@nimblebrain/synapse 0.19.0 → 0.20.0

package/dist/check-YDZUQT6A.js

@@ -0,0 +1,429 @@
+import { RESOURCE_MIME_TYPE, EXTENSION_ID, RESOURCE_URI_META_KEY } from '@modelcontextprotocol/ext-apps/server';
+import { extractWWWAuthenticateParams, discoverOAuthProtectedResourceMetadata, discoverAuthorizationServerMetadata } from '@modelcontextprotocol/sdk/client/auth.js';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { ResultSchema, ListToolsResultSchema } from '@modelcontextprotocol/sdk/types.js';
+
+// src/check/index.ts
+
+// src/check/profiles.ts
+var SPEC_MIME = "UI resources are served as text/html;profile=mcp-app.";
+var RESOLVES = "A tool's ui.resourceUri must name a ui:// resource the server serves.";
+var UI_META = "ui.visibility is a non-empty subset of model/app; csp and permissions belong on the resource, not the tool.";
+var EXTENSION = "A client uses MCP Apps only when both sides declare io.modelcontextprotocol/ui.";
+var CHALLENGE = "Sign-in starts from a 401 whose WWW-Authenticate carries resource_metadata.";
+var PRM_RESOURCE = "The protected-resource metadata's resource must equal the connector URL exactly.";
+var ISSUER = "The authorization server's metadata issuer must equal the advertised authorization server exactly (RFC 8414).";
+var PROFILES = {
+  nimblebrain: {
+    name: "nimblebrain",
+    description: "The NimbleBrain host.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      // The host resolves an app by its ui:// scheme and does not gate on the
+      // declaration, so a missing one is a portability risk, not a break.
+      "extension-declared": { severity: "warn", why: EXTENSION },
+      // Only reported when the server challenges at all.
+      "auth-challenge": { severity: "warn", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "warn", why: PRM_RESOURCE },
+      "auth-issuer": { severity: "warn", why: ISSUER }
+    }
+  },
+  claude: {
+    name: "claude",
+    description: "claude.ai and Claude Desktop.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      "extension-declared": { severity: "error", why: EXTENSION },
+      "resource-csp": {
+        severity: "warn",
+        why: "Claude builds the frame's security policy from ui.csp; an undeclared origin is blocked."
+      },
+      "resource-data-fonts": {
+        severity: "error",
+        why: "Claude's default security policy blocks data: fonts unless the resource declares them."
+      },
+      "auth-challenge": { severity: "error", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "error", why: PRM_RESOURCE },
+      // Claude has been observed to accept an issuer that differs by a trailing
+      // slash, so this is a correctness warning for Claude rather than a break.
+      "auth-issuer": { severity: "warn", why: ISSUER }
+    }
+  },
+  chatgpt: {
+    name: "chatgpt",
+    description: "ChatGPT apps.",
+    rules: {
+      "ui-resource-mime": { severity: "error", why: SPEC_MIME },
+      "tool-resource-uri": { severity: "error", why: RESOLVES },
+      "tool-ui-meta": { severity: "error", why: UI_META },
+      "extension-declared": { severity: "error", why: EXTENSION },
+      "resource-csp": {
+        severity: "error",
+        why: "ChatGPT reads the frame's security policy from ui.csp, and app submission requires it."
+      },
+      "resource-data-fonts": {
+        severity: "warn",
+        why: "A data: font is blocked by a security policy that does not declare it."
+      },
+      "auth-challenge": { severity: "error", why: CHALLENGE },
+      "auth-resource-metadata": { severity: "error", why: PRM_RESOURCE },
+      "auth-issuer": { severity: "error", why: ISSUER },
+      "tool-security-schemes": {
+        severity: "error",
+        why: "ChatGPT prompts for sign-in mid-conversation only for tools that declare securitySchemes."
+      }
+    }
+  }
+};
+function isTargetName(value) {
+  return Object.hasOwn(PROFILES, value);
+}
+
+// src/check/index.ts
+var UI_SCHEME = "ui://";
+var VISIBILITY = /* @__PURE__ */ new Set(["model", "app"]);
+async function runChecks(url, options = {}) {
+  const results = [];
+  const add = (id, status, detail) => results.push({ id, status, detail });
+  let challenge;
+  let session;
+  let connectError;
+  try {
+    session = await openSession(url, void 0, (res) => {
+      if (res.status === 401) challenge ??= res;
+    });
+  } catch (err) {
+    connectError = err;
+  }
+  const authRequired = challenge !== void 0;
+  if (authRequired && options.token) {
+    try {
+      session = await openSession(url, options.token);
+      connectError = void 0;
+    } catch (err) {
+      connectError = err;
+    }
+  }
+  if (!session && (!authRequired || options.token)) {
+    throw new Error(
+      `could not connect to ${url}${authRequired ? " with the given token" : ""}: ${message(connectError)}`
+    );
+  }
+  await checkAuth(url, challenge, add);
+  if (!session) {
+    for (const id of SESSION_CHECKS) {
+      add(id, "skip", "the server requires auth; pass --token to run it");
+    }
+    return results;
+  }
+  checkSession(session, authRequired, add);
+  return results;
+}
+function applyProfiles(results, targets) {
+  return targets.map((target) => {
+    const rules = PROFILES[target].rules;
+    const scored = results.flatMap((r) => {
+      const rule = rules[r.id];
+      return rule ? [{ ...r, severity: rule.severity, why: rule.why }] : [];
+    });
+    return {
+      target,
+      results: scored,
+      failed: scored.some((r) => r.status === "fail" && r.severity === "error")
+    };
+  });
+}
+function formatReport(url, reports) {
+  const width = Math.max(...reports.flatMap((r) => r.results.map((c) => c.id.length)), 0);
+  const lines = [`synapse check ${url}`];
+  for (const report of reports) {
+    lines.push("", `${report.target}: ${report.failed ? "FAIL" : "ok"}`);
+    for (const r of report.results) {
+      const label = r.status === "fail" ? r.severity === "error" ? "FAIL" : "WARN" : r.status.toUpperCase();
+      lines.push(`  ${label.padEnd(4)}  ${r.id.padEnd(width)}  ${r.detail}`);
+      if (r.status === "fail") lines.push(`        ${"".padEnd(width)}  ${r.why}`);
+    }
+  }
+  return lines.join("\n");
+}
+var SESSION_CHECKS = [
+  "extension-declared",
+  "ui-resource-mime",
+  "tool-resource-uri",
+  "tool-ui-meta",
+  "resource-csp",
+  "resource-data-fonts",
+  "tool-security-schemes"
+];
+async function openSession(url, token, onResponse) {
+  const ui = { mimeTypes: [RESOURCE_MIME_TYPE] };
+  const client = new Client(
+    { name: "synapse-check", version: "1" },
+    { capabilities: { extensions: { [EXTENSION_ID]: ui } } }
+  );
+  const transport = new StreamableHTTPClientTransport(new URL(url), {
+    requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : void 0,
+    fetch: async (input, init) => {
+      const res = await fetch(input, init);
+      onResponse?.(res);
+      return res;
+    }
+  });
+  await client.connect(transport);
+  try {
+    const capabilities = client.getServerCapabilities();
+    const tools = [];
+    const resources = [];
+    let cursor;
+    if (capabilities?.tools) {
