ax-audit 3.1.0 → 4.0.0

package/dist/checks/api-discovery.js

@@ -0,0 +1,432 @@
+import { API_DESCRIPTION_PATHS, LINKSET_MEDIA_TYPE } from '../constants.js';
+import { guideUrl } from '../guide-urls.js';
+import { buildResult, checkContentType, isHtmlDocument, notApplicable } from './utils.js';
+import { hasApiSurface } from './surface.js';
+import { findLinkTags, getAttribute } from './html-utils.js';
+import { parseLinkHeader } from './http-headers.js';
+import { standingNote } from './well-known.js';
+/**
+ * "api-discovery" — can an agent find, and read, this site's API description?
+ *
+ * The check used to probe exactly one path, `/.well-known/openapi.json`. That
+ * path is a folk convention: it is not in the IANA well-known registry, and the
+ * OpenAPI specification itself recommends the file be named `openapi.json` or
+ * `openapi.yaml` without prescribing a location. So a site doing everything
+ * right at `/openapi.json` scored zero.
+ *
+ * There *is* a registered mechanism: RFC 9727 defines `/.well-known/api-catalog`,
+ * a linkset of the APIs a publisher offers, each entry pointing at a
+ * machine-readable description via `service-desc` and human documentation via
+ * `service-doc` (RFC 8631). Adoption is tiny — a handful of publishers — but it
+ * is the only standards-track answer, and checking it costs one request.
+ *
+ * The check therefore walks discovery in order of authority: the registered
+ * catalog, then RFC 8631 link relations in headers and HTML, then the
+ * conventional file locations. Whatever it finds, it validates the same way, so
+ * broadening discovery can only raise a score, never lower one.
+ */
+export const meta = {
+    id: 'api-discovery',
+    name: 'API Discovery',
+    description: 'Checks how agents discover an API description (RFC 9727 catalog, service-desc links, OpenAPI)',
+    category: 'protocols',
+    aliases: ['openapi'],
+};
+const MECHANISM_LABEL = {
+    'api-catalog': '/.well-known/api-catalog (RFC 9727)',
+    'link-header': 'Link header rel="service-desc"',
+    'html-link': '<link rel="service-desc">',
+    'conventional-path': 'conventional file path',
+};
+function absolute(url, base) {
+    try {
+        return new URL(url, `${base}/`).toString();
+    }
+    catch {
+        return url;
+    }
+}
+/**
+ * Follow the discovery chain. Returns the description document plus how it was
+ * found, and separately whether a catalog exists at all, since a catalog is
+ * worth reporting even when its entries lead nowhere.
+ */
+async function locate(ctx) {
+    // 1. RFC 9727 — the registered mechanism.
+    const catalogRes = await ctx.fetch(`${ctx.url}/.well-known/api-catalog`);
+    const catalog = catalogRes.ok && catalogRes.body.trim().length > 0 ? catalogRes : null;
+    if (catalog !== null) {
+        for (const href of serviceDescsFromLinkset(catalog.body)) {
+            const res = await ctx.fetch(absolute(href, ctx.url));
+            if (res.ok && res.body.trim().length > 0) {
+                return { found: { mechanism: 'api-catalog', path: href, res }, catalog };
+            }
+        }
+    }
+    // 2. RFC 8631 link relations, in the response header then the HTML head.
+    for (const entry of parseLinkHeader(ctx.headers['link'] ?? '')) {
+        if (entry.params['rel'] !== 'service-desc')
+            continue;
+        const res = await ctx.fetch(absolute(entry.url, ctx.url));
+        if (res.ok && res.body.trim().length > 0) {
+            return { found: { mechanism: 'link-header', path: entry.url, res }, catalog };
+        }
+    }
+    for (const tag of findLinkTags(ctx.html, 'service-desc')) {
+        const href = getAttribute(tag, 'href');
+        if (href === null)
+            continue;
+        const res = await ctx.fetch(absolute(href, ctx.url));
+        if (res.ok && res.body.trim().length > 0) {
+            return { found: { mechanism: 'html-link', path: href, res }, catalog };
+        }
+    }
+    // 3. Conventional locations, registered path first.
