ax-audit 3.6.0 → 4.0.0

package/dist/checks/auth-discovery.js

@@ -0,0 +1,213 @@
+import { guideUrl } from '../guide-urls.js';
+import { buildResult, isHtmlDocument, notApplicable } from './utils.js';
+import { standingNote } from './well-known.js';
+/**
+ * "auth-discovery" — if an agent needs credentials here, can it work out how to
+ * get them?
+ *
+ * A human hitting a 401 goes and reads the documentation. An agent cannot. It
+ * needs the answer in the response: which authorization server to talk to, what
+ * scopes exist, where to register. That is what RFC 9728 Protected Resource
+ * Metadata is for, and the MCP specification makes it mandatory for remote
+ * servers precisely because agents cannot read docs.
+ *
+ * The chain is: a `401` carrying `WWW-Authenticate` with a `resource_metadata`
+ * parameter, or `/.well-known/oauth-protected-resource`, naming one or more
+ * authorization servers; each of those exposing RFC 8414 metadata at
+ * `/.well-known/oauth-authorization-server` or OpenID discovery at
+ * `/.well-known/openid-configuration`.
+ *
+ * This check is conditional. A site with no API, no MCP server and no commerce
+ * profile has nothing to authorize, and demanding OAuth metadata from a blog
+ * would be noise. It reports N/A unless one of those surfaces exists.
+ */
+export const meta = {
+    id: 'auth-discovery',
+    name: 'Auth Discovery',
+    description: 'Checks OAuth metadata (RFC 9728 / RFC 8414) so agents can authenticate without documentation',
+    category: 'protocols',
+};
+const PROTECTED_RESOURCE = '/.well-known/oauth-protected-resource';
+const AUTHORIZATION_SERVER = '/.well-known/oauth-authorization-server';
+const OPENID_CONFIGURATION = '/.well-known/openid-configuration';
+/** Paths that indicate the site has something worth authorizing. */
+const SURFACE_PROBES = [
+    { path: '/openapi.json', label: 'an OpenAPI description' },
+    { path: '/.well-known/openapi.json', label: 'an OpenAPI description' },
+    { path: '/.well-known/api-catalog', label: 'an API catalog' },
+    { path: '/.well-known/mcp/server-card.json', label: 'an MCP server card' },
+    { path: '/mcp/server-card', label: 'an MCP server card' },
+    { path: '/.well-known/ucp', label: 'a commerce profile' },
+];
+async function fetchJson(ctx, url) {
+    const res = await ctx.fetch(url);
+    if (!res.ok || res.body.trim().length === 0 || isHtmlDocument(res.body))
+        return null;
+    try {
+        return JSON.parse(res.body);
+    }
+    catch {
+        return null;
+    }
+}
+/** Does this site expose anything an agent would need credentials for? */
+async function findSurface(ctx) {
+    for (const probe of SURFACE_PROBES) {
+        const res = await ctx.fetch(`${ctx.url}${probe.path}`);
+        if (res.ok && res.body.trim().length > 0 && !isHtmlDocument(res.body))
+            return probe.label;
+    }
+    return null;
+}
+/** Read the `resource_metadata` parameter out of a `WWW-Authenticate` challenge. */
+export function resourceMetadataFromChallenge(header) {
+    const match = header.match(/resource_metadata\s*=\s*"([^"]+)"/i);
+    return match ? match[1] : null;
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    // A 401 on the homepage means the whole site is gated, which is the strongest
+    // possible signal that auth discovery matters here.
+    const challenge = ctx.headers?.['www-authenticate'];
+    const metadataUrl = challenge === undefined ? null : resourceMetadataFromChallenge(challenge);
+    if (metadataUrl !== null) {
+        findings.push({
+            status: 'pass',
+            message: 'WWW-Authenticate points at protected-resource metadata',
+            detail: metadataUrl,
+        });
+    }
+    const resource = (metadataUrl !== null ? await fetchJson(ctx, metadataUrl) : null) ??