+      do {
+        const raw = await client.request(
+          { method: "tools/list", params: cursor ? { cursor } : {} },
+          ResultSchema
+        );
+        const page = ListToolsResultSchema.parse(raw);
+        const rawTools = raw.tools ?? [];
+        page.tools.forEach((tool, i) => {
+          const schemes = rawTools[i]?.securitySchemes;
+          if (schemes !== void 0) tool.securitySchemes = schemes;
+        });
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+      } while (cursor);
+    }
+    if (capabilities?.resources) {
+      do {
+        const page = await client.listResources({ cursor });
+        resources.push(...page.resources);
+        cursor = page.nextCursor;
+      } while (cursor);
+    }
+    const uris = new Set(resources.map((r) => r.uri).filter((u) => u.startsWith(UI_SCHEME)));
+    for (const tool of tools) {
+      const uri = toolUi(tool)?.resourceUri;
+      if (typeof uri === "string") uris.add(uri);
+    }
+    const reads = /* @__PURE__ */ new Map();
+    for (const uri of uris) {
+      try {
+        reads.set(uri, (await client.readResource({ uri })).contents);
+      } catch (err) {
+        reads.set(uri, err instanceof Error ? err : new Error(String(err)));
+      }
+    }
+    return { capabilities, tools, resources, reads };
+  } finally {
+    await client.close();
+  }
+}
+function checkSession(s, authRequired, add) {
+  const boundTools = s.tools.filter((t) => toolUi(t)?.resourceUri !== void 0);
+  const uiResources = s.resources.filter((r) => r.uri.startsWith(UI_SCHEME));
+  const hasUi = boundTools.length > 0 || uiResources.length > 0 || s.tools.some(legacyBinding);
+  if (!hasUi) {
+    for (const id of SESSION_CHECKS) {
+      if (id !== "tool-security-schemes") add(id, "skip", "the server exposes no UI");
+    }
+  } else {
+    const declared = s.capabilities?.extensions?.[EXTENSION_ID] !== void 0;
+    add(
+      "extension-declared",
+      declared ? "pass" : "fail",
+      declared ? `${EXTENSION_ID} is declared` : `the server does not declare ${EXTENSION_ID} in capabilities.extensions`
+    );
+    const wrongMime = [];
+    for (const r of uiResources) {
+      if (r.mimeType !== void 0 && r.mimeType !== RESOURCE_MIME_TYPE) {
+        wrongMime.push(`${r.uri} is listed as ${r.mimeType}`);
+      }
+    }
+    for (const [uri, contents] of s.reads) {
+      if (contents instanceof Error) continue;
+      for (const c of contents) {
+        if (c.mimeType !== RESOURCE_MIME_TYPE) {
+          wrongMime.push(`${uri} is served as ${c.mimeType ?? "no MIME type"}`);
+        }
+      }
+    }
+    add(
+      "ui-resource-mime",
+      wrongMime.length ? "fail" : "pass",
+      wrongMime.length ? `${wrongMime.join("; ")}; expected ${RESOURCE_MIME_TYPE}` : `every ui:// resource is ${RESOURCE_MIME_TYPE}`
+    );
+    const unresolved = [];
+    for (const tool of s.tools) {
+      const uri = toolUi(tool)?.resourceUri;
+      if (uri === void 0) {
+        if (legacyBinding(tool)) {
+          unresolved.push(`${tool.name} binds its UI only through the deprecated flat key`);
+        }
+        continue;
+      }
+      if (typeof uri !== "string" || !uri.startsWith(UI_SCHEME)) {
+        unresolved.push(`${tool.name}: ui.resourceUri ${JSON.stringify(uri)} is not a ui:// URI`);
+        continue;
+      }
+      const read = s.reads.get(uri);
+      if (read instanceof Error || !read?.length) {
+        unresolved.push(
+          `${tool.name}: ${uri} cannot be read${read instanceof Error ? ` (${read.message})` : ""}`
+        );
+      }
+    }
+    if (boundTools.length === 0 && unresolved.length === 0) {
+      unresolved.push("no tool binds a UI through ui.resourceUri");
+    }
+    add(
+      "tool-resource-uri",
+      unresolved.length ? "fail" : "pass",
+      unresolved.length ? unresolved.join("; ") : `${boundTools.length} tool(s) bind a UI that resolves`
+    );
+    const badMeta = [];
+    for (const tool of s.tools) {
+      const ui = toolUi(tool);
+      if (!ui) continue;
+      const vis = ui.visibility;
+      if (vis !== void 0 && (!Array.isArray(vis) || vis.length === 0 || !vis.every((v) => VISIBILITY.has(v)))) {
+        badMeta.push(`${tool.name}: ui.visibility ${JSON.stringify(vis)}`);
+      }
+      for (const key of ["csp", "permissions"]) {
+        if (ui[key] !== void 0) {
+          badMeta.push(`${tool.name}: ui.${key} is on the tool, where hosts ignore it`);
+        }
+      }
+    }
+    add(
+      "tool-ui-meta",
+      badMeta.length ? "fail" : "pass",
+      badMeta.length ? badMeta.join("; ") : "tool ui metadata is well-formed"
+    );
+    const noCsp = [];
+    const dataFonts = [];
+    for (const [uri, contents] of s.reads) {
+      if (contents instanceof Error) continue;
+      for (const c of contents) {
+        const listed = s.resources.find((r) => r.uri === uri);
+        const ui = resourceUi(c) ?? resourceUi(listed);
+        const csp = ui?.csp;
+        if (csp === void 0) {
+          noCsp.push(`${uri} declares no ui.csp`);
+        } else if (!isCsp(csp)) {
+          noCsp.push(`${uri}: ui.csp is not a map of origin lists`);
+        }
+        const html = "text" in c ? c.text : Buffer.from(c.blob, "base64").toString("utf-8");
+        const declaresData = isCsp(csp) && (csp.resourceDomains ?? []).includes("data:");
+        if (hasDataFont(html) && !declaresData) {
+          dataFonts.push(`${uri} loads a data: font, and ui.csp.resourceDomains omits data:`);
+        }
+      }
+    }
+    add(
+      "resource-csp",
+      noCsp.length ? "fail" : "pass",
+      noCsp.length ? noCsp.join("; ") : "every UI resource declares ui.csp"
+    );
+    add(
+      "resource-data-fonts",
+      dataFonts.length ? "fail" : "pass",
+      dataFonts.length ? dataFonts.join("; ") : "no undeclared data: fonts"
+    );
+  }
+  if (!authRequired) {
+    add("tool-security-schemes", "skip", "the server does not require auth");
+  } else {
+    const missing = s.tools.filter((t) => !hasSecuritySchemes(t)).map((t) => t.name);
+    add(
+      "tool-security-schemes",
+      missing.length ? "fail" : "pass",
+      missing.length ? `no securitySchemes on: ${missing.join(", ")}` : "every tool declares securitySchemes"
+    );
+  }
+}
+async function checkAuth(url, challenge, add) {
+  if (!challenge) {
+    const reason = "the server answered without a 401 challenge";
+    add("auth-challenge", "skip", reason);
+    add("auth-resource-metadata", "skip", reason);
+    add("auth-issuer", "skip", reason);
+    return;
+  }
+  const { resourceMetadataUrl } = extractWWWAuthenticateParams(challenge);
+  add(
+    "auth-challenge",
+    resourceMetadataUrl ? "pass" : "fail",
+    resourceMetadataUrl ? `401 names resource_metadata ${resourceMetadataUrl.href}` : `401 WWW-Authenticate carries no resource_metadata (${JSON.stringify(challenge.headers.get("www-authenticate"))})`
+  );
+  let prm;
+  try {
+    prm = await discoverOAuthProtectedResourceMetadata(url, { resourceMetadataUrl });
+  } catch (err) {
+    add(
+      "auth-resource-metadata",
+      "fail",
+      `protected-resource metadata unreadable: ${message(err)}`