+    for (const path of API_DESCRIPTION_PATHS) {
+        const res = await ctx.fetch(`${ctx.url}${path}`);
+        if (res.ok && res.body.trim().length > 0 && looksLikeApiDescription(res.body)) {
+            return { found: { mechanism: 'conventional-path', path, res }, catalog };
+        }
+    }
+    return { found: null, catalog };
+}
+/** Pull `service-desc` hrefs out of an RFC 9264 linkset document. */
+export function serviceDescsFromLinkset(body) {
+    try {
+        const data = JSON.parse(body);
+        const linkset = Array.isArray(data.linkset) ? data.linkset : [];
+        return linkset.flatMap((entry) => {
+            const descs = Array.isArray(entry['service-desc']) ? entry['service-desc'] : [];
+            return descs.map((d) => String(d.href ?? '')).filter((h) => h !== '');
+        });
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * A 200 from `/api-docs` is usually a Swagger UI page, and on an SPA every
+ * unknown path returns the index shell. Either would turn "no API description"
+ * into a confusing validation failure, so pages are treated as absent.
+ */
+function looksLikeApiDescription(body) {
+    return !isHtmlDocument(body);
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    const { found, catalog } = await locate(ctx);
+    if (catalog !== null) {
+        score = reportCatalog(catalog, findings, score);
+    }
+    if (found === null) {
+        const surface = await hasApiSurface(ctx);
+        if (!surface.found) {
+            findings.push({
+                status: 'pass',
+                message: 'No API surface — API discovery does not apply to this site',
+                detail: 'No description, catalog, service-desc relation or developer area was found. Run with --profile api to ' +
+                    'audit as though the site offered one.',
+            });
+            return notApplicable(meta, findings, start);
+        }
+        findings.push({
+            status: 'fail',
+            message: 'API surface present but no machine-readable description found',
+            detail: `Evidence of an API: ${surface.reason}. Checked /.well-known/api-catalog, Link and <link> rel="service-desc", and ${API_DESCRIPTION_PATHS.join(', ')}`,
+            hint: 'The API exists; nothing describes it in a form an agent can read, so using it requires a human to read your ' +
+                'documentation first. Serve an OpenAPI description at /openapi.json and advertise it with ' +
+                'Link: </openapi.json>; rel="service-desc". For several APIs, publish an RFC 9727 catalog.',
+            learnMoreUrl: guideUrl(meta.id, 'not-found'),
+        });
+        return buildResult(meta, 0, findings, start);
+    }
+    findings.push({
+        status: 'pass',
+        message: `API description found at ${found.path} via ${MECHANISM_LABEL[found.mechanism]}`,
+        detail: standingNote(found.path),
+    });
+    if (found.mechanism === 'conventional-path' && catalog === null) {
+        findings.push({
+            status: 'warn',
+            message: 'API description is only discoverable by guessing its path',
+            hint: 'Nothing on the site points at it, so an agent has to try known filenames. Advertise it with a Link header ' +
+                '(Link: <…>; rel="service-desc") or a <link rel="service-desc"> tag, and for multiple APIs an RFC 9727 catalog.',
+            learnMoreUrl: guideUrl(meta.id, 'undiscoverable'),
+        });
+    }
+    return validateDescription(found, findings, score, start);
+}
