACF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,cAAc,CACrB,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,MAAM,EACN,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EACd,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CACD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE;gBAC1C,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,gBAAgB,EAAE;aAC7D,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CACpD,OAAO,CAAC,UAAU,CACjB,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,cAAc,EACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EACd,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CACD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACrD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE;aACpE,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,EAAE,CACpE,OAAO,CAAC,wBAAwB,CAC/B,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,cAAc,CACpB,CACD,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC3C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;oBAC7D,MAAM,EAAE,KAAK,CAAC,UAAU;oBACxB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAC/C,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,WAAW,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { PUBLIC_ROUTES, PUBLIC_ROUTE_PREFIXES, type PublicRoutes, type PublicRoutePrefixes, } from "./routes";
 export { McpServerError } from "./errors";
 export type { BaseProps, ServerInfo, AuthHooks, AuthMetricName, BearerAuthRouteGroup, AssetsFetcher, } from "./types";
-export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, validateAndSanitizeUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, type ApprovalDialogOptions, type ParsedApprovalResult, } from "./oauth-utils";
-export { renderTokenCallback } from "./token-utils";
+export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, buildCallbackUrl, validateAndSanitizeUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, type ApprovalDialogOptions, type ParsedApprovalResult, } from "./oauth-utils";
+export { renderTokenCallback, type TokenCallbackFlow } from "./token-utils";
 export { createAuthApp, type CreateAuthAppOptions, type AuthAppEnv, } from "./handlers";
 export { withBearerHandler, type WithBearerHandlerOptions, type BearerMCPServer, } from "./bearer";
 export { createOAuthHandler, type CreateOAuthHandlerOptions, type MCPServerForOAuth, } from "./oauth-provider";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,UAAU,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACtB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,UAAU,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { PUBLIC_ROUTES, PUBLIC_ROUTE_PREFIXES, } from "./routes";
 export { McpServerError } from "./errors";
-export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, validateAndSanitizeUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, } from "./oauth-utils";
+export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, buildCallbackUrl, validateAndSanitizeUrl, isValidRedirectUri, MAX_CLIENT_REDIRECT_URIS, } from "./oauth-utils";
 export { renderTokenCallback } from "./token-utils";
 export { createAuthApp, } from "./handlers";
 export { withBearerHandler, } from "./bearer";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS1C,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,GAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACN,aAAa,GAGb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,GAGjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,GAGlB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS1C,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,GAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAA0B,MAAM,eAAe,CAAC;AAC5E,OAAO,EACN,aAAa,GAGb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,GAGjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,GAGlB,MAAM,kBAAkB,CAAC"}

package/dist/oauth-utils.d.ts

@@ -1,4 +1,4 @@
-import type { AuthRequest, ClientInfo } from "@cloudflare/workers-oauth-provider";
+import type { ClientInfo } from "@cloudflare/workers-oauth-provider";
 import type { ServerInfo } from "./types";
 /**
  * Maximum number of redirect URIs a single client may accumulate. Bounds the
@@ -8,13 +8,12 @@ export declare const MAX_CLIENT_REDIRECT_URIS = 10;
 export interface ApprovalDialogOptions {
     client: ClientInfo | null;
     serverInfo: ServerInfo;
-    state: Record<string, unknown>;
+    /** Opaque ID of the server-side auth state record (see auth-state.ts). */
+    stateId: string;
 }
 export declare function renderApprovalDialog(request: Request, options: ApprovalDialogOptions): Response;
 export interface ParsedApprovalResult {
-    state: {
-        oauthReqInfo?: AuthRequest;
-    } & Record<string, unknown>;
+    stateId: string;
     instanceUrl: string;
 }
 export declare function validateAndSanitizeUrl(url: string): string;
@@ -36,5 +35,10 @@ export declare function isValidRedirectUri(uri: string): boolean;
 declare function verifyClientSecret(candidate: string, storedHash: string | null | undefined): Promise<boolean>;
 export { verifyClientSecret };
 export declare function parseRedirectApproval(request: Request): Promise<ParsedApprovalResult>;
-export declare function buildSamlRedirectUrl(instanceUrl: string, oauthReqInfo: unknown, callbackOrigin: string): string;
+/**
+ * The /callback URL carries only the opaque state ID; the instance URL and
+ * auth request are looked up server-side.
+ */
+export declare function buildCallbackUrl(stateId: string, callbackOrigin: string): string;
+export declare function buildSamlRedirectUrl(instanceUrl: string, stateId: string, callbackOrigin: string): string;
 //# sourceMappingURL=oauth-utils.d.ts.map