+    );
+    add("auth-issuer", "skip", "no protected-resource metadata");
+    return;
+  }
+  add(
+    "auth-resource-metadata",
+    prm.resource === url ? "pass" : "fail",
+    prm.resource === url ? `resource equals ${url}` : `resource is ${JSON.stringify(prm.resource)}, not ${JSON.stringify(url)}`
+  );
+  const advertised = prm.authorization_servers?.[0];
+  if (!advertised) {
+    add("auth-issuer", "fail", "protected-resource metadata lists no authorization_servers");
+    return;
+  }
+  try {
+    const metadata = await discoverAuthorizationServerMetadata(advertised);
+    if (!metadata) {
+      add("auth-issuer", "fail", `no authorization server metadata found for ${advertised}`);
+    } else if (metadata.issuer !== advertised) {
+      add(
+        "auth-issuer",
+        "fail",
+        `issuer is ${JSON.stringify(metadata.issuer)}, advertised as ${JSON.stringify(advertised)}`
+      );
+    } else {
+      add("auth-issuer", "pass", `issuer equals ${advertised}`);
+    }
+  } catch (err) {
+    add("auth-issuer", "fail", `authorization server metadata unreadable: ${message(err)}`);
+  }
+}
+function toolUi(tool) {
+  const ui = tool._meta?.ui;
+  return ui && typeof ui === "object" ? ui : void 0;
+}
+function legacyBinding(tool) {
+  return tool._meta?.[RESOURCE_URI_META_KEY] !== void 0 && toolUi(tool)?.resourceUri === void 0;
+}
+function resourceUi(item) {
+  const ui = item?._meta?.ui;
+  return ui && typeof ui === "object" ? ui : void 0;
+}
+function isCsp(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => Array.isArray(v) && v.every((o) => typeof o === "string"));
+}
+function hasSecuritySchemes(tool) {
+  const schemes = tool._meta?.securitySchemes ?? tool.securitySchemes;
+  return Array.isArray(schemes) && schemes.length > 0;
+}
+var DATA_FONT_MIME = /data:(?:font\/|application\/(?:x-)?font|application\/vnd\.ms-fontobject)/i;
+var FONT_FACE_DATA_URL = /@font-face\s*{[^}]*url\(\s*["']?data:/i;
+function hasDataFont(html) {
+  return DATA_FONT_MIME.test(html) || FONT_FACE_DATA_URL.test(html);
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+export { PROFILES, applyProfiles, formatReport, isTargetName, runChecks };
+//# sourceMappingURL=check-YDZUQT6A.js.map
+//# sourceMappingURL=check-YDZUQT6A.js.map

package/dist/check-YDZUQT6A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/check/profiles.ts","../src/check/index.ts"],"names":[],"mappings":";;;;;;;;;AAqCA,IAAM,SAAA,GAAY,uDAAA;AAClB,IAAM,QAAA,GAAW,uEAAA;AACjB,IAAM,OAAA,GACJ,6GAAA;AACF,IAAM,SAAA,GAAY,iFAAA;AAClB,IAAM,SAAA,GAAY,6EAAA;AAClB,IAAM,YAAA,GACJ,kFAAA;AACF,IAAM,MAAA,GACJ,+GAAA;AAEK,IAAM,QAAA,GAAwC;AAAA,EACnD,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,aAAA;AAAA,IACN,WAAA,EAAa,uBAAA;AAAA,IACb,KAAA,EAAO;AAAA,MACL,kBAAA,EAAoB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MACxD,mBAAA,EAAqB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,MACxD,cAAA,EAAgB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,OAAA,EAAQ;AAAA;AAAA;AAAA,MAGlD,oBAAA,EAAsB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAK,SAAA,EAAU;AAAA;AAAA,MAEzD,gBAAA,EAAkB,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAK,SAAA,EAAU;AAAA,MACrD,wBAAA,EAA0B,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAK,YAAA,EAAa;AAAA,MAChE,aAAA,EAAe,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAK,MAAA;AAAO;AACjD,GACF;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,IAAA,EAAM,QAAA;AAAA,IACN,WAAA,EAAa,+BAAA;AAAA,IACb,KAAA,EAAO;AAAA,MACL,kBAAA,EAAoB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MACxD,mBAAA,EAAqB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,MACxD,cAAA,EAAgB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,OAAA,EAAQ;AAAA,MAClD,oBAAA,EAAsB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MAC1D,cAAA,EAAgB;AAAA,QACd,QAAA,EAAU,MAAA;AAAA,QACV,GAAA,EAAK;AAAA,OACP;AAAA,MACA,qBAAA,EAAuB;AAAA,QACrB,QAAA,EAAU,OAAA;AAAA,QACV,GAAA,EAAK;AAAA,OACP;AAAA,MACA,gBAAA,EAAkB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MACtD,wBAAA,EAA0B,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,YAAA,EAAa;AAAA;AAAA;AAAA,MAGjE,aAAA,EAAe,EAAE,QAAA,EAAU,MAAA,EAAQ,KAAK,MAAA;AAAO;AACjD,GACF;AAAA,EACA,OAAA,EAAS;AAAA,IACP,IAAA,EAAM,SAAA;AAAA,IACN,WAAA,EAAa,eAAA;AAAA,IACb,KAAA,EAAO;AAAA,MACL,kBAAA,EAAoB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MACxD,mBAAA,EAAqB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,MACxD,cAAA,EAAgB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,OAAA,EAAQ;AAAA,MAClD,oBAAA,EAAsB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MAC1D,cAAA,EAAgB;AAAA,QACd,QAAA,EAAU,OAAA;AAAA,QACV,GAAA,EAAK;AAAA,OACP;AAAA,MACA,qBAAA,EAAuB;AAAA,QACrB,QAAA,EAAU,MAAA;AAAA,QACV,GAAA,EAAK;AAAA,OACP;AAAA,MACA,gBAAA,EAAkB,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,SAAA,EAAU;AAAA,MACtD,wBAAA,EAA0B,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,YAAA,EAAa;AAAA,MACjE,aAAA,EAAe,EAAE,QAAA,EAAU,OAAA,EAAS,KAAK,MAAA,EAAO;AAAA,MAChD,uBAAA,EAAyB;AAAA,QACvB,QAAA,EAAU,OAAA;AAAA,QACV,GAAA,EAAK;AAAA;AACP;AACF;AAEJ;AAEO,SAAS,aAAa,KAAA,EAAoC;AAC/D,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,QAAA,EAAU,KAAK,CAAA;AACtC;;;AC5DA,IAAM,SAAA,GAAY,OAAA;AAClB,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,KAAK,CAAC,CAAA;AAY3C,eAAsB,SAAA,CAAU,GAAA,EAAa,OAAA,GAAwB,EAAC,EAA2B;AAC/F,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,GAAA,GAAM,CAAC,EAAA,EAAa,MAAA,EAAqB,MAAA,KAC7C,OAAA,CAAQ,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAA,EAAQ,CAAA;AAIrC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,WAAA,CAAY,GAAA,EAAK,KAAA,CAAA,EAAW,CAAC,GAAA,KAAQ;AACnD,MAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,SAAA,KAAc,GAAA;AAAA,IACxC,CAAC,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,YAAA,GAAe,GAAA;AAAA,EACjB;AAEA,EAAA,MAAM,eAAe,SAAA,KAAc,MAAA;AACnC,EAAA,IAAI,YAAA,IAAgB,QAAQ,KAAA,EAAO;AACjC,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,WAAA,CAAY,GAAA,EAAK,OAAA,CAAQ,KAAK,CAAA;AAC9C,MAAA,YAAA,GAAe,KAAA,CAAA;AAAA,IACjB,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,GAAe,GAAA;AAAA,IACjB;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,OAAA,KAAY,CAAC,YAAA,IAAgB,QAAQ,KAAA,CAAA,EAAQ;AAChD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,qBAAA,EAAwB,GAAG,CAAA,EAAG,YAAA,GAAe,0BAA0B,EAAE,CAAA,EAAA,EAAK,OAAA,CAAQ,YAAY,CAAC,CAAA;AAAA,KACrG;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,CAAU,GAAA,EAAK,SAAA,EAAW,GAAG,CAAA;AAEnC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,MAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,kDAAkD,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,YAAA,CAAa,OAAA,EAAS,cAAc,GAAG,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;AAGO,SAAS,aAAA,CAAc,SAAwB,OAAA,EAAuC;AAC3F,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,MAAA,KAAW;AAC7B,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,MAAM,CAAA,CAAE,KAAA;AAC/B,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,KAAM;AACpC,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAA,CAAE,EAAE,CAAA;AACvB,MAAA,OAAO,IAAA,GAAO,CAAC,EAAE,GAAG,CAAA,EAAG,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,IAAI,EAAC;AAAA,IACtE,CAAC,CAAA;AACD,