+/** Report an RFC 9727 catalog: its media type, shape, and entry completeness. */
+function reportCatalog(res, findings, score) {
+    const ct = (res.headers['content-type'] ?? '').toLowerCase();
+    if (!ct.includes(LINKSET_MEDIA_TYPE) && !ct.includes('application/json')) {
+        findings.push({
+            status: 'warn',
+            message: `/.well-known/api-catalog served as "${ct.split(';')[0] || 'no Content-Type'}"`,
+            detail: `RFC 9727 requires support for ${LINKSET_MEDIA_TYPE}.`,
+            hint: `Serve the catalog as ${LINKSET_MEDIA_TYPE}.`,
+            learnMoreUrl: guideUrl(meta.id, 'catalog-content-type'),
+        });
+        return score;
+    }
+    let data;
+    try {
+        data = JSON.parse(res.body);
+    }
+    catch {
+        findings.push({
+            status: 'warn',
+            message: '/.well-known/api-catalog is not valid JSON',
+            hint: 'The catalog must be a JSON linkset per RFC 9264.',
+            learnMoreUrl: guideUrl(meta.id, 'catalog-invalid'),
+        });
+        return score;
+    }
+    const linkset = Array.isArray(data.linkset) ? data.linkset : [];
+    if (linkset.length === 0) {
+        findings.push({
+            status: 'warn',
+            message: 'API catalog present but its linkset is empty',
+            hint: 'Each linkset entry needs an anchor and at least one service-desc or service-doc link.',
+            learnMoreUrl: guideUrl(meta.id, 'catalog-empty'),
+        });
+        return score;
+    }
+    findings.push({
+        status: 'pass',
+        message: `RFC 9727 API catalog lists ${linkset.length} API(s)`,
+        detail: standingNote('/.well-known/api-catalog'),
+    });
+    const noAnchor = linkset.filter((e) => typeof e.anchor !== 'string' || e.anchor === '').length;
+    if (noAnchor > 0) {
+        findings.push({
+            status: 'warn',
+            message: `${noAnchor} catalog entry(ies) missing an anchor`,
+            hint: 'Every linkset entry needs an "anchor" identifying the API it describes.',
+            learnMoreUrl: guideUrl(meta.id, 'catalog-anchor'),
+        });
+    }
+    const noDocs = linkset.filter((e) => !Array.isArray(e['service-doc'])).length;
+    if (noDocs > 0) {
+        findings.push({
+            status: 'warn',
+            message: `${noDocs} catalog entry(ies) have no service-doc link`,
+            hint: 'Pair each service-desc (machine-readable) with a service-doc (human-readable). Agents surface the latter to users.',
+            learnMoreUrl: guideUrl(meta.id, 'catalog-service-doc'),
+        });
+    }
+    return score;
+}
+/**
+ * Validate the description document. The deduction table is unchanged from the
+ * pre-3.7 OpenAPI check, so a site that scored under the old single-path check
+ * scores identically now.
+ */
+function validateDescription(located, findings, score, start) {
+    const { res, path } = located;
+    const isYaml = /\.ya?ml$/i.test(path) || /^\s*openapi\s*:/im.test(res.body);
+    if (!isYaml) {
+        const ctFinding = checkContentType(res, ['application/json'], {
+            checkId: meta.id,
+            resourceLabel: path,
+            anchor: 'wrong-content-type',
+        });
+        if (ctFinding) {
+            findings.push(ctFinding);
+            score -= 5;
+        }
+    }
+    if (isYaml) {
+        // ax-audit carries no YAML parser (zero runtime dependencies beyond chalk
+        // and commander). Report what can be read from the surface and say plainly
+        // that the document was not fully validated, rather than guessing.