+        (await fetchJson(ctx, `${ctx.url}${PROTECTED_RESOURCE}`));
+    if (resource === null) {
+        const surface = await findSurface(ctx);
+        if (surface === null) {
+            findings.push({
+                status: 'pass',
+                message: 'Nothing on this site requires authorization — auth discovery does not apply',
+                detail: 'No API description, API catalog, MCP server card or commerce profile found.',
+            });
+            return notApplicable(meta, findings, start);
+        }
+        findings.push({
+            status: 'warn',
+            message: `Site exposes ${surface} but publishes no OAuth metadata`,
+            detail: `Checked WWW-Authenticate resource_metadata and ${PROTECTED_RESOURCE}. ${standingNote(PROTECTED_RESOURCE) ?? ''}`.trim(),
+            hint: 'If any of that surface needs credentials, an agent hitting a 401 has nowhere to look — it cannot read your ' +
+                'documentation. Publish RFC 9728 metadata at /.well-known/oauth-protected-resource naming your authorization ' +
+                'server. If everything is public, this is nothing to fix.',
+            learnMoreUrl: guideUrl(meta.id, 'not-found'),
+        });
+        return buildResult(meta, 0, findings, start);
+    }
+    findings.push({
+        status: 'pass',
+        message: 'Protected-resource metadata published (RFC 9728)',
+        detail: standingNote(PROTECTED_RESOURCE),
+    });
+    const servers = Array.isArray(resource.authorization_servers)
+        ? resource.authorization_servers.map(String)
+        : [];
+    if (servers.length === 0) {
+        findings.push({
+            status: 'fail',
+            message: 'Protected-resource metadata names no authorization server',
+            hint: 'Add "authorization_servers": ["https://auth.example.com"]. Without it the metadata says a token is needed but not where to get one.',
+            learnMoreUrl: guideUrl(meta.id, 'no-authorization-servers'),
+        });
+        return buildResult(meta, 40, findings, start);
+    }
+    findings.push({ status: 'pass', message: `${servers.length} authorization server(s) named` });
+    if (resource.resource === undefined) {
+        findings.push({
+            status: 'warn',
+            message: 'Protected-resource metadata declares no "resource" identifier',
+            hint: 'Declare the canonical resource URI so a client can request a token audienced correctly.',
+            learnMoreUrl: guideUrl(meta.id, 'no-resource'),
+        });
+        score -= 10;
+    }
+    score = await validateAuthorizationServer(ctx, servers[0], findings, score);
+    return buildResult(meta, score, findings, start);
+}
+/** Follow the first authorization server and check it can actually be used. */
+async function validateAuthorizationServer(ctx, issuer, findings, score) {
+    let base;
+    try {
+        base = new URL(issuer).origin;
+    }
+    catch {
+        findings.push({
+            status: 'fail',
+            message: `Authorization server "${issuer}" is not a valid URL`,
+            hint: 'Authorization server entries are absolute https URLs.',
+            learnMoreUrl: guideUrl(meta.id, 'invalid-issuer'),
+        });
+        return score - 25;
+    }
+    const metadata = (await fetchJson(ctx, `${base}${AUTHORIZATION_SERVER}`)) ??
+        (await fetchJson(ctx, `${base}${OPENID_CONFIGURATION}`));
+    if (metadata === null) {
+        findings.push({
+            status: 'fail',
+            message: `Authorization server ${base} publishes no discovery metadata`,
+            detail: `Checked ${AUTHORIZATION_SERVER} and ${OPENID_CONFIGURATION}`,
+            hint: 'The chain stops here: an agent knows which server to ask but not which endpoints it has. Publish RFC 8414 or OpenID discovery metadata.',
+            learnMoreUrl: guideUrl(meta.id, 'no-server-metadata'),
+        });
+        return score - 30;
+    }
+    findings.push({ status: 'pass', message: `Authorization server ${base} publishes discovery metadata` });
+    for (const field of ['issuer', 'authorization_endpoint', 'token_endpoint']) {
+        if (metadata[field] !== undefined)
+            continue;
+        findings.push({
+            status: 'fail',
+            message: `Authorization server metadata is missing "${field}"`,
+            hint: `An OAuth client cannot complete a flow without ${field}.`,
+            learnMoreUrl: guideUrl(meta.id, 'incomplete-server-metadata'),
+        });
+        score -= 15;
+    }
+    const pkce = Array.isArray(metadata.code_challenge_methods_supported)
+        ? metadata.code_challenge_methods_supported.map(String)
+        : [];
+    if (!pkce.includes('S256')) {
+        findings.push({
+            status: 'warn',
+            message: 'Authorization server does not advertise PKCE with S256',
+            hint: 'Agents are public clients: they hold no secret, so PKCE is the only thing standing between an intercepted ' +
+                'authorization code and a stolen session. Advertise code_challenge_methods_supported: ["S256"].',
+            learnMoreUrl: guideUrl(meta.id, 'no-pkce'),
+        });
+        score -= 15;
+    }
+    else {
+        findings.push({ status: 'pass', message: 'PKCE with S256 supported' });
+    }
+    // Agents appear without warning and cannot fill in a registration form, so
+    // either dynamic registration or client-ID metadata documents keeps them out
+    // of a manual onboarding queue.