package/dist/oauth-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-utils.d.ts","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAmB3C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,qBAAqB,GAC5B,QAAQ,CAqNV;AAYD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE;QAAE,YAAY,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiBvD;AAeD;;;;;GAKG;AACH,iBAAe,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;AAWD,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,EACrB,cAAc,EAAE,MAAM,GACpB,MAAM,CAWR"}
+{"version":3,"file":"oauth-utils.d.ts","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAmB3C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,qBAAqB,GAC5B,QAAQ,CAqNV;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiBvD;AAeD;;;;;GAKG;AACH,iBAAe,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,oBAAoB,CAAC,CA8B/B;AAWD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACpB,MAAM,CAIR;AAED,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACpB,MAAM,CAOR"}

package/dist/oauth-utils.js

@@ -1,5 +1,4 @@
 import { timingSafeEqual } from "node:crypto";
-import { encodeBase64Url } from "hono/utils/encode";
 /**
  * Maximum number of redirect URIs a single client may accumulate. Bounds the
  * growth of an individual client's `redirectUris` list.
@@ -17,8 +16,8 @@ const DEFAULT_TERMS_URL = "https://www.thoughtspot.com/legal/thoughtspot-for-app
 const DEFAULT_PRIVACY_URL = "https://www.thoughtspot.com/privacy-statement";
 const DEFAULT_SIGNUP_URL = "https://www.thoughtspot.com/trial?utm_source=mcp&utm_medium=consent&tsref=MCP";
 export function renderApprovalDialog(request, options) {
-    const { serverInfo, state, client } = options;
-    const encodedState = btoa(JSON.stringify(state));
+    const { serverInfo, stateId, client } = options;
+    const encodedState = sanitizeHtml(stateId);
     const serverName = sanitizeHtml(serverInfo.name);
     const mcpLogoUrl = serverInfo.mcpLogoUrl ?? DEFAULT_MCP_LOGO_URL;
     const instanceLogoUrl = serverInfo.instanceLogoUrl ?? DEFAULT_INSTANCE_LOGO_URL;
@@ -226,16 +225,6 @@ export function renderApprovalDialog(request, options) {
         headers: { "Content-Type": "text/html; charset=utf-8" },
     });
 }
-function decodeState(encodedState) {
-    try {
-        const decoded = atob(encodedState);
-        return JSON.parse(decoded);
-    }
-    catch (e) {
-        console.error("Error decoding state:", e);
-        throw new Error("Invalid state format");
-    }
-}
 export function validateAndSanitizeUrl(url) {
     try {
         const trimmedUrl = url.trim();
@@ -319,21 +308,16 @@ export async function parseRedirectApproval(request) {
     if (request.method !== "POST") {
         throw new Error("Invalid request method. Expected POST.");
     }
-    let state;
-    let clientId;
+    let stateId;
     let instanceUrl;
     try {
         const formData = await request.formData();
-        const encodedState = formData.get("state");
+        const rawStateId = formData.get("state");
         const rawInstanceUrl = formData.get("instanceUrl");
-        if (typeof encodedState !== "string" || !encodedState) {
+        if (typeof rawStateId !== "string" || !rawStateId) {
             throw new Error("Missing or invalid 'state' in form data.");
         }
-        state = decodeState(encodedState);
-        clientId = state?.oauthReqInfo?.clientId;
-        if (!clientId) {
-            throw new Error("Could not extract clientId from state object.");
-        }
+        stateId = rawStateId;
         if (!rawInstanceUrl) {
             throw new Error("Missing instance URL");
         }
@@ -343,7 +327,7 @@ export async function parseRedirectApproval(request) {
         console.error("Error processing form submission:", e);
         throw new Error(`Failed to parse approval form: ${e instanceof Error ? e.message : String(e)}`);
     }
-    return { state, instanceUrl };
+    return { stateId, instanceUrl };
 }
 function sanitizeHtml(unsafe) {
     return unsafe
@@ -353,14 +337,18 @@ function sanitizeHtml(unsafe) {
         .replace(/"/g, """)
         .replace(/'/g, "'");
 }
-export function buildSamlRedirectUrl(instanceUrl, oauthReqInfo, callbackOrigin) {
+/**
+ * The /callback URL carries only the opaque state ID; the instance URL and
+ * auth request are looked up server-side.
+ */
+export function buildCallbackUrl(stateId, callbackOrigin) {
+    const callbackUrl = new URL("/callback", callbackOrigin);
+    callbackUrl.searchParams.set("state", stateId);
+    return callbackUrl.toString();
+}
+export function buildSamlRedirectUrl(instanceUrl, stateId, callbackOrigin) {
     const redirectUrl = new URL("callosum/v1/saml/login", instanceUrl);
-    const targetURLPath = new URL("/callback", callbackOrigin);
-    targetURLPath.searchParams.append("instanceUrl", instanceUrl);
-    const encodedState = encodeBase64Url(new TextEncoder().encode(JSON.stringify(oauthReqInfo))
-        .buffer);
-    targetURLPath.searchParams.append("oauthReqInfo", encodedState);
-    redirectUrl.searchParams.append("targetURLPath", targetURLPath.href);
+    redirectUrl.searchParams.append("targetURLPath", buildCallbackUrl(stateId, callbackOrigin));
     return redirectUrl.toString();
 }
 //# sourceMappingURL=oauth-utils.js.map