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,MAAA,KAAW,MAAA,IAAU,CAAA,CAAE,QAAA,KAAa,OAAO;AAAA,KAC1E;AAAA,EACF,CAAC,CAAA;AACH;AAGO,SAAS,YAAA,CAAa,KAAa,OAAA,EAAiC;AACzE,EAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;AACtF,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,cAAA,EAAiB,GAAG,CAAA,CAAE,CAAA;AACrC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,CAAA,EAAG,MAAA,CAAO,MAAM,KAAK,MAAA,CAAO,MAAA,GAAS,MAAA,GAAS,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,OAAA,EAAS;AAC9B,MAAA,MAAM,KAAA,GACJ,CAAA,CAAE,MAAA,KAAW,MAAA,GAAU,CAAA,CAAE,QAAA,KAAa,OAAA,GAAU,MAAA,GAAS,MAAA,GAAU,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AAC1F,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,EAAA,CAAG,OAAO,KAAK,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AACrE,MAAA,IAAI,CAAA,CAAE,MAAA,KAAW,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,EAAA,CAAG,MAAA,CAAO,KAAK,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,GAAG,CAAA,CAAE,CAAA;AAAA,IAC7E;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAMA,IAAM,cAAA,GAA4B;AAAA,EAChC,oBAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF,CAAA;AAEA,eAAe,WAAA,CACb,GAAA,EACA,KAAA,EACA,UAAA,EACkB;AAGlB,EAAA,MAAM,EAAA,GAA8B,EAAE,SAAA,EAAW,CAAC,kBAAkB,CAAA,EAAE;AACtE,EAAA,MAAM,SAAS,IAAI,MAAA;AAAA,IACjB,EAAE,IAAA,EAAM,eAAA,EAAiB,OAAA,EAAS,GAAA,EAAI;AAAA,IACtC,EAAE,YAAA,EAAc,EAAE,UAAA,EAAY,EAAE,CAAC,YAAY,GAAG,EAAA,EAAG,EAAE;AAAE,GACzD;AACA,EAAA,MAAM,YAAY,IAAI,6BAAA,CAA8B,IAAI,GAAA,CAAI,GAAG,CAAA,EAAG;AAAA,IAChE,WAAA,EAAa,KAAA,GAAQ,EAAE,OAAA,EAAS,EAAE,eAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG,EAAE,GAAI,MAAA;AAAA,IACzE,KAAA,EAAO,OAAO,KAAA,EAAO,IAAA,KAAS;AAC5B,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AACnC,MAAA,UAAA,GAAa,GAAG,CAAA;AAChB,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,OAAO,qBAAA,EAAsB;AAClD,IAAA,MAAM,QAAgB,EAAC;AACvB,IAAA,MAAM,YAAwB,EAAC;AAC/B,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,cAAc,KAAA,EAAO;AACvB,MAAA,GAAG;AAKD,QAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,OAAA;AAAA,UACvB,EAAE,QAAQ,YAAA,EAAc,MAAA,EAAQ,SAAS,EAAE,MAAA,EAAO,GAAI,EAAC,EAAE;AAAA,UACzD;AAAA,SACF;AACA,QAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAC5C,QAAA,MAAM,QAAA,GAAY,GAAA,CAAmD,KAAA,IAAS,EAAC;AAC/E,QAAA,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,CAAA,KAAM;AAC9B,UAAA,MAAM,OAAA,GAAU,QAAA,CAAS,CAAC,CAAA,EAAG,eAAA;AAC7B,UAAA,IAAI,OAAA,KAAY,KAAA,CAAA,EAAY,IAAA,CAAiC,eAAA,GAAkB,OAAA;AAAA,QACjF,CAAC,CAAA;AACD,QAAA,KAAA,CAAM,IAAA,CAAK,GAAG,IAAA,CAAK,KAAK,CAAA;AACxB,QAAA,MAAA,GAAS,IAAA,CAAK,UAAA;AAAA,MAChB,CAAA,QAAS,MAAA;AAAA,IACX;AACA,IAAA,IAAI,cAAc,SAAA,EAAW;AAC3B,MAAA,GAAG;AACD,QAAA,MAAM,OAAO,MAAM,MAAA,CAAO,aAAA,CAAc,EAAE,QAAQ,CAAA;AAClD,QAAA,SAAA,CAAU,IAAA,CAAK,GAAG,IAAA,CAAK,SAAS,CAAA;AAChC,QAAA,MAAA,GAAS,IAAA,CAAK,UAAA;AAAA,MAChB,CAAA,QAAS,MAAA;AAAA,IACX;AAEA,IAAA,MAAM,OAAO,IAAI,GAAA,CAAI,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA;AACvF,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAI,CAAA,EAAG,WAAA;AAC1B,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,IAC3C;AACA,IAAA,MAAM,KAAA,uBAAY,GAAA,EAAwC;AAC1D,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,IAAI;AACF,QAAA,KAAA,CAAM,GAAA,CAAI,MAAM,MAAM,MAAA,CAAO,aAAa,EAAE,GAAA,EAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,MAC9D,SAAS,GAAA,EAAK;AACZ,QAAA,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,GAAA,YAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AACA,IAAA,OAAO,EAAE,YAAA,EAAc,KAAA,EAAO,SAAA,EAAW,KAAA,EAAM;AAAA,EACjD,CAAA,SAAE;AACA,IAAA,MAAM,OAAO,KAAA,EAAM;AAAA,EACrB;AACF;AAEA,SAAS,YAAA,CACP,CAAA,EACA,YAAA,EACA,GAAA,EACM;AACN,EAAA,MAAM,UAAA,GAAa,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,CAAC,MAAM,MAAA,CAAO,CAAC,CAAA,EAAG,WAAA,KAAgB,MAAS,CAAA;AAC7E,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,SAAA,CAAU,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,GAAA,CAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AACzE,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,MAAA,GAAS,CAAA,IAAK,WAAA,CAAY,SAAS,CAAA,IAAK,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,aAAa,CAAA;AAE3F,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,MAAA,IAAI,EAAA,KAAO,uBAAA,EAAyB,GAAA,CAAI,EAAA,EAAI,QAAQ,0BAA0B,CAAA;AAAA,IAChF;AAAA,EACF,CAAA,MAAO;AAEL,IAAA,MAAM,QAAA,GAAW,CAAA,CAAE,YAAA,EAAc,UAAA,GAAa,YAAY,CAAA,KAAM,MAAA;AAChE,IAAA,GAAA;AAAA,MACE,oBAAA;AAAA,MACA,WAAW,MAAA,GAAS,MAAA;AAAA,MACpB,QAAA,GACI,CAAA,EAAG,YAAY,CAAA,YAAA,CAAA,GACf,+BAA+B,YAAY,CAAA,2BAAA;AAAA,KACjD;AAGA,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,MAAA,IAAI,CAAA,CAAE,QAAA,KAAa,MAAA,IAAa,CAAA,CAAE,aAAa,kBAAA,EAAoB;AACjE,QAAA,SAAA,CAAU,KAAK,CAAA,EAAG,CAAA,CAAE,GAAG,CAAA,cAAA,EAAiB,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAA;AAAA,MACtD;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,QAAQ,CAAA,IAAK,EAAE,KAAA,EAAO;AACrC,MAAA,IAAI,oBAAoB,KAAA,EAAO;AAC/B,MAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,QAAA,IAAI,CAAA,CAAE,aAAa,kBAAA,EAAoB;AACrC,UAAA,SAAA,CAAU,KAAK,CAAA,EAAG,GAAG,iBAAiB,CAAA,CAAE,QAAA,IAAY,cAAc,CAAA,CAAE,CAAA;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AACA,IAAA,GAAA;AAAA,MACE,kBAAA;AAAA,MACA,SAAA,CAAU,SAAS,MAAA,GAAS,MAAA;AAAA,MAC5B,SAAA,CAAU,MAAA,GACN,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,WAAA,EAAc,kBAAkB,CAAA,CAAA,GACvD,CAAA,wBAAA,EAA2B,kBAAkB,CAAA;AAAA,KACnD;AAGA,IAAA,MAAM,aAAuB,EAAC;AAC9B,IAAA,KAAA,MAAW,IAAA,IAAQ,EAAE,KAAA,EAAO;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAI,CAAA,EAAG,WAAA;AAC1B,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACvB,UAAA,UAAA,CAAW,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,kDAAA,CAAoD,CAAA;AAAA,QAClF;AACA,QAAA;AAAA,MACF;AACA,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,GAAA,CAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzD,QAAA,UAAA,CAAW,IAAA,CAAK,GAAG,IAAA,CAAK,IAAI,oBAAoB,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,mBAAA,CAAqB,CAAA;AACxF,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAO,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC5B,MAAA,IAAI,IAAA,YAAgB,KAAA,IAAS,CAAC,IAAA,EAAM,MAAA,EAAQ;AAC1C,QAAA,UAAA,CAAW,IAAA;AAAA,UACT,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,eAAA,EAAkB,IAAA,YAAgB,KAAA,GAAQ,CAAA,EAAA,EAAK,IAAA,CAAK,OAAO,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA;AAAA,SACzF;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,IAAK,UAAA,CAAW,WAAW,CAAA,EAAG;AACtD,MAAA,UAAA,CAAW,KAAK,2CAA2C,CAAA;AAAA,IAC7D;AACA,IAAA,GAAA;AAAA,MACE,mBAAA;AAAA,MACA,UAAA,CAAW,SAAS,MAAA,GAAS,MAAA;AAAA,MAC7B,UAAA,CAAW,SACP,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA,GACpB,CAAA,EAAG,WAAW,MAAM,CAAA,gCAAA;AAAA,KAC1B;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,KAAA,MAAW,IAAA,IAAQ,EAAE,KAAA,EAAO;AAC1B,MAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,MAAA,IAAI,CAAC,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,EAAA,CAAG,UAAA;AACf,MAAA,IACE,QAAQ,MAAA,KACP,CAAC,MAAM,OAAA,CAAQ,GAAG,KAAK,GAAA,CAAI,MAAA,KAAW,KAAK,CAAC,GAAA,CAAI,MAAM,CAAC,CAAA,KAAM,WAAW,GAAA,CAAI,CAAC,CAAC,CAAA,CAAA,EAC/E;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,IAAI,mBAAmB,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,MACnE;