+    const dynamic = metadata.registration_endpoint !== undefined;
+    const cimd = metadata.client_id_metadata_document_supported === true;
+    if (dynamic || cimd) {
+        findings.push({
+            status: 'pass',
+            message: dynamic ? 'Dynamic client registration supported' : 'Client ID Metadata Documents supported',
+        });
+    }
+    else {
+        findings.push({
+            status: 'warn',
+            message: 'No automated client registration',
+            hint: 'Without dynamic registration or Client ID Metadata Documents, every new agent needs a human to register it ' +
+                'first. That is a queue, not an integration.',
+            learnMoreUrl: guideUrl(meta.id, 'no-registration'),
+        });
+        score -= 10;
+    }
+    return score;
+}
+//# sourceMappingURL=auth-discovery.js.map

package/dist/checks/auth-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-discovery.js","sourceRoot":"","sources":["../../src/checks/auth-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,8FAA8F;IAC3G,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AACnE,MAAM,oBAAoB,GAAG,yCAAyC,CAAC;AACvE,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AAEjE,oEAAoE;AACpE,MAAM,cAAc,GAAG;IACrB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAC1D,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACtE,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC7D,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC1E,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACzD,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE;CAC1D,CAAC;AAEF,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,GAAW;IACrD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,WAAW,CAAC,GAAiB;IAC1C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,8EAA8E;IAC9E,oDAAoD;IACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;IAC9F,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GACZ,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,6EAA6E;gBACtF,MAAM,EAAE,6EAA6E;aACtF,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,OAAO,kCAAkC;YAClE,MAAM,EACJ,kDAAkD,kBAAkB,KAAK,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC1H,IAAI,EACF,6GAA6G;gBAC7G,8GAA8G;gBAC9G,0DAA0D;YAC5D,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,kDAAkD;QAC3D,MAAM,EAAE,YAAY,CAAC,kBAAkB,CAAC;KACzC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3D,CAAC,CAAE,QAAQ,CAAC,qBAAmC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,qIAAqI;YAC3I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,gCAAgC,EAAE,CAAC,CAAC;IAE9F,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,yFAAyF;YAC/F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE5E,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,2BAA2B,CACxC,GAAiB,EACjB,MAAc,EACd,QAAmB,EACnB,KAAa;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yBAAyB,MAAM,sBAAsB;YAC9D,IAAI,EAAE,uDAAuD;YAC7D,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GACZ,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE,CAAC,CAAC;QACxD,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAE3D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wBAAwB,IAAI,kCAAkC;YACvE,MAAM,EAAE,WAAW,oBAAoB,QAAQ,oBAAoB,EAAE;YACrE,IAAI,EAAE,yIAAyI;YAC/I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,CAAC,CAAC;IAExG,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6CAA6C,KAAK,GAAG;YAC9D,IAAI,EAAE,kDAAkD,KAAK,GAAG;YAChE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,4BAA4B,CAAC;SAC9D,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACnE,CAAC,CAAE,QAAQ,CAAC,gCAA8C,CAAC,GAAG,CAAC,MAAM,CAAC;QACtE,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,IAAI,EACF,4GAA4G;gBAC5G,gGAAgG;YAClG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IACrE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,wCAAwC;SACtG,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EACF,6GAA6G;gBAC7G,6CAA6C;YAC/C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/checks/commerce-discovery.d.ts

@@ -0,0 +1,40 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "commerce-discovery" — can an agent buy from this site without a human
+ * driving the checkout?
+ *
+ * The Universal Commerce Protocol is the one agentic-commerce specification
+ * with a published site-side discovery mechanism: a public profile at
+ * `/.well-known/ucp` declaring which commerce services the merchant offers,
+ * over which transports, against which schemas, and which payment handlers it
+ * accepts. Google leads it, with Shopify, Etsy, Walmart and Stripe
+ * participating.