package/dist/oauth-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK9C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhD,MAAM,oBAAoB,GACzB,yGAAyG,CAAC;AAC3G,MAAM,yBAAyB,GAC9B,2DAA2D,CAAC;AAC7D,MAAM,iBAAiB,GACtB,wDAAwD,CAAC;AAC1D,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAC5E,MAAM,kBAAkB,GACvB,+EAA+E,CAAC;AAQjF,MAAM,UAAU,oBAAoB,CACnC,OAAgB,EAChB,OAA8B;IAE9B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACjE,MAAM,eAAe,GACpB,UAAU,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAChE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC7D,MAAM,aAAa,GAClB,UAAU,CAAC,aAAa;QACxB,GAAG,UAAU,+CAA+C,CAAC;IAE9D,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,kBAAkB,GAAG,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG;;;;;;mBAMF,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAgGH,UAAU;;;;;;;;;;;0BAWV,eAAe;;0CAEC,aAAa;gEACS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;;;gFAGb,aAAa;2DAClC,YAAY;;;6BAG1C,SAAS;;;+CAGS,UAAU;;;;;;;;;6BAS5B,QAAQ;iCACJ,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuDtC,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAChC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAI,YAAoB;IAC3C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,eAAe,GACpB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;YACpE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,UAAU,EAAE,CAAC;QAE5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAE3C,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACd,0CAA0C,SAAS,CAAC,QAAQ,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,SAAiB,EACjB,UAAqC;IAErC,MAAM,QAAQ,GACb,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACtD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,wBAAwB,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,eAAe,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,KAA+D,CAAC;IACpE,IAAI,QAA4B,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAW,CAAC;QAE7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QAED,KAAK,GAAG,WAAW,CAAiC,YAAY,CAAC,CAAC;QAClE,QAAQ,GAAG,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QAED,WAAW,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACd,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IACnC,OAAO,MAAM;SACX,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmB,EACnB,YAAqB,EACrB,cAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,eAAe,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;SACpD,MAAqB,CACvB,CAAC;IACF,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAChE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9C;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhD,MAAM,oBAAoB,GACzB,yGAAyG,CAAC;AAC3G,MAAM,yBAAyB,GAC9B,2DAA2D,CAAC;AAC7D,MAAM,iBAAiB,GACtB,wDAAwD,CAAC;AAC1D,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAC5E,MAAM,kBAAkB,GACvB,+EAA+E,CAAC;AASjF,MAAM,UAAU,oBAAoB,CACnC,OAAgB,EAChB,OAA8B;IAE9B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACjE,MAAM,eAAe,GACpB,UAAU,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAChE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC7D,MAAM,aAAa,GAClB,UAAU,CAAC,aAAa;QACxB,GAAG,UAAU,+CAA+C,CAAC;IAE9D,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,kBAAkB,GAAG,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG;;;;;;mBAMF,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAgGH,UAAU;;;;;;;;;;;0BAWV,eAAe;;0CAEC,aAAa;gEACS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;;;gFAGb,aAAa;2DAClC,YAAY;;;6BAG1C,SAAS;;;+CAGS,UAAU;;;;;;;;;6BAS5B,QAAQ;iCACJ,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuDtC,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAChC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,eAAe,GACpB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;YACpE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,UAAU,EAAE,CAAC;QAE5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAE3C,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACd,0CAA0C,SAAS,CAAC,QAAQ,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,SAAiB,EACjB,UAAqC;IAErC,MAAM,QAAQ,GACb,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACtD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,wBAAwB,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,eAAe,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAW,CAAC;QAE7D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,UAAU,CAAC;QAErB,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QAED,WAAW,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACd,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IACnC,OAAO,MAAM;SACX,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,OAAe,EACf,cAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmB,EACnB,OAAe,EACf,cAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACnE,WAAW,CAAC,YAAY,CAAC,MAAM,CAC9B,eAAe,EACf,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,CACzC,CAAC;IACF,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/token-utils.d.ts