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,CAAC,KAAA,EAAO,aAAa,CAAA,EAAY;AACjD,QAAA,IAAK,EAAA,CAA+B,GAAG,CAAA,KAAM,MAAA,EAAW;AACtD,UAAA,OAAA,CAAQ,KAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,sCAAA,CAAwC,CAAA;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AACA,IAAA,GAAA;AAAA,MACE,cAAA;AAAA,MACA,OAAA,CAAQ,SAAS,MAAA,GAAS,MAAA;AAAA,MAC1B,OAAA,CAAQ,MAAA,GAAS,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,GAAI;AAAA,KACxC;AAGA,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,QAAQ,CAAA,IAAK,EAAE,KAAA,EAAO;AACrC,MAAA,IAAI,oBAAoB,KAAA,EAAO;AAC/B,MAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,QAAA,MAAM,MAAA,GAAS,EAAE,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAEpD,QAAA,MAAM,EAAA,GAAM,UAAA,CAAW,CAAC,CAAA,IAAK,WAAW,MAAM,CAAA;AAC9C,QAAA,MAAM,MAAM,EAAA,EAAI,GAAA;AAChB,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,mBAAA,CAAqB,CAAA;AAAA,QACxC,CAAA,MAAA,IAAW,CAAC,KAAA,CAAM,GAAG,CAAA,EAAG;AACtB,UAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,qCAAA,CAAuC,CAAA;AAAA,QAC1D;AACA,QAAA,MAAM,IAAA,GAAO,MAAA,IAAU,CAAA,GAAI,CAAA,CAAE,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,CAAA,CAAE,IAAA,EAAM,QAAQ,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA;AAClF,QAAA,MAAM,YAAA,GAAe,MAAM,GAAG,CAAA,IAAA,CAAM,IAAI,eAAA,IAAmB,EAAC,EAAG,QAAA,CAAS,OAAO,CAAA;AAC/E,QAAA,IAAI,WAAA,CAAY,IAAI,CAAA,IAAK,CAAC,YAAA,EAAc;AACtC,UAAA,SAAA,CAAU,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,2DAAA,CAA6D,CAAA;AAAA,QACpF;AAAA,MACF;AAAA,IACF;AACA,IAAA,GAAA;AAAA,MACE,cAAA;AAAA,MACA,KAAA,CAAM,SAAS,MAAA,GAAS,MAAA;AAAA,MACxB,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI;AAAA,KACpC;AACA,IAAA,GAAA;AAAA,MACE,qBAAA;AAAA,MACA,SAAA,CAAU,SAAS,MAAA,GAAS,MAAA;AAAA,MAC5B,SAAA,CAAU,MAAA,GAAS,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI;AAAA,KAC5C;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,GAAA,CAAI,uBAAA,EAAyB,QAAQ,kCAAkC,CAAA;AAAA,EACzE,CAAA,MAAO;AACL,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,kBAAA,CAAmB,CAAC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAC/E,IAAA,GAAA;AAAA,MACE,uBAAA;AAAA,MACA,OAAA,CAAQ,SAAS,MAAA,GAAS,MAAA;AAAA,MAC1B,QAAQ,MAAA,GACJ,CAAA,uBAAA,EAA0B,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAC5C;AAAA,KACN;AAAA,EACF;AACF;AAMA,eAAe,SAAA,CACb,GAAA,EACA,SAAA,EACA,GAAA,EACe;AACf,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,MAAA,GAAS,6CAAA;AACf,IAAA,GAAA,CAAI,gBAAA,EAAkB,QAAQ,MAAM,CAAA;AACpC,IAAA,GAAA,CAAI,wBAAA,EAA0B,QAAQ,MAAM,CAAA;AAC5C,IAAA,GAAA,CAAI,aAAA,EAAe,QAAQ,MAAM,CAAA;AACjC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,4BAAA,CAA6B,SAAS,CAAA;AACtE,EAAA,GAAA;AAAA,IACE,gBAAA;AAAA,IACA,sBAAsB,MAAA,GAAS,MAAA;AAAA,IAC/B,mBAAA,GACI,CAAA,4BAAA,EAA+B,mBAAA,CAAoB,IAAI,CAAA,CAAA,GACvD,CAAA,mDAAA,EAAsD,IAAA,CAAK,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAC,CAAA,CAAA;AAAA,GACrH;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AAGF,IAAA,GAAA,GAAM,MAAM,sCAAA,CAAuC,GAAA,EAAK,EAAE,qBAAqB,CAAA;AAAA,EACjF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA;AAAA,MACE,wBAAA;AAAA,MACA,MAAA;AAAA,MACA,CAAA,wCAAA,EAA2C,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,KACzD;AACA,IAAA,GAAA,CAAI,aAAA,EAAe,QAAQ,gCAAgC,CAAA;AAC3D,IAAA;AAAA,EACF;AACA,EAAA,GAAA;AAAA,IACE,wBAAA;AAAA,IACA,GAAA,CAAI,QAAA,KAAa,GAAA,GAAM,MAAA,GAAS,MAAA;AAAA,IAChC,IAAI,QAAA,KAAa,GAAA,GACb,CAAA,gBAAA,EAAmB,GAAG,KACtB,CAAA,YAAA,EAAe,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAC,CAAA,MAAA,EAAS,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAAA,GAC7E;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,qBAAA,GAAwB,CAAC,CAAA;AAChD,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,GAAA,CAAI,aAAA,EAAe,QAAQ,4DAA4D,CAAA;AACvF,IAAA;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,mCAAA,CAAoC,UAAU,CAAA;AACrE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,GAAA,CAAI,aAAA,EAAe,MAAA,EAAQ,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAE,CAAA;AAAA,IACvF,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,UAAA,EAAY;AACzC,MAAA,GAAA;AAAA,QACE,aAAA;AAAA,QACA,MAAA;AAAA,QACA,CAAA,UAAA,EAAa,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,MAAM,CAAC,CAAA,gBAAA,EAAmB,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OAC3F;AAAA,IACF,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,aAAA,EAAe,MAAA,EAAQ,CAAA,cAAA,EAAiB,UAAU,CAAA,CAAE,CAAA;AAAA,IAC1D;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,eAAe,MAAA,EAAQ,CAAA,0CAAA,EAA6C,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACxF;AACF;AAMA,SAAS,OAAO,IAAA,EAAuC;AACrD,EAAA,MAAM,EAAA,GAAK,KAAK,KAAA,EAAO,EAAA;AACvB,EAAA,OAAO,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,GAAY,EAAA,GAAuB,MAAA;AAChE;AAEA,SAAS,cAAc,IAAA,EAAqB;AAC1C,EAAA,OACE,IAAA,CAAK,QAAQ,qBAAqB,CAAA,KAAM,UAAa,MAAA,CAAO,IAAI,GAAG,WAAA,KAAgB,MAAA;AAEvF;AAEA,SAAS,WAAW,IAAA,EAAgE;AAClF,EAAA,MAAM,EAAA,GAAK,MAAM,KAAA,EAAO,EAAA;AACxB,EAAA,OAAO,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,MAAA;AAC7C;AAEA,SAAS,MAAM,KAAA,EAAgE;AAC7E,EAAA,OACE,OAAO,KAAA,KAAU,QAAA,IACjB,KAAA,KAAU,IAAA,IACV,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IACpB,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAQ,CAAC,CAAA;AAE/F;AAEA,SAAS,mBAAmB,IAAA,EAAqB;AAC/C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,EAAO,eAAA,IAAoB,IAAA,CAAiC,eAAA;AACjF,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,QAAQ,MAAA,GAAS,CAAA;AACpD;AAEA,IAAM,cAAA,GAAiB,2EAAA;AACvB,IAAM,kBAAA,GAAqB,wCAAA;AAE3B,SAAS,YAAY,IAAA,EAAuB;AAC1C,EAAA,OAAO,eAAe,IAAA,CAAK,IAAI,CAAA,IAAK,kBAAA,CAAmB,KAAK,IAAI,CAAA;AAClE;AAEA,SAAS,QAAQ,GAAA,EAAsB;AACrC,EAAA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AACxD","file":"check-YDZUQT6A.js","sourcesContent":["/**\n * Store profiles for `synapse check`: which checks each host applies, and how\n * hard. A check a profile does not list is not run for that target.\n *\n * `error` fails the run. `warn` is reported and does not: it marks a\n * requirement the host is documented to have but is not known to enforce, so a\n * failure is a risk rather than a certain break.\n */\n\nexport type CheckId =\n  | \"extension-declared\"\n  | \"ui-resource-mime\"\n  | \"tool-resource-uri\"\n  | \"tool-ui-meta\"\n  | \"resource-csp\"\n  | \"resource-data-fonts\"\n  | \"auth-challenge\"\n  | \"auth-resource-metadata\"\n  | \"auth-issuer\"\n  | \"tool-security-schemes\";\n\nexport type Severity = \"error\" | \"warn\";\n\nexport interface ProfileRule {\n  severity: Severity;\n  /** The host requirement behind the rule, printed when the check fails. */\n  why: string;\n}\n\nexport interface Profile {\n  name: TargetName;\n  description: string;\n  rules: Partial<Record<CheckId, ProfileRule>>;\n}\n\nexport type TargetName = \"nimblebrain\" | \"claude\" | \"chatgpt\";\n\nconst SPEC_MIME = \"UI resources are served as text/html;profile=mcp-app.\";\nconst RESOLVES = \"A tool's ui.resourceUri must name a ui:// resource the server serves.\";\nconst UI_META =\n  \"ui.visibility is a non-empty subset of model/app; csp and permissions belong on the resource, not the tool.\";\nconst EXTENSION = \"A client uses MCP Apps only when both sides declare io.modelcontextprotocol/ui.