+ *
+ * The alternatives deliberately have nothing to probe. OpenAI and Stripe's
+ * Agentic Commerce Protocol states outright that it defines no discovery
+ * endpoint or manifest — merchants are onboarded per platform. Google's AP2
+ * advertises itself as an A2A capability extension, not a file. So this check
+ * covers UCP and says plainly that the others are not discoverable rather than
+ * inventing paths for them.
+ *
+ * It is conditional. Most sites do not sell anything, and scoring a
+ * documentation site zero for lacking a commerce profile would be nonsense. The
+ * check reports N/A unless the page shows commerce signals: `Product` or `Offer`
+ * structured data, or links into a cart or checkout.
+ */
+export declare const meta: CheckMeta;
+/**
+ * Evidence that this site has a storefront an agent could transact against.
+ *
+ * The distinction that matters is between selling and pricing. A SaaS landing
+ * page routinely carries a lone `Offer` describing its plans; that is a price
+ * statement, not a catalog, and telling such a site to publish a commerce
+ * profile would be wrong. So a bare `Offer` counts only alongside a second
+ * signal, while an unambiguous storefront type stands on its own.
+ */
+export declare function hasCommerceSignals(html: string): {
+    found: boolean;
+    evidence: string[];
+};
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+//# sourceMappingURL=commerce-discovery.d.ts.map

package/dist/checks/commerce-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commerce-discovery.d.ts","sourceRoot":"","sources":["../../src/checks/commerce-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAuBvF;AAED,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAsF3E"}

package/dist/checks/commerce-discovery.js

@@ -0,0 +1,295 @@
+import { guideUrl } from '../guide-urls.js';
+import { buildResult, isHtmlDocument, notApplicable } from './utils.js';
+import { standingNote } from './well-known.js';
+import { findJsonLdBlocks } from './html-utils.js';
+import { forcedBy, profileFrom } from './surface.js';
+/**
+ * "commerce-discovery" — can an agent buy from this site without a human
+ * driving the checkout?
+ *
+ * The Universal Commerce Protocol is the one agentic-commerce specification
+ * with a published site-side discovery mechanism: a public profile at
+ * `/.well-known/ucp` declaring which commerce services the merchant offers,
+ * over which transports, against which schemas, and which payment handlers it
+ * accepts. Google leads it, with Shopify, Etsy, Walmart and Stripe
+ * participating.
+ *
+ * The alternatives deliberately have nothing to probe. OpenAI and Stripe's
+ * Agentic Commerce Protocol states outright that it defines no discovery
+ * endpoint or manifest — merchants are onboarded per platform. Google's AP2
+ * advertises itself as an A2A capability extension, not a file. So this check
+ * covers UCP and says plainly that the others are not discoverable rather than
+ * inventing paths for them.
+ *
+ * It is conditional. Most sites do not sell anything, and scoring a
+ * documentation site zero for lacking a commerce profile would be nonsense. The
+ * check reports N/A unless the page shows commerce signals: `Product` or `Offer`
+ * structured data, or links into a cart or checkout.
+ */
+export const meta = {
+    id: 'commerce-discovery',
+    name: 'Commerce Discovery',
+    description: 'Checks the Universal Commerce Protocol profile for agent-driven purchasing',
+    category: 'protocols',
+};
+/** UCP profile paths, in the order the specification and Google's docs use. */
+const PROFILE_PATHS = ['/.well-known/ucp', '/.well-known/ucp.json'];
+/** Capability names the specification defines, for reporting unknown ones. */
+const KNOWN_CAPABILITY_PREFIX = 'dev.ucp.';
+/**
+ * Evidence that this site has a storefront an agent could transact against.
+ *
+ * The distinction that matters is between selling and pricing. A SaaS landing
+ * page routinely carries a lone `Offer` describing its plans; that is a price
+ * statement, not a catalog, and telling such a site to publish a commerce
+ * profile would be wrong. So a bare `Offer` counts only alongside a second
+ * signal, while an unambiguous storefront type stands on its own.