+        return reportYamlDescription(res.body, path, findings, score, start);
+    }
+    let data;
+    try {
+        data = JSON.parse(res.body);
+    }
+    catch {
+        findings.push({
+            status: 'fail',
+            message: `Invalid JSON in ${path}`,
+            hint: 'Fix the JSON syntax. Validate with a JSON linter or an OpenAPI validator.',
+            learnMoreUrl: guideUrl(meta.id, 'invalid-json'),
+        });
+        return buildResult(meta, 10, findings, start);
+    }
+    findings.push({ status: 'pass', message: 'Valid JSON' });
+    score = validateOpenApi(data, findings, score);
+    return buildResult(meta, score, findings, start);
+}
+/** Shared OpenAPI/Swagger field rules. */
+function validateOpenApi(data, findings, score) {
+    const version = typeof data.openapi === 'string' ? data.openapi : typeof data.swagger === 'string' ? data.swagger : null;
+    if (version === null) {
+        findings.push({
+            status: 'fail',
+            message: 'No "openapi" or "swagger" version field',
+            hint: 'Add an "openapi" field naming the specification version, for example "3.1.0".',
+            learnMoreUrl: guideUrl(meta.id, 'no-version'),
+        });
+        score -= 20;
+    }
+    else if (typeof data.swagger === 'string') {
+        findings.push({
+            status: 'warn',
+            message: `Swagger ${version} rather than OpenAPI 3.x`,
+            hint: 'Convert to OpenAPI 3.1 or 3.2. Tooling support for Swagger 2.0 is fading, and 3.1 aligns with JSON Schema.',
+            learnMoreUrl: guideUrl(meta.id, 'swagger-2'),
+        });
+        score -= 10;
+    }
+    else {
+        findings.push({ status: 'pass', message: `OpenAPI ${version}` });
+        if (version.startsWith('3.2') && data.$self !== undefined) {
+            findings.push({ status: 'pass', message: '$self declared (OpenAPI 3.2 self-identifying document)' });
+        }
+    }
+    const info = (data.info ?? {});
+    if (info.title) {
+        findings.push({ status: 'pass', message: `API title: "${String(info.title)}"` });
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: 'Missing info.title',
+            hint: 'Add info.title naming the API. Agents show it when choosing between tools.',
+            learnMoreUrl: guideUrl(meta.id, 'no-title'),
+        });
+        score -= 10;
+    }
+    if (info.description) {
+        findings.push({ status: 'pass', message: 'API description present' });
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: 'Missing info.description',
+            hint: 'Add info.description explaining what the API does. This is the text an agent reads to decide whether to use it.',
+            learnMoreUrl: guideUrl(meta.id, 'no-description'),
+        });
+        score -= 5;
+    }
+    const paths = (data.paths ?? {});
+    const pathCount = Object.keys(paths).length;
+    if (pathCount > 0) {
+        findings.push({ status: 'pass', message: `${pathCount} path(s) documented` });
+        reportOperationIds(paths, findings);
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: 'No paths documented',
+            hint: 'Document your endpoints under "paths". A description with no operations tells an agent nothing it can act on.',
+            learnMoreUrl: guideUrl(meta.id, 'no-paths'),
+        });
+        score -= 15;
+    }
+    if (Array.isArray(data.servers) && data.servers.length > 0) {
+        findings.push({ status: 'pass', message: `${data.servers.length} server URL(s) declared` });
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: 'No servers declared',
+            hint: 'Add a "servers" array with the base URL. Without it an agent has to guess where to send requests.',
+            learnMoreUrl: guideUrl(meta.id, 'no-servers'),
+        });
+        score -= 5;
+    }
+    const components = (data.components ?? {});
+    if (components.securitySchemes !== undefined || data.security !== undefined) {
+        findings.push({ status: 'pass', message: 'Authentication requirements declared' });
+    }
+    return score;
+}
+/**
+ * Operation ids are how an agent names a call. Informational in 3.x: this is a
+ * new finding inside a weighted check, so it must not deduct.