\";\nconst CHALLENGE = \"Sign-in starts from a 401 whose WWW-Authenticate carries resource_metadata.\";\nconst PRM_RESOURCE =\n  \"The protected-resource metadata's resource must equal the connector URL exactly.\";\nconst ISSUER =\n  \"The authorization server's metadata issuer must equal the advertised authorization server exactly (RFC 8414).\";\n\nexport const PROFILES: Record<TargetName, Profile> = {\n  nimblebrain: {\n    name: \"nimblebrain\",\n    description: \"The NimbleBrain host.\",\n    rules: {\n      \"ui-resource-mime\": { severity: \"error\", why: SPEC_MIME },\n      \"tool-resource-uri\": { severity: \"error\", why: RESOLVES },\n      \"tool-ui-meta\": { severity: \"error\", why: UI_META },\n      // The host resolves an app by its ui:// scheme and does not gate on the\n      // declaration, so a missing one is a portability risk, not a break.\n      \"extension-declared\": { severity: \"warn\", why: EXTENSION },\n      // Only reported when the server challenges at all.\n      \"auth-challenge\": { severity: \"warn\", why: CHALLENGE },\n      \"auth-resource-metadata\": { severity: \"warn\", why: PRM_RESOURCE },\n      \"auth-issuer\": { severity: \"warn\", why: ISSUER },\n    },\n  },\n  claude: {\n    name: \"claude\",\n    description: \"claude.ai and Claude Desktop.\",\n    rules: {\n      \"ui-resource-mime\": { severity: \"error\", why: SPEC_MIME },\n      \"tool-resource-uri\": { severity: \"error\", why: RESOLVES },\n      \"tool-ui-meta\": { severity: \"error\", why: UI_META },\n      \"extension-declared\": { severity: \"error\", why: EXTENSION },\n      \"resource-csp\": {\n        severity: \"warn\",\n        why: \"Claude builds the frame's security policy from ui.csp; an undeclared origin is blocked.\",\n      },\n      \"resource-data-fonts\": {\n        severity: \"error\",\n        why: \"Claude's default security policy blocks data: fonts unless the resource declares them.\",\n      },\n      \"auth-challenge\": { severity: \"error\", why: CHALLENGE },\n      \"auth-resource-metadata\": { severity: \"error\", why: PRM_RESOURCE },\n      // Claude has been observed to accept an issuer that differs by a trailing\n      // slash, so this is a correctness warning for Claude rather than a break.\n      \"auth-issuer\": { severity: \"warn\", why: ISSUER },\n    },\n  },\n  chatgpt: {\n    name: \"chatgpt\",\n    description: \"ChatGPT apps.\",\n    rules: {\n      \"ui-resource-mime\": { severity: \"error\", why: SPEC_MIME },\n      \"tool-resource-uri\": { severity: \"error\", why: RESOLVES },\n      \"tool-ui-meta\": { severity: \"error\", why: UI_META },\n      \"extension-declared\": { severity: \"error\", why: EXTENSION },\n      \"resource-csp\": {\n        severity: \"error\",\n        why: \"ChatGPT reads the frame's security policy from ui.csp, and app submission requires it.\",\n      },\n      \"resource-data-fonts\": {\n        severity: \"warn\",\n        why: \"A data: font is blocked by a security policy that does not declare it.\",\n      },\n      \"auth-challenge\": { severity: \"error\", why: CHALLENGE },\n      \"auth-resource-metadata\": { severity: \"error\", why: PRM_RESOURCE },\n      \"auth-issuer\": { severity: \"error\", why: ISSUER },\n      \"tool-security-schemes\": {\n        severity: \"error\",\n        why: \"ChatGPT prompts for sign-in mid-conversation only for tools that declare securitySchemes.\",\n      },\n    },\n  },\n};\n\nexport function isTargetName(value: string): value is TargetName {\n  return Object.hasOwn(PROFILES, value);\n}\n","/**\n * `synapse check` — verify, from outside, what a host sees of a running MCP\n * server: the UI resources and their metadata, the MCP Apps extension\n * declaration, and the OAuth discovery surface a host signs in through.\n *\n * Every check runs once against the server; each target's profile then decides\n * which results count and how hard (see `./profiles.ts`).\n */\n\nimport type {\n  McpUiClientCapabilities,\n  McpUiResourceMeta,\n  McpUiToolMeta,\n} from \"@modelcontextprotocol/ext-apps\";\nimport {\n  EXTENSION_ID,\n  RESOURCE_MIME_TYPE,\n  RESOURCE_URI_META_KEY,\n} from \"@modelcontextprotocol/ext-apps/server\";\nimport {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n  extractWWWAuthenticateParams,\n} from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type {\n  ReadResourceResult,\n  Resource,\n  ServerCapabilities,\n  Tool,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { ListToolsResultSchema, ResultSchema } from \"@modelcontextprotocol/sdk/types.js\";\nimport { type CheckId, PROFILES, type Severity, type TargetName } from \"./profiles.js\";\n\nexport { type CheckId, isTargetName, PROFILES, type Profile, type TargetName } from \"./profiles.js\";\n\nexport type CheckStatus = \"pass\" | \"fail\" | \"skip\";\n\nexport interface CheckResult {\n  id: CheckId;\n  status: CheckStatus;\n  detail: string;\n}\n\nexport interface TargetReport {\n  target: TargetName;\n  results: Array<CheckResult & { severity: Severity; why: string }>;\n  /** True when any `error`-severity check failed. */\n  failed: boolean;\n}\n\nexport interface CheckOptions {\n  /** Bearer token for a server that requires auth. Without one, checks that need a session are skipped. */\n  token?: string;\n}\n\nconst UI_SCHEME = \"ui://\";\nconst VISIBILITY = new Set([\"model\", \"app\"]);\n\ntype ResourceContents = ReadResourceResult[\"contents\"][number];\n\ninterface Session {\n  capabilities: ServerCapabilities | undefined;\n  tools: Tool[];\n  resources: Resource[];\n  reads: Map<string, ResourceContents[] | Error>;\n}\n\n/** Run every check against `url` once. */\nexport async function runChecks(url: string, options: CheckOptions = {}): Promise<CheckResult[]> {\n  const results: CheckResult[] = [];\n  const add = (id: CheckId, status: CheckStatus, detail: string) =>\n    results.push({ id, status, detail });\n\n  // Connect without credentials first: the response to that is what a host\n  // sees before sign-in, and it decides whether the server requires auth.\n  let challenge: Response | undefined;\n  let session: Session | undefined;\n  let connectError: unknown;\n  try {\n    session = await openSession(url, undefined, (res) => {\n      if (res.status === 401) challenge ??= res;\n    });\n  } catch (err) {\n    connectError = err;\n  }\n\n  const authRequired = challenge !== undefined;\n  if (authRequired && options.token) {\n    try {\n      session = await openSession(url, options.token);\n      connectError = undefined;\n    } catch (err) {\n      connectError = err;\n    }\n  }\n\n  // A server that cannot be reached is not a server that passes.