+ */
+export function hasCommerceSignals(html) {
+    const evidence = [];
+    let weakOffer = false;
+    for (const block of findJsonLdBlocks(html)) {
+        if (/"@type"\s*:\s*"(Product|AggregateOffer|OnlineStore|OnlineMarketplace|ItemList)"/i.test(block)) {
+            evidence.push('Product or storefront structured data');
+            break;
+        }
+        if (/"@type"\s*:\s*"Offer"/i.test(block))
+            weakOffer = true;
+    }
+    const hasCart = /<a\b[^>]+href\s*=\s*["'][^"']*\/(cart|checkout|basket|bag)\b/i.test(html);
+    if (hasCart)
+        evidence.push('links to a cart or checkout');
+    if (/<meta\b[^>]+property\s*=\s*["']product:price:amount["']/i.test(html)) {
+        evidence.push('product price Open Graph tags');
+    }
+    // A lone Offer is a plan price. Paired with a cart, it is a storefront.
+    if (weakOffer && evidence.length > 0)
+        evidence.push('Offer structured data');
+    return { found: evidence.length > 0, evidence };
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    let profile = null;
+    for (const path of PROFILE_PATHS) {
+        const res = await ctx.fetch(`${ctx.url}${path}`);
+        if (res.ok && res.body.trim().length > 0 && !isHtmlDocument(res.body)) {
+            profile = { path, body: res.body, headers: res.headers };
+            break;
+        }
+        // A profile behind auth is a specification violation worth reporting, since
+        // an agent has no credentials at discovery time.
+        if (res.status === 401 || res.status === 403) {
+            findings.push({
+                status: 'fail',
+                message: `${path} requires authentication`,
+                detail: `HTTP ${res.status}`,
+                hint: 'The UCP profile must be publicly accessible with no authentication. An agent reads it before it has any credentials.',
+                learnMoreUrl: guideUrl(meta.id, 'profile-auth'),
+            });
+            return buildResult(meta, 0, findings, start);
+        }
+    }
+    if (profile === null) {
+        const commerce = hasCommerceSignals(ctx.html ?? '');
+        if (!commerce.found && !forcedBy(profileFrom(ctx), 'commerce')) {
+            findings.push({
+                status: 'pass',
+                message: 'No commerce surface — agentic-commerce discovery does not apply to this site',
+                detail: 'No Product or Offer structured data, cart links, or product price tags found.',
+            });
+            return notApplicable(meta, findings, start);
+        }
+        findings.push({
+            status: 'warn',
+            message: 'Site sells something but publishes no agent-readable commerce profile',
+            detail: `Commerce signals found: ${commerce.evidence.join(', ')}. Checked ${PROFILE_PATHS.join(', ')}.`,
+            hint: 'Publish a Universal Commerce Protocol profile at /.well-known/ucp so an agent can find your catalog, cart and ' +
+                'checkout without a human. Note that the alternatives are not discoverable by design: the OpenAI and Stripe ' +
+                'Agentic Commerce Protocol defines no manifest, and AP2 advertises itself through an A2A card extension.',
+            learnMoreUrl: guideUrl(meta.id, 'not-found'),
+        });
+        return buildResult(meta, 0, findings, start);
+    }
+    findings.push({
+        status: 'pass',
+        message: `UCP profile published at ${profile.path}`,
+        detail: standingNote(profile.path),
+    });
+    let data;
+    try {
+        data = JSON.parse(profile.body);
+    }
+    catch {
+        findings.push({
+            status: 'fail',
+            message: 'UCP profile is not valid JSON',
+            hint: 'Fix the JSON syntax. An agent cannot transact against a profile it cannot parse.',
+            learnMoreUrl: guideUrl(meta.id, 'invalid-json'),
+        });
+        return buildResult(meta, 10, findings, start);
+    }
+    const ucp = (data.ucp ?? {});
+    if (Object.keys(ucp).length === 0) {
+        findings.push({
+            status: 'fail',
+            message: 'UCP profile has no "ucp" object',
+            hint: 'The profile wraps everything in a top-level "ucp" object carrying version, services and payment_handlers.',
+            learnMoreUrl: guideUrl(meta.id, 'no-ucp-object'),
+        });
+        return buildResult(meta, 20, findings, start);
+    }
+    score = validateVersion(ucp, findings, score);
+    score = await validateServices(ctx, ucp, findings, score);
+    score = validatePayments(ucp, findings, score);
+    score = validateKeys(data, ucp, findings, score);
+    return buildResult(meta, score, findings, start);
+}
+/** The version is a spec date, and it tells a client which shape to expect. */
+function validateVersion(ucp, findings, score) {
+    const version = typeof ucp.version === 'string' ? ucp.version : null;
+    if (version === null) {
+        findings.push({
+            status: 'fail',
+            message: 'UCP profile declares no version',