+ */
+function reportOperationIds(paths, findings) {
+    const methods = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace']);
+    let total = 0;
+    let named = 0;
+    for (const item of Object.values(paths)) {
+        if (typeof item !== 'object' || item === null)
+            continue;
+        for (const [method, op] of Object.entries(item)) {
+            if (!methods.has(method.toLowerCase()))
+                continue;
+            total++;
+            if (typeof op?.operationId === 'string')
+                named++;
+        }
+    }
+    if (total === 0)
+        return;
+    if (named === total) {
+        findings.push({ status: 'pass', message: `All ${total} operations have an operationId` });
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: `${named}/${total} operations have an operationId`,
+            hint: 'Give every operation a stable operationId. Agents and code generators use it as the function name; without one they invent one from the path and it changes under them.',
+            learnMoreUrl: guideUrl(meta.id, 'operation-ids'),
+        });
+    }
+}
+/** Surface-level reporting for a YAML description, clearly labelled as partial. */
+function reportYamlDescription(body, path, findings, score, start) {
+    const version = body.match(/^\s*openapi\s*:\s*["']?([\d.]+)/im);
+    const hasTitle = /^\s{2,}title\s*:/im.test(body);
+    const hasPaths = /^paths\s*:/im.test(body);
+    const hasServers = /^servers\s*:/im.test(body);
+    findings.push({
+        status: 'pass',
+        message: version ? `OpenAPI ${version[1]} (YAML)` : 'YAML API description',
+        detail: 'ax-audit ships no YAML parser, so a YAML description is reported but not fully validated. Publish JSON alongside it for complete checking.',
+    });
+    if (!hasTitle) {
+        findings.push({
+            status: 'warn',
+            message: 'No info.title found in the YAML description',
+            hint: 'Add info.title naming the API.',
+            learnMoreUrl: guideUrl(meta.id, 'no-title'),
+        });
+        score -= 10;
+    }
+    if (!hasPaths) {
+        findings.push({
+            status: 'warn',
+            message: 'No paths section found in the YAML description',
+            hint: 'Document your endpoints under "paths".',
+            learnMoreUrl: guideUrl(meta.id, 'no-paths'),
+        });
+        score -= 15;
+    }
+    if (!hasServers) {
+        findings.push({
+            status: 'warn',
+            message: 'No servers section found in the YAML description',
+            hint: 'Add a "servers" list with the base URL.',
+            learnMoreUrl: guideUrl(meta.id, 'no-servers'),
+        });
+        score -= 5;
+    }
+    if (!version) {
+        findings.push({
+            status: 'warn',
+            message: 'No openapi version field found in the YAML description',
+            hint: 'Add an "openapi" field naming the specification version.',
+            learnMoreUrl: guideUrl(meta.id, 'no-version'),
+        });
+        score -= 20;
+    }
+    void path;
+    return buildResult(meta, score, findings, start);
+}
+//# sourceMappingURL=api-discovery.js.map

package/dist/checks/api-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-discovery.js","sourceRoot":"","sources":["../../src/checks/api-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,+FAA+F;IAC5G,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,CAAC,SAAS,CAAC;CACrB,CAAC;AAIF,MAAM,eAAe,GAA8B;IACjD,aAAa,EAAE,qCAAqC;IACpD,aAAa,EAAE,gCAAgC;IAC/C,WAAW,EAAE,2BAA2B;IACxC,mBAAmB,EAAE,wBAAwB;CAC9C,CAAC;AAQF,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,GAAiB;IACrC,0CAA0C;IAC1C,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc;YAAE,SAAS;QACrD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,cAAc,CAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,4DAA4D;gBACrE,MAAM,EACJ,wGAAwG;oBACxG,uCAAuC;aAC1C,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+DAA+D;YACxE,MAAM,EAAE,uBAAuB,OAAO,CAAC,MAAM,+EAA+E,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC9J,IAAI,EACF,8GAA8G;gBAC9G,2FAA2F;gBAC3F,2FAA2F;YAC7F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,4BAA4B,KAAK,CAAC,IAAI,QAAQ,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QACzF,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,IAAI,EACF,4GAA4G;gBAC5G,gHAAgH;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,GAAkB,EAAE,QAAmB,EAAE,KAAa;IAC3E,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,GAAG;YACxF,MAAM,EAAE,iCAAiC,kBAAkB,GAAG;YAC9D,IAAI,EAAE,wBAAwB,kBAAkB,GAAG;YACnD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4CAA4C;YACrD,IAAI,EAAE,kDAAkD;YACxD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8CAA8C;YACvD,IAAI,EAAE,uFAAuF;YAC7F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,8BAA8B,OAAO,CAAC,MAAM,SAAS;QAC9D,MAAM,EAAE,YAAY,CAAC,0BAA0B,CAAC;KACjD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/F,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,uCAAuC;YAC3D,IAAI,EAAE,yEAAyE;YAC/E,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,MAAM,8CAA8C;YAChE,IAAI,EAAE,oHAAoH;YAC1H,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAgB,EAAE,QAAmB,EAAE,KAAa,EAAE,KAAa;IAC9F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAC5D,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,oBAAoB;SAC7B,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,0EAA0E;QAC1E,2EAA2E;QAC3E,mEAAmE;QACnE,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,IAAI,EAAE;YAClC,IAAI,EAAE,2EAA2E;YACjF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAEzD,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,0CAA0C;AAC1C,SAAS,eAAe,CAAC,IAA6B,EAAE,QAAmB,EAAE,KAAa;IACxF,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3G,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,+EAA+E;YACrF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,OAAO,0BAA0B;YACrD,IAAI,EAAE,4GAA4G;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAC1D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EAAE,4EAA4E;YAClF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,iHAAiH;YACvH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAAC,CAAC;QAC9E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,+GAA+G;YACrH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,mGAAmG;YACzG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IACtE,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAA8B,EAAE,QAAmB;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACxD,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAS;YACjD,KAAK,EAAE,CAAC;YACR,IAAI,OAAQ,EAA8B,EAAE,WAAW,KAAK,QAAQ;gBAAE,KAAK,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO;IACxB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,iCAAiC,EAAE,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,IAAI,KAAK,iCAAiC;YAC3D,IAAI,EAAE,yKAAyK;YAC/K,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,qBAAqB,CAC5B,IAAY,EACZ,IAAY,EACZ,QAAmB,EACnB,KAAa,EACb,KAAa;IAEb,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB;QAC1E,MAAM,EACJ,4IAA4I;KAC/I,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6CAA6C;YACtD,IAAI,EAAE,gCAAgC;YACtC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,wCAAwC;YAC9C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,yCAAyC;YAC/C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE,0DAA0D;YAChE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK,IAAI,CAAC;IACV,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/checks/auth-discovery.d.ts

@@ -0,0 +1,28 @@
+import type { CheckContext, CheckResult, CheckMeta, FetchResponse } from '../types.js';
+/**
+ * "auth-discovery" — if an agent needs credentials here, can it work out how to
+ * get them?
+ *
+ * A human hitting a 401 goes and reads the documentation. An agent cannot. It
+ * needs the answer in the response: which authorization server to talk to, what
+ * scopes exist, where to register. That is what RFC 9728 Protected Resource
+ * Metadata is for, and the MCP specification makes it mandatory for remote
+ * servers precisely because agents cannot read docs.
+ *
+ * The chain is: a `401` carrying `WWW-Authenticate` with a `resource_metadata`
+ * parameter, or `/.well-known/oauth-protected-resource`, naming one or more
+ * authorization servers; each of those exposing RFC 8414 metadata at
+ * `/.well-known/oauth-authorization-server` or OpenID discovery at
+ * `/.well-known/openid-configuration`.
+ *
+ * This check is conditional. A site with no API, no MCP server and no commerce
+ * profile has nothing to authorize, and demanding OAuth metadata from a blog
+ * would be noise. It reports N/A unless one of those surfaces exists.
+ */
+export declare const meta: CheckMeta;
+/** Read the `resource_metadata` parameter out of a `WWW-Authenticate` challenge. */
+export declare function resourceMetadataFromChallenge(header: string): string | null;
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+/** Exposed for tests that build a metadata response directly. */
+export type { FetchResponse };
+//# sourceMappingURL=auth-discovery.d.ts.map

package/dist/checks/auth-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-discovery.d.ts","sourceRoot":"","sources":["../../src/checks/auth-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,aAAa,EAAE,MAAM,aAAa,CAAC;AAIhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAmCF,oFAAoF;AACpF,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiF3E;AA4FD,iEAAiE;AACjE,YAAY,EAAE,aAAa,EAAE,CAAC"}