\n  if (!session && (!authRequired || options.token)) {\n    throw new Error(\n      `could not connect to ${url}${authRequired ? \" with the given token\" : \"\"}: ${message(connectError)}`,\n    );\n  }\n\n  await checkAuth(url, challenge, add);\n\n  if (!session) {\n    for (const id of SESSION_CHECKS) {\n      add(id, \"skip\", \"the server requires auth; pass --token to run it\");\n    }\n    return results;\n  }\n\n  checkSession(session, authRequired, add);\n  return results;\n}\n\n/** Apply each target's profile to one set of results. */\nexport function applyProfiles(results: CheckResult[], targets: TargetName[]): TargetReport[] {\n  return targets.map((target) => {\n    const rules = PROFILES[target].rules;\n    const scored = results.flatMap((r) => {\n      const rule = rules[r.id];\n      return rule ? [{ ...r, severity: rule.severity, why: rule.why }] : [];\n    });\n    return {\n      target,\n      results: scored,\n      failed: scored.some((r) => r.status === \"fail\" && r.severity === \"error\"),\n    };\n  });\n}\n\n/** One line per check, grouped by target. */\nexport function formatReport(url: string, reports: TargetReport[]): string {\n  const width = Math.max(...reports.flatMap((r) => r.results.map((c) => c.id.length)), 0);\n  const lines = [`synapse check ${url}`];\n  for (const report of reports) {\n    lines.push(\"\", `${report.target}: ${report.failed ? \"FAIL\" : \"ok\"}`);\n    for (const r of report.results) {\n      const label =\n        r.status === \"fail\" ? (r.severity === \"error\" ? \"FAIL\" : \"WARN\") : r.status.toUpperCase();\n      lines.push(`  ${label.padEnd(4)}  ${r.id.padEnd(width)}  ${r.detail}`);\n      if (r.status === \"fail\") lines.push(`        ${\"\".padEnd(width)}  ${r.why}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\n// ---------------------------------------------------------------------------\n// session\n// ---------------------------------------------------------------------------\n\nconst SESSION_CHECKS: CheckId[] = [\n  \"extension-declared\",\n  \"ui-resource-mime\",\n  \"tool-resource-uri\",\n  \"tool-ui-meta\",\n  \"resource-csp\",\n  \"resource-data-fonts\",\n  \"tool-security-schemes\",\n];\n\nasync function openSession(\n  url: string,\n  token: string | undefined,\n  onResponse?: (res: Response) => void,\n): Promise<Session> {\n  // Declare MCP Apps support, so a server that gates its UI on the client's\n  // capability shows the UI a host would see.\n  const ui: McpUiClientCapabilities = { mimeTypes: [RESOURCE_MIME_TYPE] };\n  const client = new Client(\n    { name: \"synapse-check\", version: \"1\" },\n    { capabilities: { extensions: { [EXTENSION_ID]: ui } } },\n  );\n  const transport = new StreamableHTTPClientTransport(new URL(url), {\n    requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,\n    fetch: async (input, init) => {\n      const res = await fetch(input, init);\n      onResponse?.(res);\n      return res;\n    },\n  });\n  await client.connect(transport);\n  try {\n    const capabilities = client.getServerCapabilities();\n    const tools: Tool[] = [];\n    const resources: Resource[] = [];\n    let cursor: string | undefined;\n    if (capabilities?.tools) {\n      do {\n        // Requested raw rather than through `listTools()`: the SDK's tool schema\n        // strips fields it does not model, and ChatGPT documents `securitySchemes`\n        // at the tool's top level as well as in `_meta`. The one field is copied\n        // back onto each parsed tool so `hasSecuritySchemes` can see either place.\n        const raw = await client.request(\n          { method: \"tools/list\", params: cursor ? { cursor } : {} },\n          ResultSchema,\n        );\n        const page = ListToolsResultSchema.parse(raw);\n        const rawTools = (raw as { tools?: Array<Record<string, unknown>> }).tools ?? [];\n        page.tools.forEach((tool, i) => {\n          const schemes = rawTools[i]?.securitySchemes;\n          if (schemes !== undefined) (tool as Record<string, unknown>).securitySchemes = schemes;\n        });\n        tools.push(...page.tools);\n        cursor = page.nextCursor;\n      } while (cursor);\n    }\n    if (capabilities?.resources) {\n      do {\n        const page = await client.listResources({ cursor });\n        resources.push(...page.resources);\n        cursor = page.nextCursor;\n      } while (cursor);\n    }\n\n    const uris = new Set(resources.map((r) => r.uri).filter((u) => u.startsWith(UI_SCHEME)));\n    for (const tool of tools) {\n      const uri = toolUi(tool)?.resourceUri;\n      if (typeof uri === \"string\") uris.add(uri);\n    }\n    const reads = new Map<string, ResourceContents[] | Error>();\n    for (const uri of uris) {\n      try {\n        reads.set(uri, (await client.readResource({ uri })).contents);\n      } catch (err) {\n        reads.set(uri, err instanceof Error ? err : new Error(String(err)));\n      }\n    }\n    return { capabilities, tools, resources, reads };\n  } finally {\n    await client.close();\n  }\n}\n\nfunction checkSession(\n  s: Session,\n  authRequired: boolean,\n  add: (id: CheckId, status: CheckStatus, detail: string) => void,\n): void {\n  const boundTools = s.tools.filter((t) => toolUi(t)?.resourceUri !== undefined);\n  const uiResources = s.resources.filter((r) => r.uri.startsWith(UI_SCHEME));\n  const hasUi = boundTools.length > 0 || uiResources.length > 0 || s.tools.some(legacyBinding);\n\n  if (!hasUi) {\n    for (const id of SESSION_CHECKS) {\n      if (id !== \"tool-security-schemes\") add(id, \"skip\", \"the server exposes no UI\");\n    }\n  } else {\n    // extension-declared\n    const declared = s.capabilities?.extensions?.[EXTENSION_ID] !== undefined;\n    add(\n      \"extension-declared\",\n      declared ? \"pass\" : \"fail\",\n      declared\n        ? `${EXTENSION_ID} is declared`\n        : `the server does not declare ${EXTENSION_ID} in capabilities.extensions`,\n    );\n\n    // ui-resource-mime: every ui:// resource, as listed and as read.\n    const wrongMime: string[] = [];\n    for (const r of uiResources) {\n      if (r.mimeType !== undefined && r.mimeType !== RESOURCE_MIME_TYPE) {\n        wrongMime.push(`${r.uri} is listed as ${r.mimeType}`);\n      }\n    }\n    for (const [uri, contents] of s.reads) {\n      if (contents instanceof Error) continue;\n      for (const c of contents) {\n        if (c.mimeType !== RESOURCE_MIME_TYPE) {\n          wrongMime.push(`${uri} is served as ${c.mimeType ?? \"no MIME type\"}`);\n        }\n      }\n    }\n    add(\n      \"ui-resource-mime\",\n      wrongMime.length ? \"fail\" : \"pass\",\n      wrongMime.length\n        ? `${wrongMime.join(\"; \")}; expected ${RESOURCE_MIME_TYPE}`\n        : `every ui:// resource is ${RESOURCE_MIME_TYPE}`,\n    );\n\n    // tool-resource-uri\n    const unresolved: string[] = [];\n    for (const tool of s.tools) {\n      const uri = toolUi(tool)?.resourceUri;\n      if (uri === undefined) {\n        if (legacyBinding(tool)) {\n          unresolved.push(`${tool.name} binds its UI only through the deprecated flat key`);\n        }\n        continue;\n      }\n      if (typeof uri !== \"string\" || !uri.startsWith(UI_SCHEME)) {\n        unresolved.push(`${tool.name}: ui.resourceUri ${JSON.stringify(uri)} is not a ui:// URI`);\n        continue;\n      }\n      const read = s.reads.get(uri);\n      if (read instanceof Error || !read?.length) {\n        unresolved.push(\n          `${tool.name}: ${uri} cannot be read${read instanceof Error ? ` (${read.message})` : \"\"}`,\n        );\n      }\n    }\n    if (boundTools.length === 0 && unresolved.length === 0) {\n      unresolved.push(\"no tool binds a UI through ui.resourceUri\");\n    }\n    add(\n      \"tool-resource-uri\",\n      unresolved.length ? \"fail\" : \"pass\",\n      unresolved.length\n        ? unresolved.join(\"; \")\n        : `${boundTools.length} tool(s) bind a UI that resolves`,\n    );\n\n    // tool-ui-meta\n    const badMeta: string[] = [];\n    for (const tool of s.tools) {\n      const ui = toolUi(tool);\n      if (!ui) continue;\n      const vis = ui.visibility as unknown;\n      if (\n        vis !