+            hint: 'Add "version" with the specification date you implement, for example "2026-08-25".',
+            learnMoreUrl: guideUrl(meta.id, 'no-version'),
+        });
+        return score - 20;
+    }
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(version)) {
+        findings.push({
+            status: 'warn',
+            message: `UCP version "${version}" is not a specification date`,
+            hint: 'UCP versions are dates, for example "2026-08-25". A semantic version here will not match any published revision.',
+            learnMoreUrl: guideUrl(meta.id, 'version-format'),
+        });
+        return score - 10;
+    }
+    findings.push({ status: 'pass', message: `UCP version ${version}` });
+    return score;
+}
+/** Services declare what an agent may do and where. Their schemas must resolve. */
+async function validateServices(ctx, ucp, findings, score) {
+    const services = (ucp.services ?? {});
+    const names = Object.keys(services);
+    if (names.length === 0) {
+        findings.push({
+            status: 'fail',
+            message: 'UCP profile declares no services',
+            hint: 'Declare at least one service, for example dev.ucp.shopping, with its transports and schema URLs.',
+            learnMoreUrl: guideUrl(meta.id, 'no-services'),
+        });
+        return score - 25;
+    }
+    findings.push({ status: 'pass', message: `${names.length} commerce service(s) declared: ${names.join(', ')}` });
+    const unprefixed = names.filter((n) => !n.startsWith(KNOWN_CAPABILITY_PREFIX) && !n.includes('.'));
+    if (unprefixed.length > 0) {
+        findings.push({
+            status: 'warn',
+            message: 'Service name is not in reverse-DNS form',
+            detail: unprefixed.join(', '),
+            hint: 'Service names are reverse-DNS so vendors cannot collide, for example dev.ucp.shopping.',
+            learnMoreUrl: guideUrl(meta.id, 'service-name'),
+        });
+        score -= 5;
+    }
+    // Resolve the schema URLs the profile promises. A profile pointing at a
+    // missing schema is a transaction an agent starts and cannot finish.
+    const schemas = [];
+    for (const value of Object.values(services)) {
+        collectSchemaUrls(value, schemas);
+    }
+    if (schemas.length === 0) {
+        findings.push({
+            status: 'warn',
+            message: 'No service declares a schema URL',
+            hint: 'Each transport should point at the schema describing its operations, so an agent knows the request shapes.',
+            learnMoreUrl: guideUrl(meta.id, 'no-schema'),
+        });
+        return score - 10;
+    }
+    const dead = [];
+    for (const url of schemas.slice(0, 3)) {
+        const head = await ctx.fetch(url, { method: 'HEAD' });
+        const res = head.status === 405 || head.status === 501 ? await ctx.fetch(url) : head;
+        if (!res.ok)
+            dead.push(`${url} (HTTP ${res.status || 'network error'})`);
+    }
+    if (dead.length > 0) {
+        findings.push({
+            status: 'fail',
+            message: `${dead.length} declared schema URL(s) cannot be fetched`,
+            detail: dead.join('\n'),
+            hint: 'An agent reads the schema before it builds a request. A dead schema is a transaction it starts and cannot finish.',
+            learnMoreUrl: guideUrl(meta.id, 'dead-schema'),
+        });
+        score -= 20;
+    }
+    else {
+        findings.push({ status: 'pass', message: `${Math.min(schemas.length, 3)} declared schema URL(s) resolve` });
+    }
+    return score;
+}
+/** Walk a service definition for `schema` URLs, whatever transport shape it uses. */
+function collectSchemaUrls(value, into) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSchemaUrls(item, into);
+        return;
+    }
+    if (typeof value !== 'object' || value === null)
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (key === 'schema' && typeof child === 'string' && /^https?:\/\//.test(child)) {
+            into.push(child);
+            continue;
+        }
+        collectSchemaUrls(child, into);
+    }
+}
+/** Without a payment handler, an agent can browse but not buy. */
+function validatePayments(ucp, findings, score) {
+    const handlers = ucp.payment_handlers ?? ucp.payment?.handlers;
+    const list = Array.isArray(handlers) ? handlers : [];
+    if (list.length === 0) {
+        findings.push({
+            status: 'warn',
+            message: 'UCP profile declares no payment handlers',
+            hint: 'Without a payment handler an agent can read your catalog but cannot complete a purchase. Declare the handlers you accept.',
+            learnMoreUrl: guideUrl(meta.id, 'no-payment-handlers'),
+        });
+        return score - 15;
+    }
+    const named = list.map((h) => String(h.name ?? '(unnamed)'));
+    findings.push({ status: 'pass', message: `${list.length} payment handler(s): ${named.join(', ')}` });
+    const unnamed = list.filter((h) => h.name === undefined).length;
+    if (unnamed > 0) {
+        findings.push({