@@ -1,3 +1,10 @@
 import type { AssetsFetcher } from "./types";
-export declare function renderTokenCallback(instanceUrl: string, oauthReqInfo: unknown, assets: AssetsFetcher, origin: string): Promise<string>;
+/** Values the callback page needs; injected as JSON into `{{OAUTH_FLOW}}`. */
+export interface TokenCallbackFlow {
+    /** Opaque auth state ID, posted back to /store-token. */
+    state: string;
+    /** ThoughtSpot instance to fetch the session token from. */
+    instanceUrl: string;
+}
+export declare function renderTokenCallback(flow: TokenCallbackFlow, assets: AssetsFetcher, origin: string): Promise<string>;
 //# sourceMappingURL=token-utils.d.ts.map

package/dist/token-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-utils.d.ts","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,wBAAsB,mBAAmB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAoEjB"}
+{"version":3,"file":"token-utils.d.ts","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IACjC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAuEjB"}

package/dist/token-utils.js

@@ -1,6 +1,21 @@
-export async function renderTokenCallback(instanceUrl, oauthReqInfo, assets, origin) {
-    const parsedOAuthReqInfo = typeof oauthReqInfo === "string" ? JSON.parse(oauthReqInfo) : oauthReqInfo;
-    const oauthReqInfoJson = JSON.stringify(parsedOAuthReqInfo);
+/**
+ * JSON.stringify output is not safe inside a <script> element: a "</script>"
+ * in any string would close it. Escape the characters that matter in HTML and
+ * the line separators that are invalid in pre-ES2019 JavaScript.
+ */
+function toScriptSafeJson(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+export async function renderTokenCallback(flow, assets, origin) {
+    const flowJson = toScriptSafeJson({
+        state: flow.state,
+        instanceUrl: flow.instanceUrl,
+    });
     try {
         const htmlResponse = await assets.fetch(`${origin}/oauth-callback.html`);
         if (!htmlResponse.ok) {
@@ -17,9 +32,11 @@ export async function renderTokenCallback(instanceUrl, oauthReqInfo, assets, ori
             throw new Error("Failed to load oauth-callback.js");
         }
         const js = await jsResponse.text();
-        htmlContent = htmlContent.replace("{{OAUTH_REQ_INFO}}", oauthReqInfoJson);
-        htmlContent = htmlContent.replace('<link rel="stylesheet" href="oauth-callback.css">', `<style>${css}</style>`);
-        htmlContent = htmlContent.replace('<script src="oauth-callback.js"></script>', `<script>window.INSTANCE_URL = '${instanceUrl}';</script>\n    <script>${js}</script>`);
+        // Function replacers so "$&"-style sequences in the inserted text are not
+        // interpreted as replacement patterns.
+        htmlContent = htmlContent.replace("{{OAUTH_FLOW}}", () => flowJson);
+        htmlContent = htmlContent.replace('<link rel="stylesheet" href="oauth-callback.css">', () => `<style>${css}</style>`);
+        htmlContent = htmlContent.replace('<script src="oauth-callback.js"></script>', () => `<script>${js}</script>`);
         return htmlContent;
     }
     catch (error) {

package/dist/token-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,WAAmB,EACnB,YAAqB,EACrB,MAAqB,EACrB,MAAc;IAEd,MAAM,kBAAkB,GACvB,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC5E,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE5D,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAEnC,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAE1E,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,mDAAmD,EACnD,UAAU,GAAG,UAAU,CACvB,CAAC;QAEF,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,2CAA2C,EAC3C,kCAAkC,WAAW,4BAA4B,EAAE,WAAW,CACtF,CAAC;QAEF,OAAO,WAAW,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;4BAuBmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;;;;SAI3E,CAAC;IACT,CAAC;AACF,CAAC"}
+{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC1B,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,IAAuB,EACvB,MAAqB,EACrB,MAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAEnC,0EAA0E;QAC1E,uCAAuC;QACvC,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpE,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,mDAAmD,EACnD,GAAG,EAAE,CAAC,UAAU,GAAG,UAAU,CAC7B,CAAC;QAEF,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,2CAA2C,EAC3C,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAC9B,CAAC;QAEF,OAAO,WAAW,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;4BAuBmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;;;;SAI3E,CAAC;IACT,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@thoughtspot/mcp-auth",
-	"version": "2.1.1",
+	"version": "3.0.0",
 	"description": "Reusable ThoughtSpot OAuth + bearer auth layer for Cloudflare Workers MCP servers",
 	"type": "module",
 	"main": "./dist/index.js",