== undefined &&\n        (!Array.isArray(vis) || vis.length === 0 || !vis.every((v) => VISIBILITY.has(v)))\n      ) {\n        badMeta.push(`${tool.name}: ui.visibility ${JSON.stringify(vis)}`);\n      }\n      for (const key of [\"csp\", \"permissions\"] as const) {\n        if ((ui as Record<string, unknown>)[key] !== undefined) {\n          badMeta.push(`${tool.name}: ui.${key} is on the tool, where hosts ignore it`);\n        }\n      }\n    }\n    add(\n      \"tool-ui-meta\",\n      badMeta.length ? \"fail\" : \"pass\",\n      badMeta.length ? badMeta.join(\"; \") : \"tool ui metadata is well-formed\",\n    );\n\n    // resource-csp and resource-data-fonts, per UI resource read.\n    const noCsp: string[] = [];\n    const dataFonts: string[] = [];\n    for (const [uri, contents] of s.reads) {\n      if (contents instanceof Error) continue;\n      for (const c of contents) {\n        const listed = s.resources.find((r) => r.uri === uri);\n        // Hosts read the content item's metadata, and fall back to the list entry.\n        const ui = (resourceUi(c) ?? resourceUi(listed)) as McpUiResourceMeta | undefined;\n        const csp = ui?.csp as unknown;\n        if (csp === undefined) {\n          noCsp.push(`${uri} declares no ui.csp`);\n        } else if (!isCsp(csp)) {\n          noCsp.push(`${uri}: ui.csp is not a map of origin lists`);\n        }\n        const html = \"text\" in c ? c.text : Buffer.from(c.blob, \"base64\").toString(\"utf-8\");\n        const declaresData = isCsp(csp) && (csp.resourceDomains ?? []).includes(\"data:\");\n        if (hasDataFont(html) && !declaresData) {\n          dataFonts.push(`${uri} loads a data: font, and ui.csp.resourceDomains omits data:`);\n        }\n      }\n    }\n    add(\n      \"resource-csp\",\n      noCsp.length ? \"fail\" : \"pass\",\n      noCsp.length ? noCsp.join(\"; \") : \"every UI resource declares ui.csp\",\n    );\n    add(\n      \"resource-data-fonts\",\n      dataFonts.length ? \"fail\" : \"pass\",\n      dataFonts.length ? dataFonts.join(\"; \") : \"no undeclared data: fonts\",\n    );\n  }\n\n  // tool-security-schemes: a question about auth, not about UI.\n  if (!authRequired) {\n    add(\"tool-security-schemes\", \"skip\", \"the server does not require auth\");\n  } else {\n    const missing = s.tools.filter((t) => !hasSecuritySchemes(t)).map((t) => t.name);\n    add(\n      \"tool-security-schemes\",\n      missing.length ? \"fail\" : \"pass\",\n      missing.length\n        ? `no securitySchemes on: ${missing.join(\", \")}`\n        : \"every tool declares securitySchemes\",\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// auth\n// ---------------------------------------------------------------------------\n\nasync function checkAuth(\n  url: string,\n  challenge: Response | undefined,\n  add: (id: CheckId, status: CheckStatus, detail: string) => void,\n): Promise<void> {\n  if (!challenge) {\n    const reason = \"the server answered without a 401 challenge\";\n    add(\"auth-challenge\", \"skip\", reason);\n    add(\"auth-resource-metadata\", \"skip\", reason);\n    add(\"auth-issuer\", \"skip\", reason);\n    return;\n  }\n\n  const { resourceMetadataUrl } = extractWWWAuthenticateParams(challenge);\n  add(\n    \"auth-challenge\",\n    resourceMetadataUrl ? \"pass\" : \"fail\",\n    resourceMetadataUrl\n      ? `401 names resource_metadata ${resourceMetadataUrl.href}`\n      : `401 WWW-Authenticate carries no resource_metadata (${JSON.stringify(challenge.headers.get(\"www-authenticate\"))})`,\n  );\n\n  let prm: Awaited<ReturnType<typeof discoverOAuthProtectedResourceMetadata>>;\n  try {\n    // Without resource_metadata, a client falls back to the well-known path,\n    // so the rest of the surface is still worth reporting.\n    prm = await discoverOAuthProtectedResourceMetadata(url, { resourceMetadataUrl });\n  } catch (err) {\n    add(\n      \"auth-resource-metadata\",\n      \"fail\",\n      `protected-resource metadata unreadable: ${message(err)}`,\n    );\n    add(\"auth-issuer\", \"skip\", \"no protected-resource metadata\");\n    return;\n  }\n  add(\n    \"auth-resource-metadata\",\n    prm.resource === url ? \"pass\" : \"fail\",\n    prm.resource === url\n      ? `resource equals ${url}`\n      : `resource is ${JSON.stringify(prm.resource)}, not ${JSON.stringify(url)}`,\n  );\n\n  const advertised = prm.authorization_servers?.[0];\n  if (!advertised) {\n    add(\"auth-issuer\", \"fail\", \"protected-resource metadata lists no authorization_servers\");\n    return;\n  }\n  try {\n    const metadata = await discoverAuthorizationServerMetadata(advertised);\n    if (!metadata) {\n      add(\"auth-issuer\", \"fail\", `no authorization server metadata found for ${advertised}`);\n    } else if (metadata.issuer !== advertised) {\n      add(\n        \"auth-issuer\",\n        \"fail\",\n        `issuer is ${JSON.stringify(metadata.issuer)}, advertised as ${JSON.stringify(advertised)}`,\n      );\n    } else {\n      add(\"auth-issuer\", \"pass\", `issuer equals ${advertised}`);\n    }\n  } catch (err) {\n    add(\"auth-issuer\", \"fail\", `authorization server metadata unreadable: ${message(err)}`);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// helpers\n// ---------------------------------------------------------------------------\n\nfunction toolUi(tool: Tool): McpUiToolMeta | undefined {\n  const ui = tool._meta?.ui;\n  return ui && typeof ui === \"object\" ? (ui as McpUiToolMeta) : undefined;\n}\n\nfunction legacyBinding(tool: Tool): boolean {\n  return (\n    tool._meta?.[RESOURCE_URI_META_KEY] !== undefined && toolUi(tool)?.resourceUri === undefined\n  );\n}\n\nfunction resourceUi(item: { _meta?: Record<string, unknown> } | undefined): unknown {\n  const ui = item?._meta?.ui;\n  return ui && typeof ui === \"object\" ? ui : undefined;\n}\n\nfunction isCsp(value: unknown): value is NonNullable<McpUiResourceMeta[\"csp\"]> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((v) => Array.isArray(v) && v.every((o) => typeof o === \"string\"))\n  );\n}\n\nfunction hasSecuritySchemes(tool: Tool): boolean {\n  const schemes = tool._meta?.securitySchemes ?? (tool as Record<string, unknown>).securitySchemes;\n  return Array.isArray(schemes) && schemes.length > 0;\n}\n\nconst DATA_FONT_MIME = /data:(?:font\\/|application\\/(?:x-)?font|application\\/vnd\\.ms-fontobject)/i;\nconst FONT_FACE_DATA_URL = /@font-face\\s*{[^}]*url\\(\\s*[\"']?data:/i;\n\nfunction hasDataFont(html: string): boolean {\n  return DATA_FONT_MIME.test(html) || FONT_FACE_DATA_URL.test(html);\n}\n\nfunction message(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n"]}