+            status: 'warn',
+            message: `${unnamed} payment handler(s) have no name`,
+            hint: 'Each handler needs a name so an agent can match it against the payment methods it holds.',
+            learnMoreUrl: guideUrl(meta.id, 'unnamed-handler'),
+        });
+        score -= 5;
+    }
+    return score;
+}
+/** Signing keys let an agent verify the profile belongs to the merchant. */
+function validateKeys(data, ucp, findings, score) {
+    const keys = data.keys ?? data.signing_keys ?? ucp.keys ?? ucp.signing_keys;
+    const list = Array.isArray(keys) ? keys : [];
+    if (list.length === 0) {
+        findings.push({
+            status: 'warn',
+            message: 'UCP profile declares no signing keys',
+            hint: 'Publish the public keys an agent uses to verify your responses. Money is moving; identity should not rest on DNS alone.',
+            learnMoreUrl: guideUrl(meta.id, 'no-keys'),
+        });
+        return score - 10;
+    }
+    findings.push({ status: 'pass', message: `${list.length} signing key(s) published` });
+    return score;
+}
+//# sourceMappingURL=commerce-discovery.js.map

package/dist/checks/commerce-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commerce-discovery.js","sourceRoot":"","sources":["../../src/checks/commerce-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,4EAA4E;IACzF,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,kFAAkF,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnG,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,MAAM;QACR,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAE1D,IAAI,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjD,CAAC;IAED,wEAAwE;IACxE,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAE7E,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,IAAI,OAAO,GAA2E,IAAI,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM;QACR,CAAC;QACD,4EAA4E;QAC5E,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,IAAI,0BAA0B;gBAC1C,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;gBAC5B,IAAI,EAAE,sHAAsH;gBAC5H,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,8EAA8E;gBACvF,MAAM,EAAE,+EAA+E;aACxF,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uEAAuE;YAChF,MAAM,EAAE,2BAA2B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACvG,IAAI,EACF,gHAAgH;gBAChH,6GAA6G;gBAC7G,yGAAyG;YAC3G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,4BAA4B,OAAO,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAA4B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+BAA+B;YACxC,IAAI,EAAE,kFAAkF;YACxF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,2GAA2G;YACjH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEjD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,GAA4B,EAAE,QAAmB,EAAE,KAAa;IACvF,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,oFAAoF;YAC1F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,OAAO,+BAA+B;YAC/D,IAAI,EAAE,kHAAkH;YACxH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,OAAO,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,gBAAgB,CAC7B,GAAiB,EACjB,GAA4B,EAC5B,QAAmB,EACnB,KAAa;IAEb,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,kGAAkG;YACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhH,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yCAAyC;YAClD,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,wFAAwF;YAC9F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,4GAA4G;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,MAAM,IAAI,eAAe,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,2CAA2C;YAClE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,EAAE,mHAAmH;YACzH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,iCAAiC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAc;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAExD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,GAA4B,EAAE,QAAmB,EAAE,KAAa;IACxF,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,IAAK,GAAG,CAAC,OAA+C,EAAE,QAAQ,CAAC;IACxG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0CAA0C;YACnD,IAAI,EAAE,2HAA2H;YACjI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAErG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,OAAO,kCAAkC;YACrD,IAAI,EAAE,0FAA0F;YAChG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CACnB,IAA6B,EAC7B,GAA4B,EAC5B,QAAmB,EACnB,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,yHAAyH;YAC/H,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/checks/content-negotiation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-negotiation.d.ts","sourceRoot":"","sources":["../../src/checks/content-negotiation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAIjF,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAyBF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAuH3E"}
+{"version":3,"file":"content-negotiation.d.ts","sourceRoot":"","sources":["../../src/checks/content-negotiation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAKjF,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAyCF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6G3E"}